user acceptance - mako networks · pdf filea series of user acceptance tests that can ......

• UAT 1 WWW.MAKONETWORKS.COM

User AcceptanceTests for the CMS

The Mako System combines a web server driven configuration, management and reporting user interface. The system uses client-end hardware to provide users with considerable cost savings as well as functionality and flexibility not currently available in traditional devices used to meet either the same or similar requirements.

All interaction takes place on the Mako Central Management Severs via the web-based management and reporting console. The system is powerful but not unnecessarily complex to use. From initial configuration to daily changes through to viewing of reports, all interface with the Mako System takes place via the secure website.

This document provides the reader with a series of User Acceptance Tests that can assist with exposing the core functionality of the Mako System. A certain level of technical expertise is required. You should have a basic understanding of TCP/IP and have experience with configuring and/or managing routers or firewalls.

By default, tests are available for all users. However, some tests may only be done by resellers, and are labeled accordingly.

All interactions with the management platform will have up to a two minute delay before the CPE itself is updated. The CPE will poll the management platform for changes within the two minute window.

Some significant changes may trigger a software update for the device; an example of this behavior is if the user changes IP addressing information on the WAN interface. The device will update it stored configuration file to reflect the changes.

Failover configuration changes are delayed by 10 minutes to ensure the devices are synchronised. It is recommended USB Key configuration files (discussed later in this document) are used after enabling the failover service.

A Web Access Control (WAC) server is required for optimum Mako Guardian performance. Testing without this may result in increased latency when browsing websites.

Overview

Hardware PrerequisitesYou will need the following:

n A Mako device

n Cabling to suit.

Document ReferenceThe following documents should be referenced for additional configuration information.

n Mako CMS Manual

n Mako Guardian Handbook

n 6500 Product Handbooks


1 Management 31.1 Creating a company profile (Reseller Only) 31.2 Adding a Mako to a company (Reseller Only) 3

2 Connectivity Configuration 42.1 ADSL WAN, PPP Configuration 42.2 Ethernet WAN, IP Configuration 42.3 Cellular WAN 52.4 Adding IP Range 52.5 Configuring Alerts 52.6 Configuring Network LAN 1 62.7 Configuring Network LAN 2 62.8 Configuring DHCP Leases 62.9 Configuring Static Routes 6

3 Firewall Configuration 73.1 Inbound Basic Rule 73.2 Inbound Advanced Rule 73.3 Outbound Basic Rule 73.4 Configuring Firewall - Outbound Advanced 83.5 Configuring Firewall - Intranet Basic 83.6 Configuring Firewall - Intranet Advanced 83.7 Configuring Firewall - VPN Basic 93.8 VPN Advanced Rule 9

4 VPN and Remote Access Configuration 104.1 Mako to Mako IPSec VPN 104.2 Add Third Party Device 104.3 Delete Third Party Device 104.4 Mako to Third Party IPSec VPN 114.5 PPTP Configuration 114.6 Adding VPN User 114.7 Enabling Remote Access 12

5 Quality of Service 125.1 Adding a service to a QoS Bin 125.2 Removing a service from a QoS Bin 125.3 Adding a QoS Bin 125.4 Removing a QoS Bin 125.5 Managing QoS Bin bandwidth allocations. 12

6 VPN Cloud 136.1 Creating a VPN Cloud 136.2 Joining a VPN Cloud 136.3 Editing your Mako's options for its VPN Cloud 146.4 Simple Diagnostics on VPN Cloud 14

7 Mako Guardian 157.1 Category Management 157.2 Default Site Categories 157.3 Custom Sites 157.4 Custom Sites Banned URL Expression 167.5 Custom Categories 167.6 Custom Category Edit 177.7 Phrases Management 177.8 Custom Phrases 187.9 Weighted Phrase Configuration 187.10 User and Group Options 187.11 Users and Groups - LDAP 197.12 Users and Groups - Local Users 197.13 Create Local Group 207.14 Create IP Group 207.15 Create LDAP Group 207.16 Add Local User to Local Group 217.17 Add IP Address to IP Based Group 217.18 Banned File Extensions 217.19 MIME Types 227.20 Create Time 227.21 Exceptions 227.22 Site Bypass 237.23 Landing 3

8 Mako Failover 248.1 Failover Configuration 24

9 Dynamic DNS 249.1 Dynamic DNS Configuration - No-ip.com 249.2 Dynamic DNS Configuration - DynDNS.org 25

10 Deployment 2510.1 Mako ID Change (Reseller Test) 2510.2 Hardware Modification (Reseller Test) 25

11 Warranty 26

Contents


1 Management

1.1 Creating a company profile (Reseller Only)Menu Management > Home > Add a companyor Management > Company > New Company

1) Select the Parent Company.

2) Enter the Company Name.

3) Enter the Address.

4) (Optional): Enter the Suburb.

5) (Optional): Enter the City.

6) (Optional): Enter the State.

7) (Optional): Enter the Postal Code.

8) Select the Country.

-- Optionally Create a User --

9) Select the user’s Title.

10) Enter the First Name.

11) Enter the desired username.

12) Enter the user’s E-Mail address.

13) Select Type of Access.

14) Select the scope of access.

-- Optionally Create a Mako --

15) Enter the Mako name.

16) Select the Hardware type.

17) (Optional): Enter the Mako ID.

18) (Optional): Enter any associated licenses for this device.

19) (Optional): Enter location specific details (Default: Inherit Company details).

1.2 Adding a Mako to a company (Reseller Only)Menu Management > Company > Manage [Company] > Add a Mako

1) Select Management.

2) Select Company and in the search box enter the Company you want to add a new Mako device to.

3) Select Company from the search results; your browser will be redirected to the Management tabs for the selected company.

4) Select the ‘Add Mako to [Company]’ hyperlink, or click the Add Mako tab.

5) Select the appropriate model and enter the required name for the new device profile.

6) (Optional): Enter the Mako ID and any associated licenses you have been supplied.

1.1 NotesIt is possible for a reseller to belong to multiple companies. Select the company that will become the ‘Parent’ for the company being created.

13) Access types are described in Appendix 1 of the Management System Reseller Manual.

14) Scope is defined as the single device being created, or the entire Company being created.

ResultCompany saved (if Mako device profile and/or user created these should be saved also).

1.2 ResultSelecting ‘Add’ creates the device profile, selecting ‘Add and Configure’ creates the device profile and redirects the user to the configure page for the newly created profile.


2 Connectivity Configuration

2.1 ADSL WAN, PPP Configuration

PrerequisiteMako ADSL device profile has been loaded for configuration. This could be done via loading from the selection page or after creating a new company and choosing the ‘Add and Configure’ option.

Menu Configure > Internet > ISP Setup

1) Select the ISP.

2) Select the Plan.

3) Enter the username and password details.

4) (Optional): Configure external DNS for the CPE to use.

5) (Optional): Configure the warning and absolute threshold levels.

6) Select the correct Billing Cycle Start Date to match the ISP billing cycle (this information is used by the End of Month Report.)

7) Click ‘Save’ to commit the changes.

2.2 Ethernet WAN, IP Configuration

PrerequisiteMako Ethernet device profile has been loaded for configuration. This could be done via loading from the selection page or after creating a new company and choosing the ‘Add and Configure’ option.


1) (Optional): Select the ISP.

2) (Optional): Select the Plan.

3) Enter the WAN IP address.

4) Enter the Network Mask.

5) Enter the default gateway.


7) (Optional): Configure the Warning and Absolute Threshold levels.

8) Select the correct Billing Cycle Start Date to match the ISP billing cycle (this information is used by the End of Month report).


2.1 Notes5) is dependent on the ISP Plan. If you have selected an ISP plan that is flat rate, Warning and Absolute Threshold alerts are not available.

ResultWAN Interface configured. If a USB configuration file is required the above steps will be enough information to get a CPE device to an online state.

2.2 Notes1) and 2) are optional here and not strictly required to bring a device to an online state. The information provided during these steps is used for reporting purposes.

8) is dependent on the ISP Plan. If you have selected an ISP plan that is flat rate, Warning and Absolute Threshold Alerts are not available.

ResultWAN Interface configured. A USB Configuration file can now be downloaded and applied to the device.


2.3 Cellular WAN

PrerequisiteA Mako Cellular device profile has been loaded for configuration. This could be done via loading from the selection page or after creating a new Mako and choosing the ‘Add and Configure’ option.


1) Select the ISP.

2) Select the ISP Plan.

3) (Optional): Enter the PIN number.

4) (Optional): Enter the APN.


6) (Optional): Configure the Warning and Absolute Threshold levels.

7) Select the correct Billing Cycle Start Date to match the ISP billing cycle (this information is used by the End of Month report).


2.4 Adding IP Range

PrerequisiteISP Plan selected support IP Range.

Menu Configure > Internet > IP Range

1) Enter an IP range that has been allocated by the ISP.

2) Click Save.

2.5 Configuring AlertsMenu Configure > Internet > Alerts

1) Set the percentage level at which the system will alert based on your daily average.

2) Set the percentage level at which the system will alert based on your selected ISP plan free monthly allowance.

3) Select Worm Detection threshold.

4) Select Port Scan Detection threshold.

5) Select the maximum temperature before alerting.

6) Select whether to alert if the internal fan stops spinning.

2.3 Notes3) is optional and depends on the environment your configuring for.

4) is optional and depends on the type of service your using.

6) is dependent on the ISP Plan. If you have selected an ISP plan that is flat rate, Warning and Absolute Threshold Alerts are not available.

ResultWAN Interface configured. A USB Configuration file can now be downloaded and applied to the device.

2.4 NotesIP Ranges are defined by the ISP plan.

Subnet masks can be entered in standard or CIDR formats.

ResultIP Range now listed. IP addresses allocated within IP Range are now available in the Firewall section of the website as Target IPs.

2.5 NotesExtraordinary Alerts are based around summary data captured during an End of Month report. The Management System will track usage patterns and can warn when certain thresholds are passed.

2) is ISP Plan dependent; if the currently selected ISP plan is flat rate this option will not be available.

ResultManagement system alerts are configured.


2.6 Configuring Network LAN 1Menu Configure > Network > LAN 1

1) (Optional): Enter a name to describe the LAN.

2) Select whether to allow or deny ICMP echo-request (default: deny).

3) Enter the Ethernet IP address.

4) Enter the subnet mask.

5) Enable or disable DHCP (default: enable).

6) (Optional): Enter the start IP address for DHCP allocation.

7) (Optional): Enter the stop IP address for DHCP allocation.

8) (Optional): Enter the IP address of a WINS server for DHCP clients.

9) (Optional): Enter the IP address of a primary DNS server for DHCP clients.

10) (Optional): Enter the IP address of a secondary DNS server for DHCP clients.

2.7 Configuring Network LAN 2

Prerequisite6500 - A2 / 3G / E Hardware type.

Menu Configure > Network > LAN 2

See ‘Configuring Network LAN 1’

2.8 Configuring DHCP LeasesMenu Configure > Network > DHCP Leases

1) Enter the IP Address.

2) Enter the MAC Address. (Format XX:XX:XX:XX:XX:XX)

3) (Optional): Enter a comment.

4) Click Add.

2.9 Configuring Static RoutesMenu Configure > Network > Static Routes

1) Enter the subnet information.

2) Enter the gateway address to reach this subnet (must be local).

3) (Optional): Enter a name for the static route.

4) Click Add.

2.6 NotesSteps 6-10 are optional and are only used when client machines on the LAN are connecting via DHCP. Client settings can override any DHCP options entered here.

If Steps 6 and 7 are not set the default action is to use the entire LAN subnet for IP allocation.

ResultLAN 1 Interface is configured.

2.7 NotesLAN 2 supports disabling NAT. This is useful if you have a public IP range and wish to allocate the entire range to this network port.

ResultLAN 2 can have NAT enabled or disabled.

2.8 NotesThe DHCP Leases page will be automatically populated by the Mako device after a lease has been issued. This section of the website can be used to statically assign a particular IP address to a MAC address.

The Mako Management System uses the “Comments” field for reporting purposes.

ResultDHCP Entry displayed on page. After CPE update (2 minutes) the assigned IP address should be allocated to the correct requesting MAC address.

2.9 NotesIf the name field is omitted then the network and subnet mask will be used as a name.

Static routes can be edited by clicking on the cog icon.

ResultStatic route added.


3 Firewall Configuration

3.1 Inbound Basic RuleMenu Configure > Firewall > Inbound > Basic

1) Enter the internal IP Address to forward traffic to.

2) Select the service type from the list provided.

3) (Optional): Enter a comment for the rule.

4) Click Add.

3.2 Inbound Advanced RuleMenu Configure > Firewall > Inbound > Advanced

1) Enter the Source IP Address (blank for any).

2) (Optional): Enter the subnet mask (defaults to /32).

3) Select the External Service Type.

4) (Optional): Select the Internal Service Type.

5) (Optional): Enable Trace Logging (recommended only in rare circumstances).


7) Click Add.

3.3 Outbound Basic RuleMenu Configure > Firewall > Outbound > Basic

1) Enter a Source IP Address, or select a source network from the drop down list.

2) Enter a Destination IP Address, or leave blank for ‘anywhere’.

3) Select the Service Type.

4) Set the action for the rule: Allow or Deny.


6) Click Add.

3.1 NotesThe IP address must be reachable via one the Mako’s internal LAN interfaces, either directly or via a static route.

The refresh button can be used force an update from the NOC to the Mako.

ResultFirewall rule added to list.

3.2 NotesThe IP address must be reachable via one the Mako’s internal LAN interfaces; either directly or connected via a static route.

The refresh button can be used to force an update from the NOC to the Mako.

The External Service and the Internal Service can be different; the Mako will perform a port translation in this case.

Trace Logging means any packet coming through the firewall will be logged.


3.3 NotesThe Refresh button can be used to force an immediate update from the NOC to the Mako.

Firewall rules are implemented from the top down. Be wary of this when constructing complex rule sets.



3.4 Configuring Firewall - Outbound AdvancedMenu Configure > Firewall > Outbound > Advanced

7) Enter the Source IP Address.

8) (Optional): Enter the Source Subnet Mask (default: /32).

9) Enter the Destination IP Address.

10) (Optional): Enter the Destination Subnet Mask (default /32).


12) Set the action for rule: Allow or Deny.

13) (Optional): Set Trace Logging flag (default: Allow-disabled, Deny-enabled).


15) Click Add.

3.5 Configuring Firewall - Intranet Basic

Prerequisite6500 – A2 / Cellular / E Hardware type.

Menu Configure > Firewall > Intranet > Basic

1) Select the Source Network.

2) Enter the Destination IP or select the Destination Network.




6) Click Add.

3.6 Configuring Firewall - Intranet AdvancedMenu Configure > Firewall > Intranet > Advanced


2) (Optional): Enter the Source Subnet Mask (default: /32).


4) (Optional): Enter the Destination Subnet Mask (default /32).





9) Click Add.

3.5 NotesThe refresh button can be used force an immediate update from the NOC to the Mako.

Any manually entered IP addresses must be local to the device, either directly connected or reachable via a static route.


3.4 NotesThe Refresh button can be used force an immediate update from the NOC to the Mako.



Any manually entered IP addresses must be local to the device, either directly connected or reachable via a static route.



3.7 Configuring Firewall - VPN Basic

PrerequisiteAn IPSec VPN must be present. Refer 4.1 Mako to Mako IPSec VPN.

Menu Configure > Firewall > VPN > Basic

1) Select an IPSec VPN to create a rule for.

2) Enter Source IP Address, or select Source Network from the drop down list.

3) Enter Destination IP Address, or select Destination Network from drop down list.




7) Click Add.

3.8 VPN Advanced Rule

PrerequisiteAn IPSec VPN must be present. Refer 4.1 Mako to Mako IPSec VPN.

Menu Configure > Firewall > VPN > Advanced

1) Select an IPSec VPN to create a rule for.


3) (Optional): Enter the source Subnet Mask (default: /32).


5) (Optional): Enter the Destination Subnet Mask (default: /32).





10) Click Add.


ResultFirewall rule added to VPN rule list.




4 VPN and Remote Access Configuration

4.1 Mako to Mako IPSec VPN

PrerequisiteAt least two device profiles must exist in order to construct a Mako to Mako IPSec VPN. The device profiles do not need to exist under the same company; a reseller with access to multiple customers can use the search feature to construct inter-company IPSec VPNs.

Menu Configure > VPN > Mako to Mako > Manage Access

1) On the left-hand side, select the local network to be part of the IPSec VPN.

2) Select the direction of traffic flow. This controls firewall settings allowing or denying traffic originating in a certain direction.

3) Select the other device profile to be part of the IPSec VPN. The search magnifying glass icon can be use to locate device profiles under other companies (Reseller only function).

4) Select the network on the other device that will be part of the IPSec VPN.

5) Click Add.

4.2 Add Third Party DeviceMenu Configure > VPN > Mako to Mako > Add Third Party Device

1) Enter the Location name.

2) Enter the Public IP Address of the Third Party Device.

3) Enter the Network that will be part of the IPSec VPN.

4) Click Add, or Add and Create VPN.

4.3 Delete Third Party DeviceMenu Configure > VPN > Mako to Mako > Delete Third Party Device

1) Select the device to delete.

2) Click Delete. A confirmation box will be displayed allowing the user to confirm or cancel this action.

4.1 ResultMako to Mako IPSec VPN constructed with the desired default traffic direction.

4.2 NotesRefer Appendix 3 of the Management System Reseller Manual for more information on IPSec parameters.

ResultDevice created is now available in the Manage Access section and can be used to construct an IPSec VPN.

4.3 NotesAny IPSec VPNs or VPN Firewall rules associated with the Third Party IPSec device will be removed.

ResultThird Party IPSec device is no longer available in the Manage Access section.


4.4 Mako to Third Party IPSec VPN

PrerequisiteA Third Party device needs to be available to use.

Menu Configure > VPN > Mako to Mako > Manage Access

1) On the left-hand side, select the local network to be part of the IPSec VPN.

2) Select the direction of traffic flow. This controls firewall settings allowing or denying traffic originating in a certain direction.

3) Select the Third Party Device profile to be part of the IPSec VPN. The search magnifying glass icon can be use to locate device profiles under other companies (Reseller only function).

4) Enter the pre-shared key to be used during authentication for this IPSec tunnel. Alternately, the Management system can generate a unique pre-shared key by clicking on the [random] hyperlink.

5) Click Add.

4.5 PPTP ConfigurationMenu Configure > VPN > Remote Access > PPTP Settings

1) Enable PPTP access.

2) Select the Network to terminate PPTP VPNs.

3) Enter the IP Range Start Address.

4) Enter the IP Range Stop Address.

5) (Optional): Enter a DNS server address to be allocated to a connecting PPTP client.

6) (Optional): Enter a WINS server address to be allocated to a connecting PPTP client.

7) Click Save.

4.6 Adding VPN UserMenu Configure > VPN > Remote Access > Add VPN User

1) Enter the users First Name.

2) Enter the users Last Name.

3) Enter the desired Username.

4) Enter the users E-Mail Address.

5) Click Add.

4.4 NotesRefer Appendix 3 of the Management System Reseller Manual for more information on IPSec parameters.

The local subnets at both ends of an IPSec connection must be unique.

ResultMako side of IPSec tunnel will be created. If the other end is correctly configured then the tunnel should establish and be useable.

4.5 NotesPPTP allocates IP addresses from the network terminating the PPTP sessions. It is important to ensure that the IP addresses allocated during PPTP Configuration do not conflict with existing devices on the LAN.

Due to the above nature of PPTP, the connecting client cannot have the same network as the Mako. I.e. They cannot both have 10.0.0.0/8, as a routing conflict will exist.

ResultPPTP Configured. PPTP will not be activated on the device until a user is created and enabled, refer 4.6 and 4.7.

4.6 NotesThe user will receive an e-mail containing login details. These details are used by PPTP users when they construct a PPTP VPN, or by a Remote Access IPSec VPN user when they log into the Management System to exchange pre-shared keys.

ResultThe user is created in the system. The will receive an e-mail containing username and password information.

The user will now be available in the Remote Access > Manage Access section.


4.7 Enabling Remote AccessMenu Configure > VPN > Remote Access > Manage Access

6) Toggle the red and green access orbs to enable or disable access of the required type on the appropriate LAN by clicking once on them.

5 Quality of ServiceQuality of Services comes pre-configured. The Mako Team has developed a generic QoS profile that suits the majority of customers. All QoS changes are done via Configure > Services > QoS > Advanced. The hyperlink found at Configure > Services > QoS > Custom is the same menu item.

QoS works by dividing the available upstream bandwidth into segments called bins.

5.1 Adding a service to a QoS BinMenu Configure > Services > QoS > Advanced


2) Select the Bin.

3) (Optional): Enter a Source Address.

4) Click Add.

5.2 Removing a service from a QoS BinMenu Configure > Services > QoS > Advanced

1) Click on the delete icon in the Remove Service column next to the service you want to remove.

5.3 Adding a QoS BinMenu Configure > Services > QoS > Advanced

1) Click on the Add New Bin button.

5.4 Removing a QoS BinMenu Configure > Services > QoS > Advanced

2) Click on the delete icon in the Remove Bin column next to the bin you wish to remove.

5.5 Managing QoS Bin bandwidth allocations.Menu Configure > Services > QoS > Advanced

1) Click on the ‘Show advanced bandwidth settings’ checkbox at the bottom of the page.

2) Adjust QoS Bin allocations, ensuring the total adds to 100%.

3) Click Save.

4.7 NotesUser access is disabled by default.

ResultAccount state is changed and access is allowed or denied.

5.1 NotesSource Addresses can be used to provide fine-grained control over QoS.

ResultService added to selected QoS Bin and prioritized accordingly.

5.2 ResultService removed from QoS configuration.

5.3 NotesThe new bin will be allocated 3% bandwidth from the most suitable bin. The new bin will be placed last in the priority queue.

ResultNew QoS bin available for use.

5.4 NotesAny services in the QoS Bin being removed will be deleted from the QoS profile.

The bandwidth previously added to the QoS Bin will be distributed to the last QoS bin in the profile.

ResultBin removed and QoS allocations readjusted.




6 VPN Cloud

6.1 Creating a VPN Cloud

PrerequisiteYou must have a least one appliance able to be used as a VPN Cloud concentrator.

You must have the authority required to create a VPN Cloud for your network.

Menu Management > Company > Manage MSP > VPN Cloud1) Click 'Create VPN Cloud'. The VPN Cloud modal window will

appear.

2) Enter a name for your VPN Cloud.

3) Select a Mako to be used as a cloud concentrator. The Mako's LAN details will appear.

4) Enable at least one LAN over which the VPN cloud will operate.

5) Click 'Save VPN Cloud'. The 'Save VPN Cloud' dialog box will appear.

6) Enter your password to authorize this configuration change.

6.2 Joining a VPN Cloud

PrerequisiteA VPN Cloud must have been created for the business.

Menu Configure > VPN > VPN Cloud1) Click 'Join VPN Cloud'. A modal window will appear.

2) Click 'Select VPN Cloud'. A drop-down selection box will appear.

3) Begin typing the name of an available VPN Cloud. (In Mako's Demo site, "BigCorp's Cloud" has been created.)

4) If/When the cloud appears below the search box, click it. The cloud name will appear in the VPN Cloud field.

5) Click 'Save VPN Cloud connection'.

6.2 NotesBy default, joining a Mako to a VPN Cloud allows bi-directional traffic.

ResultThe VPN Cloud-enabled LANs of the selected Mako are listed.

6.1 NotesA VPN Cloud is a virtual data center where VPN traffic is managed by certificate-based authentication. It's a fast, secure way of handling VPN traffic.

While creating a VPN Cloud is very simple, you should ensure that its creation has a genuine business purpose, as maintaining several VPN clouds may cause unwanted management problems.

ResultA new VPN Cloud is created.


6.3 Editing your Mako's options for its VPN Cloud

PrerequisiteYour Mako must have joined a VPN Cloud.

Menu Configure > VPN > VPN Cloud1) The page shows the name of the Mako's VPN Cloud, how many

LANs your Mako has assigned to the cloud, the direction, SNAT setting and the Options ( ) column.

2) Click the button. The 'Join VPN Cloud' modal pane appears.

3) Click 'Select concentrators, VPN direction and SNAT'. The VPN Cloud's concentrator list and Mako LAN properties appear.

4) Enter an SNAT address in IPv4 or CIDR notation, and/or select a direction change, and/or a priority weighting level. You may also engage or disengage a Mako's LAN from the cloud.

5) Click 'Save VPN Cloud connection'. You will return to the main page listing the VPN Cloud your Mako has joined.

6.4 Simple Diagnostics on VPN Cloud

PrerequisiteThis procedure requires a laptop or IP client with which to plug in to the LAN(s) of a Mako assigned to a VPN Cloud.

1) Plug a PC or IP client to the LANs on at least one Mako designated as a VPN Cloud Mako.

2) Enter the CMS and select the Mako.

3) Menu Reports > Diagnostics > VPN Cloud Setup

4) This diagnostic displays the Cloud name, Device tunnel name, the number of connections in the cloud, the Peer Network count and local network address.

5) Menu Reports > Diagnostics > VPN Cloud Routing Table

6) This displays the networks discovered over the VPN Cloud, including network ranges, weights and endpoint address.

6.3 NotesOptions may be edited during the 'Joining' process.

SNAT settings, whether it's used or not, can be instrumental in diagnosing US-centric problems.

Traffic direction determines which way data may be transmitted and received from Mako to Mako.

Priority is a weighting level. A Mako's LAN may be part of several VPN cloud networks in a distributed concentrator configuration. Priority assists in distributing loads across several concentrators.

ResultThe Mako's LAN's properties have been altered.

6.4 NotesVPN Cloud diagnostics start stepping out of the scope of user acceptance testing. Some properties are only accessible via high level system administrators.

ResultSeveral tables of diagnostic information are present for user evaluation.


7 Mako Guardian

7.1 Category Management

PrerequisiteA Mako Guardian license must be installed to use this functionality.

Mako Guardian must be activated. Activate it from this same Menu by clicking the ‘Enable Mako Guardian’ checkbox.

Menu Configure > Services > Mako Guardian > Sites > Categories

1) Select a category for the drop down list.

2) (Optional) Select a Group.

3) (Optional) Select a Time.

4) Select an action for the category: Allow or Deny.

5) Click Add.

7.2 Default Site Categories



Menu Configure > Services > Mako Guardian > Sites > Categories

1) Click the ‘Use Default Site and Phrase Categories’ button.

7.3 Custom Sites



Menu Configure > Services > Mako Guardian > Sites > Custom Sites

1) Enter a domain or URL.



4) Set the Action, Allow or Deny.

5) Click Save.

7.3 NotesWhen adding domain names, the system will include sub-level domains as part of a match. E.g. Adding a block on example.com will block www.example.com however adding a block on www.example.com will not block test.example.com.

Allowed sites have priority over domains, so adding allowed custom sites will override any denied entries that match in the Categories section.

Groups and Times default to Everyone/Anytime. Additional Groups and Times can be configured. Refer 6.10 – 6.18.

ResultThe custom site is added to the list of domains and URLs.

7.1 NotesMako Spyware Protection can be enabled by checking the ‘Enable Mako Spyware Protection’ checkbox.

An ‘Add All’ category is available; this simply adds all categories into the profile configuration.

Groups and Times default to Everyone/Anytime. Additional Groups and Times can be configured. Refer 6.10 through to 6.18.

ResultNew category selected is added to the list.

7.2 NotesThe Mako Team has put together a standard set of categories suitable to most sites. Using the Default button will load those categories into the list, replacing any user-specific changes.

ResultCategory and Phrase lists are set to default. These include Adverts, Hacking, Pirated Software, Pornography, Proxies, Diallers and Redirectors.

http://www.example.com




7.4 Custom Sites Banned URL Expression



Menu Configure > Services > Mako Guardian > Sites > Custom Sites

1) Enter a regular expression.

2) (Optional): Click the [test] hyperlink to test the expressions you have entered.

3) (Optional): Enter a domain or URL to test against.

4) (Optional): Click Test Expression This section allows you to modify the expression you have entered until it is behaving as expected.

5) (Optional): Click Use Expression to use the expression entered in the parent page.



8) Click Save.

7.5 Custom Categories



Menu Configure > Services > Mako Guardian > Sites > Custom Categories

1) Enter the name of the category you would like to create.

2) Enter a description for the category type your creating.

3) (Optional - Reseller level only) Check or uncheck ‘Share this category with customers’.

7.5 NotesCustom Categories allow you to create customised lists containing both URLs and Domains. These custom categories can be shared amongst CPE device profiles within the same company.

is a reseller function and can be used to share custom categories among multiple customers.

ResultRegular expression is added to the list of custom sites.

7.4 NotesThe Mako CPE can handle true regular expressions as part of its site and URL filtering. More information about regular expressions can be found at http://www.regular-expressions.info



http://www.regexp.com

http://www.regexp.com


7.6 Custom Category Edit



A custom category must be created. Refer 6.5.

Menu Configure > Services > Mako Guardian > Sites > Custom Categories

1) Click the spanner icon next to the category you would like to edit.

2) (Optional) Individual Domains/URLs can be added or removed using the Add/Remove Sites section and corresponding Add/Remove buttons.

3) (Optional) Correctly formatted files containing URLs and Domains can be uploaded using the ‘Upload Site Category File’ section.

4) a: (Optional) Use the ‘Choose File’ button to locate the Domains/URLs file. b: (Optional) Click Upload.

7.7 Phrases Management



Menu Configure > Services > Mako Guardian > Phrases > Categories



3) Click Add.

7.6 NotesCustom Categories allow you to create customised lists containing both URLs and Domains. These custom categories can be shared amongst CPE device profiles within the same company.

3) is a reseller function and can be used to share custom categories among multiple customers.

When uploading files the correct format must be adhered to. Refer Mako Guardian Manual for further details.

Existing custom categories can be downloaded using the ‘Floppy Disk’ icon located on the Custom Categories page.


7.7 NotesPhrases are based on the contents on an HTML pages rather than domain or URL matching.


ResultPhrase category added to the list.


7.8 Custom Phrases



Menu Configure > Services > Mako Guardian > Phrases > Custom Phrases

1) Enter a phrase.

2) Select action for the phrase match; Allow, Deny or Weight.



5) Click Save.

7.9 Weighted Phrase Configuration



Menu Configure > Services > Mako Guardian > Phrases > Custom Phrases

1) Select the Weighted Phrase Mode.

2) Enter the Weighted Phrase Limit.

3) Click Save.

7.10 User and Group Options



Menu Configure > Services > Mako Guardian > Users and Groups > Options

1) Select the authentication mode for Mako Guardian (Default: Anonymous).

2) (Optional) Check ‘Allow anonymous/unauthenticated web access’

3) Click Save.

7.10 NotesOptional enables or disables anonymous access as well as the selected Authentication mode. This is useful during initial configuration where an administrator can configure another mode of operation and not effect existing users.

LDAP configuration (Configure > Services > Mako Guardian> Users and Groups > LDAP) is only available if LDAP User Authentication mode is selected.

Local Users configuration (Configure > Services > Mako Guardian> Users and Groups > Local Users) is only available if Local User authentication mode is selected.

ResultThe authentication mode is changed.

7.9 NotesWeight Phrase Modes act on phrases matched in an HTML page. Either each match of a word counts only once, or the match counts multiple times.

Weighted Phrase Limit decides the level an HTML page has to reach before it is blocked.

ResultWeighted Phrase Configuration updated.

7.8 NotesThe weight setting allows you to give certain words or combinations of words more weight than others. Use this in conjunction with the weighted phrase configuration.

The Add to Preview function allows you to build combinations of words that act as one phrase.


ResultPhrase added to the list.


7.11 Users and Groups - LDAP



LDAP User Authentication mode must be enabled. Refer 6.8.

An LDAP compliant directory server must be reachable from the CPE device.

Menu Configure > Services > Mako Guardian > Users and Groups > LDAP

1) Enter the IP address of the LDAP server.

2) Enter the port number that the LDAP service is available on.

3) Enter an administrative account name that can browse and authenticate LDAP users.

4) Enter the administrative account password.

5) Enter the administrative account password a second time (for validation).

6) Enter the Root DN.

7) Enter the search query.

8) Enter the Group Attribute.

7.12 Users and Groups - Local Users



Local User Authentication mode must be enabled.

Menu Configure > Services > Mako Guardian > Users and Groups > Local Users

1) Enter a Username.

2) Enter the Full Name.

3) Enter the E-Mail address of the user.

4) Enter the Password.

5) Enter the Password again for verification.

7.12 NotesLocal User Authentication mode provides a mechanism for Authentication without the requirement for a LDAP compliant server.

ResultThe user is added. This account can now be used for authentication when Mako Guardian is configured in ‘Local User Authentication Mode’.

7.11 NotesThe administrative account entered here will need to be fully qualified. E.g. ‘cn=Administrator,cn=Users, dc=example,dc=com’ rather than ‘Administrator’.

The Root DN (Distinguished Name) is the top level at which we search for users. In the example domain the Root DN is ‘DC=example, DC=com’.

Steps 7 & 8: These values are specific to your LDAP configuration. The examples provided are based on Microsoft 2003 Active Directory.

ResultLDAP Authentication mode is configured.


7.13 Create Local Group

PrerequisiteLocal User Authentication mode must be enabled.

Menu Configure > Services > Mako Guardian > Users and Groups > Groups

1) Enter a Group name.

2) Select ‘Local User Group’.

3) Click Add.

7.14 Create IP Group




1) Enter the Group name.

2) Select ‘IP Address Based’.

3) Click Add.

7.15 Create LDAP Group



LDAP User Authentication mode must be enabled. Refer 6.10.


1) Select ‘LDAP User Group’ - The LDAP Group DN text box now appears.

2) Enter the LDAP Group DN.

3) Click Add.

7.14 NotesIP Groups are groups that contain IP based members.

ResultThe IP Based Group is created and appears in the list of Groups.

7.13 NotesLocal User Group’s provide a mechanism for Group based policies without the requirement of an LDAP compliant server. Local Groups contain Local Users.

ResultThe Local User Group is created and appears in the list of Groups.

7.15 NotesThe LDAP Group DN is defined by the LDAP Server. This will generally be unique for each LDAP environment.

You do not enter LDAP users into LDAP Group’s on the Management platform. LDAP Group based membership is queried during communication with your LDAP server.

ResultThe LDAP User Group is created and appears in the list of Groups.


7.16 Add Local User to Local Group



Local User Authentication mode must be enabled. Refer 6.10.

Local Users must be defined. Refer 6.12.

At least one Local Group must be defined. Refer 6.13.


1) Click the Spanner icon next to the group you wish to make the user a part of.

2) Select the user you wish to add to the Group from the ‘Add Group Member’ section.

3) Click Add.

7.17 Add IP Address to IP Based Group



At least one IP Based Group must be defined. Refer 6.14.


1) Click the Spanner icon next to the group you wish to make the user a part of.

2) Enter the IP Address you wish to add the IP Based Group in the ‘Add Group Member’ section

3) Click Add.

7.18 Banned File Extensions



Menu Configure > Services > Mako Guardian > Advanced > File Types

1) Enter the extension.

2) Click Add.

7.17 ResultThe IP Address is added to the group.

7.16 ResultThe user is added to the group.

7.18 NotesThe prefixing full stop is not required.

ResultFile extension is added to the list.


7.19 MIME Types



Menu Configure > Services > Mako Guardian > Advanced > File Types

1) Select the MIME type from the list.

2) Click Add.

7.20 Create Time



Menu Configure > Services > Mako Guardian > Advanced > Times

1) Enter a name for the time slot you are creating.

2) Select the start and stop intervals for this time slot.

3) Click Add.

7.21 Exceptions



Menu Configure > Services > Mako Guardian > Advanced > Exceptions

1) Enter an IP address.

2) Set action, Allow or Deny.

3) Click Add.

7.21 NotesAll exceptions to Content Filtering are IP based.

Allowed IPs are exempt from all Content Filtering policies.

ResultEntered IP address is completely allowed, or completely denied.

7.20 NotesAdditional time intervals can be added by clicking on the Spanner icon next to the time slot name.

ResultThe time slot is added to the list.

7.19 ResultMIME Type selected is added to the list.


7.22 Site Bypass



Menu Configure > Services > Mako Guardian > Advanced > Site Bypass

1) Enter an IP address, Network Address or Website.

2) (Optional) Enter a comment.

3) Click Add.

7.23 Landing Page



Menu Configure > Services > Mako Guardian > Advanced > Landing Page

1) Check the ‘Landing Page Enabled’ check box.

2) Enter the website to redirect the user to.

3) Select the time-out period.

4) Click Save.

7.23 NotesLanding Page temporarily redirects any HTTP traffic to another website. This is useful for Kiosk mode operation where the initial page displayed could be a welcome message.

Only the first request from a browser will be redirected. The user will not see the landing page until the value defined by the timeout period has past and there has been no further activity from the browser.

ResultLanding page is enabled. The first attempt to access any webpage will be redirected to the landing page.

7.22 NotesSite Bypasses currently only work when Mako Guardian is being used in transparent mode. Transparent mode is when the proxy server address on the Mako device is not being used. If the proxy server address on the Mako is being used the Site cannot be bypassed.

Site Bypass is used when non-HTTP traffic is being passed through the Mako on port 80, or in cases when non-RFC compliant devices are using port 80.

If a Website name is used and no comment is supplied the Mako System will automatically resolve the Website to an IP address and use the Website name as a comment.

ResultThe IP Address, Network or Website is not bypassed when accessed.


8 Mako Failover

8.1 Failover Configuration

PrerequisiteTwo device profiles with LAN networks configured in the same subnet but with different IP addresses assigned to the LAN ports.

The secondary device in the failover pair must have a valid Mako Failover license to enable failover.

The device profiles must be able to communicate with each other via their corresponding LAN ports. A crossover cable is recommended for the communications channel.

Both devices in the failover configuration must be the same hardware type, i.e. 2x6500 - A2 / Cellular / E (WAN type can be mixed).

Menu Configure > Services > Mako Failover

1) Select device profile that will be the secondary device in the failover configuration.

2) Check or uncheck the ‘Secondary always on’ option.

3) For each available Interface, decide the Virtual IP Address.

4) Check or Uncheck the Monitor option for each Interface.

5) Select the LAN Interface to be used as the failover communication channel.

6) Click Save.

9 Dynamic DNSMako’s CMS supports two Dynamic DNS providers: No-IP.com and DynamicDNS.org. Accounts must be configured with the appropriate provider prior to configuring the Mako’s Dynamic DNS profile.

9.1 Dynamic DNS Configuration - No-ip.com

PrerequisiteA Dynamic DNS account must be configured with No-IP.com.

Menu Configure > Services > Dynamic DNS

1) Enter the Username.


3) Enter the Password again for confirmation.

4) Enter the Hostname.

5) (Optional): If you have a group of hostnames you can enter the group name.

6) Click Submit.

9.1 NotesDynamic DNS uses third party DNS providers.

ResultDynamic DNS profile configured on the device. After the first update the Dynamic DNS hostname will be updated to point to the Mako’s WAN address.

8.1 NotesVirtual IP Addresses will be the default gateway for any machines connected on the LAN subnet. The virtual IP Address will shift between the devices as they change state.

The Monitor option instructs the devices to also monitor the interface in case of a state change (link up/link down). If a monitored LAN interface fails (or switch fails) the secondary device will take ownership of the Virtual IP.

ResultMako Failover configured.


9.2 Dynamic DNS Configuration - DynDNS.org

PrerequisiteA Dynamic DNS account must be configured with DynDNS.org.

Menu Configure > Services > Dynamic DNS

1) Enter the Username.


3) Enter the Password again for confirmation.

4) Enter the Hostname.

5) Set wildcard support.

6) Enter a Backup MX Record if you wish to use one for this host.

7) Enable or Disable Backup MX service.

8) Click Submit.

10 Deployment

10.1 Mako ID Change (Reseller Test)Menu Configure > Deployment > Deployment

1) Enter the Mako ID.

2) Click Update.

10.2 Hardware Modification (Reseller Test)Menu Configure > Deployment > Hardware

1) Select the Hardware Type.

2) (Optional): Enter the Mako ID (useful if changing physical hardware).

3) Enter your password.

4) Click ‘Update Configuration’.

10.1 NotesMako IDs are used to link a physical piece of Mako hardware to a device profile configured on the Management System.

ResultMako ID is changed.

10.2 NotesEntry of your password is required due to the irreversible changes Modify Hardware can make. Take special note of the warnings on this page. Changing from an Ethernet model to an ADSL model will remove all firewall, IPSec and WAN configuration entered into the site.

ResultHardware type changed. Mako ID updated if required.

9.2 NotesDynamic DNS uses third party DNS providers.

The Backup MX Record is used if you wish to provide an alternate MX record for the hostname. If enabled, two MX records are created; one pointing to the IP address for the Mako’s WAN and another pointing to the backup MX host provided.

ResultDynamic DNS profile configured on the device. After the first update the Dynamic DNS hostname will be updated to point to the Mako’s WAN address.

11 Warranty1) Standard Limited Warranty. If the products purchased hereunder are resold by a distributor or reseller to an end-

user (customer) pursuant to the terms hereof in their original, unmodified, unused condition, Purchaser shall pass on to its customers, or keep as applicable for internal use, the MAKO NETWORKS LTD. standard limited warranty for the products, as summarized in documentation supplied with the product and including provisions and limitations set forth below. The Manufacturer warrants the Mako Appliance for one (1) year. The Warranty begins on the date of purchase as shown on your providers invoice.

2) Express End-user Limited Warranty. Each MAKO NETWORKS LTD. product purchased hereunder is warranted against defect in material and workmanship and will substantially conform to MAKO NETWORKS LTD. product documentation for the period set forth in the documentation supplied with the product following delivery to end-user (the “Warranty Period”). This warranty extends only to end-user and will not extend to, nor may it be assigned to, any subsequent user, Purchaser or user of a MAKO NETWORKS LTD. product, whether such MAKO NETWORKS LTD. product is alone or incorporated into end-user’s product.

3) Exclusions. The express warranty set forth above is contingent upon the proper use of a MAKO NETWORKS LTD. product in the application for which it was intended and will not apply to any MAKO NETWORKS LTD. product that has been (i) damaged during shipping, (ii) modified or improperly maintained or repaired by a party other than MAKO NETWORKS LTD. or its designees, or (iii) subjected to unusual physical or electrical stress. This includes operation of the product outside the Operating Specifications of the product.

4) Limitation of Remedy. In the event a MAKO NETWORKS LTD. product fails to perform as warranted, MAKO NETWORKS LTD. sole and exclusive liability and end-user’s only remedies for breach of this warranty shall be, at MAKO NETWORKS LTD.’s option to repair, replace or credit an amount not exceeding the Purchaser’s purchase price of each product found to be defective, provided that:

4.1) End-user complies with the rejection and warranty procedures contained in Section 5 below and returns the MAKO NETWORKS LTD. product that the end-user considers defective for examination and testing.

4.2) MAKO NETWORKS LTD. shall not be liable under this warranty if testing and examination by MAKO NETWORKS LTD. discloses that the MAKO NETWORKS LTD. product has been modified or altered in any manner after it was shipped by MAKO NETWORKS LTD.

4.3) MAKO NETWORKS LTD. shall not be liable under this warranty if testing and examination by MAKO NETWORKS LTD. discloses that the alleged defect in the MAKO NETWORKS LTD. product does not exist or was caused by end-user or any third person’s misuse, neglect, improper installation or testing, unauthorized attempts to repair or any other cause beyond the range of intended user, or by accident, fire or other hazard.

4.4) MAKO NETWORKS LTD. shall not be liable under any warranty under this Agreement with respect to any MAKO NETWORKS LTD. product that is not returned in its original shipping container or a functionally equivalent container.

4.5) If MAKO NETWORKS LTD. testing and examination does not disclose a defect warranted under this Agreement: MAKO NETWORKS LTD. shall so advise Purchaser and dispose of such MAKO NETWORKS LTD. product in accordance with Purchaser’s instructions on behalf of end-user and at Purchaser’s cost.

2014 Mako Networks Limited. Some Rights Reserved - http://creativecommons.org/licenses/by-nc-sa/3.0/

The Mako logo is a registered trademark of Mako Networks Limited.

Other product and company names mentioned herein can be trademarks and/or registered trademarks of their respective companies.

Information in this document is subject to change without notice and does not represent a commitment on the part of Mako Networks Limited.

This document should be read in conjunction with the Mako Networks Terms and Conditions available from the Mako Networks website (http://www.makonetworks.com).

Mako Networks, its parent or associate companies may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written licence agreement from Mako Networks, its parent or associate companies, the furnishing of this document does not give you any rights or licence to these patents, trademarks, copyrights, or other intellectual property.

• Warranty Software

user acceptance - mako networks · pdf filea series of user acceptance tests that can ......

Documents