Rohde & Schwarz GP-E Manual de usuario
R&S®GP-E/GP-S
gateprotect Firewall
User Manual
User Manual
v16.2.1 ─ 01
Cybersecurity
This document describes the following R&S®gateprotect Firewall models:
●R&S®gateprotect Firewall GP-E
●R&S®gateprotect Firewall GP-S
© 2017 R&S Cybersecurity gateprotect GmbH
Augustusplatz 9, 04109 Leipzig, Germany
Phone: +49 (0) 341 392 993 43-0
Fax: +49 (0) 341 392 993 43-9
E-mail: [email protected]
Internet: https://cybersecurity.rohde-schwarz.com
Printed in Germany – Subject to change – Data without tolerance limits is not binding.
R&S® is a registered trademark of Rohde & Schwarz GmbH & Co. KG.
Trade names are trademarks of the owners.
The following abbreviations are used throughout this manual: R&S®gateprotect Firewall is indicated as gateprotect Firewall.
Contents
R&S®GP-E/GP-S
3User Manual v16.2.1 ─ 01
Contents
1 About This Manual.................................................................................9
1.1 Audience........................................................................................................................ 9
1.2 What’s in This Manual................................................................................................ 10
1.3 Conventions................................................................................................................ 10
1.4 Related Resources......................................................................................................11
1.5 About Rohde & Schwarz Cybersecurity................................................................... 11
2 Getting Started..................................................................................... 13
2.1 Logging On.................................................................................................................. 13
2.2 Resetting the Hardware.............................................................................................. 14
3 User Interface....................................................................................... 17
3.1 Web Interface Components........................................................................................17
3.1.1 Header Area..................................................................................................................18
3.1.2 Navigation Pane............................................................................................................19
3.1.3 Desktop......................................................................................................................... 19
3.2 Icons and Buttons.......................................................................................................21
3.3 Firewall Rule Settings.................................................................................................22
3.4 Menu Reference.......................................................................................................... 29
3.4.1 Firewall..........................................................................................................................29
3.4.1.1 Status............................................................................................................................ 29
3.4.1.2 Reports..........................................................................................................................30
3.4.1.3 Updates.........................................................................................................................33
3.4.1.4 Backup.......................................................................................................................... 34
3.4.1.5 Local Logs.....................................................................................................................38
3.4.1.6 Network Diagnostics..................................................................................................... 42
3.4.1.7 System.......................................................................................................................... 44
3.4.1.8 User Authentication.......................................................................................................47
3.4.1.9 License..........................................................................................................................53
3.4.1.10 Time Profiles................................................................................................................. 54
3.4.2 Network......................................................................................................................... 55
3.4.2.1 Firewall Rules................................................................................................................55
3.4.2.2 Static Routes.................................................................................................................56
Contents
R&S®GP-E/GP-S
4User Manual v16.2.1 ─ 01
3.4.2.3 Syslog Servers.............................................................................................................. 58
3.4.2.4 SSL Proxy..................................................................................................................... 59
3.4.2.5 High Availability.............................................................................................................60
3.4.2.6 Support Access............................................................................................................. 63
3.4.2.7 FTC (Forensic Traffic Capture)..................................................................................... 64
3.4.2.8 NAT Rules.....................................................................................................................66
3.4.3 LAN............................................................................................................................... 68
3.4.3.1 Ethernet Zones..............................................................................................................68
3.4.3.2 WLAN Zones.................................................................................................................72
3.4.3.3 VLAN Zones..................................................................................................................76
3.4.4 WAN..............................................................................................................................78
3.4.4.1 Connection Monitoring.................................................................................................. 78
3.4.4.2 DynDNS Accounts........................................................................................................ 80
3.4.4.3 Failover Settings........................................................................................................... 82
3.4.4.4 WAN Zone.....................................................................................................................84
3.4.4.5 Port Forwarding.............................................................................................................89
3.4.4.6 IP Forwardings.............................................................................................................. 90
3.4.4.7 Policy Based Routes..................................................................................................... 92
3.4.5 Nodes............................................................................................................................94
3.4.5.1 Custom Hosts................................................................................................................94
3.4.5.2 Network Groups............................................................................................................ 95
3.4.5.3 Custom Networks..........................................................................................................96
3.4.6 UTM.............................................................................................................................. 97
3.4.6.1 Invalid Protocols............................................................................................................97
3.4.6.2 IPS/IDS Profiles............................................................................................................ 98
3.4.6.3 Web Filter Profiles.......................................................................................................100
3.4.6.4 Antispam Settings....................................................................................................... 103
3.4.6.5 Antivirus Settings........................................................................................................ 104
3.4.6.6 Mail Filter Settings.......................................................................................................105
3.4.7 VPN.............................................................................................................................107
3.4.7.1 IPsec........................................................................................................................... 108
3.4.7.2 OpenVPN.................................................................................................................... 117
3.4.8 Certificate Management.............................................................................................. 121
Contents
R&S®GP-E/GP-S
5User Manual v16.2.1 ─ 01
3.4.8.1 Certificates.................................................................................................................. 122
3.4.8.2 Templates................................................................................................................... 125
3.4.8.3 OCSP/CRL Settings....................................................................................................126
3.4.8.4 Truststore.................................................................................................................... 126
4 Application Examples........................................................................129
4.1 Firewall Rule Examples............................................................................................ 129
4.1.1 Blocking Certain Websites Using Applications............................................................130
4.1.2 Blocking Certain Websites Using Web Filters.............................................................130
4.1.3 Allowing Certain Websites Using Web Filters............................................................. 132
4.1.4 Forcing Secure Communication..................................................................................134
4.1.5 Using Quality of Service..............................................................................................135
4.1.6 Using DHCP in Bridge Mode.......................................................................................136
4.2 Setting Up Single Sign-On....................................................................................... 137
4.2.1 Configuring the NTP Server........................................................................................ 137
4.2.2 Preparing the Domain Controller.................................................................................137
4.2.3 Configuring the Firewall.............................................................................................. 139
4.2.4 Configuring User-Specific Firewall Rules....................................................................142
4.2.5 Configuring the Windows Clients................................................................................ 143
4.3 Setting Up a Static Route......................................................................................... 145
4.4 Using NAT Rules....................................................................................................... 146
4.4.1 Destination NAT.......................................................................................................... 146
4.4.2 Source NETMAP.........................................................................................................146
4.5 Setting Up a Syslog Server...................................................................................... 146
4.6 Setting Up a VLAN.................................................................................................... 148
4.7 Setting Up Port Forwarding..................................................................................... 149
4.8 Sorting Policy-Based Routes...................................................................................150
4.8.1 Sorting IP Addresses.................................................................................................. 150
4.8.2 Sorting Ports and IP Addresses.................................................................................. 150
4.8.3 Overall Sorting............................................................................................................ 151
4.9 Setting Up the Mail Filter with SSL Inspection.......................................................152
4.10 Handling Certificates................................................................................................ 153
4.10.1 Creating a Certificate.................................................................................................. 153
4.10.2 Importing a Certificate................................................................................................. 153
Contents
R&S®GP-E/GP-S
6User Manual v16.2.1 ─ 01
4.10.3 Replacing a Certificate................................................................................................ 154
4.10.4 Exporting a Certificate.................................................................................................155
4.10.5 Exporting a Certificate Signing Request..................................................................... 155
4.10.6 Suspending a Certificate............................................................................................. 156
4.10.7 Resuming a Certificate................................................................................................156
4.10.8 Renewing a Certificate................................................................................................ 156
4.10.9 Revoking a Certificate................................................................................................. 157
4.11 Setting Up OCSP/CRL Services...............................................................................157
4.12 VPN Setup Examples................................................................................................ 158
4.12.1 Setting Up a Client-to-Site VPN via IPsec...................................................................159
4.12.1.1 Setting Up the VPN Connection..................................................................................160
4.12.1.2 Setting Up Authentication............................................................................................175
4.12.2 Setting Up a Site-to-Site VPN via IPsec......................................................................177
4.12.2.1 Creating VPN Certificates........................................................................................... 177
4.12.2.2 Setting Up the VPN Connection..................................................................................181
4.12.2.3 Setting Up IPsec Site-to-Site for Complex Networks.................................................. 185
4.12.3 Setting Up a Client-to-Site VPN via OpenVPN........................................................... 187
4.12.3.1 Creating a VPN Certificate.......................................................................................... 187
4.12.3.2 Configuring Authentication.......................................................................................... 188
4.12.3.3 Setting Up the VPN Connection..................................................................................190
4.12.4 Setting Up a Site-to-Site VPN via OpenVPN.............................................................. 192
4.12.4.1 Creating VPN Certificates........................................................................................... 193
4.12.4.2 Setting Up the Primary Box.........................................................................................196
4.12.4.3 Setting Up the Secondary Box.................................................................................... 199
4.12.4.4 Connecting the Remote Networks.............................................................................. 201
4.13 Decoder Examples.................................................................................................... 201
4.13.1 Blocking PDF Files......................................................................................................202
4.13.2 Blocking Microsoft Office Files.................................................................................... 202
4.13.3 Blocking Web Hosts.................................................................................................... 202
4.13.4 Blocking Keywords in Webmail................................................................................... 203
4.13.5 Blocking Keywords in Mail Clients.............................................................................. 203
4.13.6 Using Anchors in String Decoders.............................................................................. 204
4.13.7 Using IEC 104 Protocol Decoders.............................................................................. 205
Contents
R&S®GP-E/GP-S
7User Manual v16.2.1 ─ 01
Annex.................................................................................................. 209
A Decoder Reference............................................................................ 209
A.1 FTP Commands.........................................................................................................209
A.2 HTTP MIME Types..................................................................................................... 211
Index....................................................................................................231
Contents
R&S®GP-E/GP-S
8User Manual v16.2.1 ─ 01
About This Manual
R&S®GP-E/GP-S
9User Manual v16.2.1 ─ 01
1 About This Manual
The gateprotect Firewall User Manual describes the innovative next-generation firewall
solution from Rohde & Schwarz Cybersecurity. gateprotect Firewall integrates firewall,
intrusion prevention, application control, web filtering, malware protection and many
more functions in a single system.
Figure 1-1: Sample gateprotect Firewall GP-E-1200.
This document applies to two gateprotect Firewall product lines:
●Extended Line - Easy to configure - the firewall solution for complex office networks
in medium-sized companies
●Specialized Line - Easy to customize - the perfectly tailored solution that meets the
high demands of complex network structures in industry and enterprise environ-
ments
There are license-based features that distinguish individual product models within the
two product lines from one another. For more information about your specific gatepro-
tect Firewall, see the information on the relevant data sheet.
See the topics below for more information about this document.
1.1 Audience
This manual is for the networking or computer technician responsible for installing and
configuring gateprotect Firewall and employees that use the web interface to define
traffic filtering rules.
To use this document effectively, you have to have the following skills depending on
your responsibilities:
●To install and configure the hardware, you have to be familiar with telecommunica-
tions equipment and installation procedures. You also have to have good experi-
ence as a network or system administrator.
●To define filtering rules, you need to understand basic TCP/IP networking con-
cepts.
Audience
About This Manual
R&S®GP-E/GP-S
10User Manual v16.2.1 ─ 01
1.2 What’s in This Manual
The contents of this manual are designed to assist you in installing and configuring
gateprotect Firewall.
This document includes the following chapters and appendixes:
1. Chapter 2, "Getting Started", on page 13
Log on to gateprotect Firewall to set up the system for your network.
2. Chapter 3, "User Interface", on page 17
The sections in this chapter describe the components of the gateprotect Firewall
user interface.
3. Chapter 4, "Application Examples", on page 129
This chapter includes various examples that illustrate how to use firewall rules to
manage network traffic, set up specific features, services and VPN connections,
and configure decoders to block communication containing certain file types or
keywords.
4. Chapter A, "Decoder Reference", on page 209
The gateprotect Firewall protocol decoder can detect FTP commands and HTTP
MIME types in traffic flows.
1.3 Conventions
This topic explains the typographic conventions and other notations used to represent
information in this manual.
Elements of the web-based graphical user interface (GUI, or »web interface«) are indi-
cated as follows:
●Buttons, checkboxes, list names and other controls appear in quotation marks. For
example: »Click "Save" to create the rule.«
●A sequence of menu commands is indicated as follows: "Firewall > Status" . In this
case, select "Status" from the "Firewall" menu.
●List options and literal text both appear in a fixed-width font. For example: »The
default filename is set to config.tar.gz.«
●Terms that require extended definitions or explanations are indicated in italics. For
example, the term application is often used to refer to a software program. In this
manual, however, it usually means the Layer 7 protocol used by the program on
the Application Layer of the OSI reference model. With Skype traffic, for example,
the terms application and protocol are used interchangeably.
Notes
The following types of notes are used in this manual to indicate information which
expands on or calls attention to a particular point.
Conventions
Este manual sirve para los siguientes modelos
1
Tabla de contenidos
