PLANET CS-2000 User Manual

CS-2000 UTM Content Security Gateway User’s Manual
UTM Content Security
Gateway
CS-2000
User’s Manual
CS-2000 UTM Content Security Gateway User’s Manual
Copyright© 2009 by PLANET Technology Corp. All rights reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language or computer language, in any form or by any means, electronic, mechanical, magnetic, optical, chemical, manual or otherwise, without the prior written permission of PLANET. PLANET makes no representations or warranties, either expressed or implied, with respect to the contents hereof and specifically disclaims any warranties, merchantability or fitness for any particular purpose. Any software described in this manual is sold or licensed "as is". Should the programs prove defective following their purchase, the buyer (and not this company, its distributor, or its dealer) assumes the entire cost of all necessary servicing, repair, and any incidental or consequential damages resulting from any defect in the software. Further, this company reserves the right to revise this publication and to make changes from time to time in the contents hereof without obligation to notify any person of such revision or changes. All brand and product names mentioned in this manual are trademarks and/or registered trademarks of their respective holders.
Disclaimer
PLANET Technology does not warrant that the hardware will work properly in all environments and applications, and makes no warranty and representation, either implied or expressed, with respect to the quality, performance, merchantability, or fitness for a particular purpose. PLANET has made every effort to ensure that this User’s Manual is accurate; PLANET disclaims liability for any inaccuracies or omissions that may have occurred. Information in this User’s Manual is subject to change without notice and does not represent a commitment on the part of PLANET. PLANET assumes no responsibility for any inaccuracies that may be contained in this User’s Manual. PLANET makes no commitment to update or keep current the information in this User’s Manual, and reserves the right to make improvements to this User’s Manual and/or to the products described in this User’s Manual, at any time without notice. If you find information in this manual that is incorrect, misleading, or incomplete, we would appreciate your comments and suggestions.
Trademarks
The PLANET logo is a trademark of PLANET Technology. This documentation may refer to numerous hardware and software products by their trade names. In most, if not all cases, these designations are claimed as trademarks or registered trademarks by their respective companies.
CE mark Warning
This is a class A device, in a domestic environment; this product may cause radio interference, in which case the user may be required to take adequate measures.
Federal Communication Commission Interference Statement
This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to Part 15 of FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This equipment generates, uses, and can radiate radio frequency energy and, if not installed and used in accordance with the instructions, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures:
1. Reorient or relocate the receiving antenna.
2. Increase the separation between the equipment and receiver.
3. Connect the equipment into an outlet on a circuit different from that to which the receiver is connected.
4. Consult the dealer or an experienced radio technician for help.
CS-2000 UTM Content Security Gateway User’s Manual
FCC Caution:
To assure continued compliance (example-use only shielded interface cables when connecting to computer or peripheral devices). Any changes or modifications not expressly approved by the party responsible for compliance could void the user’s authority to operate the equipment. This device complies with Part 15 of the FCC Rules. Operation is subject to the Following two conditions: (1) This device may not cause harmful interference, and (2) this Device must accept any interference received, including interference that may cause undesired operation.
R&TTE Compliance Statement
This equipment complies with all the requirements of DIRECTIVE 1999/5/EC OF THE EUROPEAN PARLIAMENT AND THE COUNCIL OF 9 March 1999 on radio equipment and telecommunication terminal Equipment and the mutual recognition of their conformity (R&TTE) The R&TTE Directive repeals and replaces in the directive 98/13/EEC (Telecommunications Terminal Equipment and Satellite Earth Station Equipment) As of April 8, 2000.
WEEE Caution
To avoid the potential effects on the environment and human health as a result of the presence of hazardous substances in electrical and electronic equipment, end users of electrical and electronic equipment should understand the meaning of the crossed-out wheeled bin symbol. Do not dispose of WEEE as unsorted municipal waste and have to collect such WEEE separately.
Safety
This equipment is designed with the utmost care for the safety of those who install and use it. However, special attention must be paid to the dangers of electric shock and static electricity when working with electrical equipment. All guidelines of this and of the computer manufacture must therefore be allowed at all times to ensure the safe use of the equipment.
Customer Service
For information on customer service and support for the UTM Content Security Gateway, please refer to the following Website URL:
http://www.planet.com.tw
Before contacting customer service, please take a moment to gather the following information:
UTM Content Security Gateway serial number and MAC address
Any error messages that displayed when the problem occurred
Any software running when the problem occurred
Steps you took to resolve the problem on your own
Revision
User’s Manual for PLANET UTM Content Security Gateway
Model: CS-2000
Rev: 2.0 (July, 2009)
CS-2000 UTM Content Security Gateway User’s Manual
Table of Contents
CHAPTER 1: INTRODUCTION ........................................................................................................................ 1
1.1 F
EATURES
1.2 P
ACKAGE CONTENTS
1.3 CS-2000 F
1.4 S
PECIFICATION
CHAPTER 2: INSTALLATION .......................................................................................................................... 6
2.1 I
NSTALLATION REQUIREMENTS
2.2 F
RONT PANEL
2.3 L
OGIN
2.4 A
PPLICATION
CHAPTER 3: SYSTEM ....................................................................................................................................11
3.1 A
DMINISTRATION
3.1.1 Admin ............................................................................................................................................. 13
3.1.2 Permitted IPs ................................................................................................................................. 15
3.1.3 Software Update ............................................................................................................................ 16
................................................................................................................................................................ 1
.............................................................................................................................................. 3
RONT VIEW
........................................................................................................................................................ 4
.......................................................................................................................................................... 6
....................................................................................................................................................................... 7
............................................................................................................................................................ 8
........................................................................................................................................... 3
............................................................................................................................... 6
.................................................................................................................................................... 11
3.2 C
ONFIGURE
3.2.1 Setting ............................................................................................................................................ 21
3.2.2 Date/Time....................................................................................................................................... 27
3.2.3 Multiple Subnet .............................................................................................................................. 28
3.2.4 Route Table .................................................................................................................................... 31
3.2.5 DHCP............................................................................................................................................. 35
3.2.5 DHCP............................................................................................................................................. 35
3.2.6 DDNS............................................................................................................................................. 37
3.2.7 Host Table ...................................................................................................................................... 39
3.2.8 SNMP............................................................................................................................................. 40
3.2.9 Language ....................................................................................................................................... 42
3.3 L
OGOUT
CHAPTER 4: INTERFACE.............................................................................................................................. 44
4.1 LAN ....................................................................................................................................................................... 46
4.2 WAN...................................................................................................................................................................... 47
4.3 DMZ ...................................................................................................................................................................... 52
........................................................................................................................................................... 17
................................................................................................................................................................. 43
CHAPTER 5: POLICY OBJECT ..................................................................................................................... 54
5.1 A
DDRESS
............................................................................................................................................................... 54
5.2 S
5.3 S
ERVICE
CHEDULE
CS-2000 UTM Content Security Gateway User’s Manual
................................................................................................................................................................ 64
............................................................................................................................................................. 73
5.4 QOS....................................................................................................................................................................... 75
5.5 A
UTHENTICATION
5.5.1 Example 1 User & User Group Authentication .............................................................................. 85
5.5.2 Example 2 RADIUS Server Authentication.................................................................................... 88
5.5.3 Example 3 POP3 Server Authentication...................................................................................... 102
5.5.4 Example 4 LDAP Server Authentication ...................................................................................... 105
5.6 C
ONTENT BLOCKING
5.7 IM/P2P B
5.8 V
IRTUAL SERVER
5.9 VPN..................................................................................................................................................................... 152
5.9.1 VPN Wizard.................................................................................................................................. 155
5.9.2 Example 1 .................................................................................................................................... 162
5.9.3 Example 2 .................................................................................................................................... 177
5.9.4 Example 3 .................................................................................................................................... 223
5.9.5 Example 4 .................................................................................................................................... 237
5.9.6 Example 5 .................................................................................................................................... 257
................................................................................................................................................... 79
........................................................................................................................................... 119
LOCKING
.............................................................................................................................................. 131
................................................................................................................................................. 138
CHAPTER 6: POLICY................................................................................................................................... 270
CHAPTER 7: MAIL SECURITY .................................................................................................................... 298
7.1 C
ONFIGURE
7.1.1 Setting .......................................................................................................................................... 299
7.1.2 Mail Relay .................................................................................................................................... 303
7.1.3 Mail Account................................................................................................................................. 309
7.1.4 Mail Notice ................................................................................................................................... 318
7.2 A
NTI-SPAM
7.2.1 Setting .......................................................................................................................................... 332
7.2.2 Personal Rule .............................................................................................................................. 336
7.2.3 Global Rule .................................................................................................................................. 337
7.2.4 Whitelist........................................................................................................................................ 339
7.2.5 Blacklist ........................................................................................................................................ 339
7.2.6 Training ........................................................................................................................................ 340
7.2.7 Spam Mail .................................................................................................................................... 341
7.2.8 The Advanced Description ........................................................................................................... 343
......................................................................................................................................................... 298
........................................................................................................................................................... 331
7.2.9 Anti-Spam Examples.................................................................................................................... 347
7.3 A
NTI-VIRUS
7.3.1 Setting .......................................................................................................................................... 395
7.3.2 Virus Mail ..................................................................................................................................... 398
.......................................................................................................................................................... 394
CS-2000 UTM Content Security Gateway User’s Manual
7.3.3 Anti-Virus Examples..................................................................................................................... 400
7.4 M
AIL REPORT
7.4.1 Setting .......................................................................................................................................... 412
7.4.2 Statistics....................................................................................................................................... 418
7.4.3 Log ............................................................................................................................................... 420
CHAPTER 8: IDP .......................................................................................................................................... 424
8.1 C
ONFIGURE
8.2 S
IGNATURE
8.2.1 Anomaly ....................................................................................................................................... 430
8.2.2 Pre-defined .................................................................................................................................. 431
8.3 IDP R
8.3.1 Setting .......................................................................................................................................... 439
8.3.2 Statistics....................................................................................................................................... 444
8.3.3 Log ............................................................................................................................................... 446
CHAPTER 9: ANOMALY FLOW IP .............................................................................................................. 450
EPORT
...................................................................................................................................................... 411
......................................................................................................................................................... 424
.......................................................................................................................................................... 429
........................................................................................................................................................ 438
CHAPTER 10: WEB VPN/SSL VPN............................................................................................................. 455
CHAPTER 11: ADVANCE............................................................................................................................. 465
11.1 I
NBOUND BALANCE
11.1.1 Inbound Load Balance Examples .............................................................................................. 475
11.2 H
IGH AVAILABILITY
CHAPTER 12: MONITOR ............................................................................................................................. 515
12.1 LOG................................................................................................................................................................... 515
12.1.1 Log Examples ............................................................................................................................ 521
12.2 A
CCOUNTING REPORT
12.3 S
TATI STICS
12.4 D
IAGNOSTIC
12.5 W
12.6 S
AKE ON LAN
TATU S
12.6.1 Interface ..................................................................................................................................... 558
12.6.2 System Info ................................................................................................................................ 560
........................................................................................................................................................ 543
.............................................................................................................................................................. 557
............................................................................................................................................ 465
............................................................................................................................................. 505
...................................................................................................................................... 530
...................................................................................................................................................... 549
.................................................................................................................................................... 555
12.6.3 Authentication ............................................................................................................................ 562
12.6.4 ARP Table .................................................................................................................................. 563
12.6.5 Sessions Info ............................................................................................................................. 564
12.6.6 DHCP......................................................................................................................................... 567
CS-2000 UTM Content Security Gateway User’s Manual

Chapter 1: Introduction

The innovation of the Internet has created a tremendous worldwide opportunities for e-business and
information sharing, but network security problems also come out. So the request of security will
be the primary concerned for the enterprises. The new model, PLANET UTM Content Security
Gateway CS-2000, a special designed of security gateway, can adopt Heuristics Analysis to filter
spam and virus mail, and the auto-training system can raise identify rate of spam. The built-in 80GB
Hard Disk can store the spam mail in quarantine. The Anti-virus application has double virus scan
engines - Clam and Sophos which can detect viruses, worms and other threats from transferring
E-mail and Internet network. It also provides the mail report by Daily, Weekly, Monthly and Yearly
and helps the administrators monitor the mail status easily.
The CS-2000 can filter spam and virus mail. Moreover, the IDP and firewall functions can
defense hackers and blaster attacks from Internet or Intranet. The complete function in one device
can provide security solutions and the secure environment better than ever.
The CS-2000 not only supports the fully security features, such as Content Blocking to block
specific URL, Scripts, IM/P2P program, Authentication, IPSec, PPTP VPN server/Client, SSL VPN,
QoS, High Availability and Inbound Load-Balancing etc., but also provides the higher performance.
All Gigabit Ethernet interfaces provide the higher speeds for your network applications. Built-in two
WAN interfaces allow the CS-2000 to support Outbound/Inbound load balance and WAN fail-over
feature. Furthermore, the VPN Trunk provides VPN fail-over and load balance features, that can
offer a VPN redundant mechanism to keep the VPN connection being on line.

1.1 Features

All Gigabit Interface: The CS-2000 supports all Gigabit Ethernet interfaces, it provides the higher
performance for your network environment.
Anti-Spam Filtering: Multiple defense layers (Spam Fingerprint, Blacklist & Whitelist, Bayesian Filtering,
Spam Signature, Graylist, Checking sender account and IP address in RBL), and Heuristics Analysis to block over 95% spam mail. Customizable notification options and spam mail report are provided for administrator. Varied actions toward spam mail include: Delete, Deliver, Forward and Store in the quarantine. Built-in auto-training system to rise identify rate of spam mail substantially.
Anti-Virus Protection: Built-in double virus scan engines can detect viruses, worms, and other threats
from email transfer. Scan mission-critical content protocols-SMTP, POP3 in real time as traffic enters the network to provide maximum protection. Customizable notification options and virus mail report are provided for administrator. Varied actions toward spam mail include: Delete, Deliver, Forward and Store in the quarantine.
Anti-Virus for HTTP, FTP, P2P, IM, NetBIOS: The CS-2000 not only can provide Anti-virus feature for
mail, it also can filter the virus from varied protocol. The virus pattern can be updated automatically or manually.
- 1 -
CS-2000 UTM Content Security Gateway User’s Manual
VPN Connectivity: The CS-2000 supports several VPN features -- IPSec VPN, SSL VPN and PPTP
server/client. The VPN Tunnel with DES / 3DES / AES encryption and SHA-1 / MD5 authentication that provide secured network traffic over public Internet. VPN Wizard can help administrator to have an easy way to configure VPN settings.
SSL VPN: SSL VPN does not need to install any software or hardware. Only need to use the web
browser and easily establish VPN connections for transferring the data by SSL encryption.
VPN Trunk: VPN trunk function provides VPN load balance and VPN fail-over feature to keep the VPN
connection more reliable.
Content Filtering: The CS-2000 can block network connection based on URLs, Scripts (The Pop-up,
Java Applet, cookies and Active X), P2P (eDonkey, Bit Torrent, WinMX and more), Instant Messaging (MSN, Yahoo Messenger, ICQ, QQ, Skype and Google Talk) and Download / Upload. If there are new updated version of P2P or IM software in client side, CS-2000 will detect the difference and update the Content Filtering pattern to renew the filtering mechanism.
IDP: Built-in IDP function can detect and prevent the Hacker attacks, Anomaly Flow, and Signatures
from Internet. CS-2000 provides three kinds of the Signature to complete the intrusion detection system, user can select to configure “Anomaly”, “Pre-defined” and “Custom” according to the current environment’s request.
Policy-based Firewall: The built-in policy-based firewall prevent many known hacker attack including
SYN attack, ICMP flood, UDP flood, Ping of Death, etc. The access control function allowed only specified WAN or LAN users to use only allowed network services on specified time.
QoS: Network packets can be classified based on IP address, IP subnet and TCP/UDP port number and
give guarantee and maximum bandwidth with three levels of priority.
User Authentication: Web-based authentication allows users to be authenticated by web browser.
User database can be configured on the devices; CS-2000 also supports the authenticated database through external RADIUS, POP3 and LDAP server.
WAN Backup: The CS-2000 can monitor each WAN link status and automatically activate backup links
when a failure is detected. The detection is based on the configurable target Internet addresses.
Outbound Load Balancing: The network sessions are assigned based on the user configurable load
balancing mode, including “Auto”, “Round-Robin”, “By Traffic”, “By Session” and “By Packet”. User can also configure which IP or TCP/UDP type of traffic use which WAN port to connect.
Inbound Load Balancing: The CS-2000 provides the Inbound Load Balancing for enterprise’s internal
server. The Inbound Load Balancing can reduce the server loading and system crash risks, in order to improve the server working efficiency.
Multiple NA
T: Multiple NAT allows local port to set multiple subnet works and connect to the Internet
through different WAN IP addresses.
High Availability: The CS-2000 provides High Availability function, and the redundant system will avoid
influencing the network traffic because of the device crash down.
- 2 -
CS-2000 UTM Content Security Gateway User’s Manual

1.2 Package Contents

The following items should be included:
CS-2000 x 1
Quick Installation Guide x 1
User’s Manual CD x 1
Power cord x 1
Console cable x 1
Cat6 Cable x 4
Screw Package x 1
Rack-mount ear x 2
Mat x 4
If any of the contents are missing or damaged, please contact your dealer or distributor immediately.

1.3 CS-2000 Front View

CS-2000 Front Panel
LED / Port Definition
LED / Port Description
PWR
HD
Console
(9600, 8, N, 1)
WAN1
WAN2
LAN
DMZ
Power is supplied to this device.
Blinks to indicate this devise is being to access the Hard Disk.
Connect this serial port for checking network interface setting and
can reset to factory setting.
LED1 Orange Steady on indicates the port is connected to
other network device.
Blink to indicates there is traffic on the port
LED2
Orange Steady on indicates the port is connected at
1000Mbps speed
Green Steady on indicates the port is connected at
100Mbps speed
Off The LED off to indicate the port is connected at
10Mbps speed
- 3 -
CS-2000 UTM Content Security Gateway User’s Manual
A

1.4 Specification

Product UTM Content Security Gateway Model CS-2000 Hardware Ethernet
Console 1 x RS-232 (9600, 8, N, 1) Hard Disk 80 GB H/W Watch-Dog Auto reboot when detecting system fail Software Management Web (English, Traditional Chinese, Simplified Chinese) Operation Mode DMZ_Transparent, DMZ_NAT, NAT Routing Protocol Static Route, RIPv2 Concurrent Sessions 1,000,000 Email Capacity per Day 1,800,000 Firewall Performance 300Mbps VPN Performance 46Mbps VPN 3DES Performance 30Mbps Firewall Security Policy-based access control
VPN Tunnels (Connection/Configure) VPN Function IPSec, SSL VPN, PPTP server and client
Content Filtering URL Blocking
IDP Anti-Virus for HTTP, FTP, P2P, IM, NetBIOS
Anti-Virus Virus scan engine: Two scan engines - Sophos and Clam
Anti-Spam Inbound scanning for external and internal Mail Server
QoS Policy-based bandwidth management
LAN
WAN
DMZ
1 x 10/100/1000Based-T RJ-45, Auto-negotiation, Auto MDI / MDI-X
2 x 10/100/1000Based-T RJ-45, Auto-negotiation, Auto MDI / MDI-X
1 x 10/100/1000Based-T RJ-45, Auto-negotiation, Auto MDI / MDI-X
Stateful Packet Inspection (SPI) NAT / NAPT 200 / 1000
DES, 3DES and AES encrypting SHA-1 / MD5 authentication algorithm Remote access VPN (Client-to-Site) and Site to Site VPN
Script Blocking (Popup, Java Applet, cookies and Active X) IM blocking (MSN, Yahoo Messenger, ICQ, QQ, Skype, Google Talk and more) P2P blocking (eDonkey, Bit Torrent, WinMX and more) Download and Upload blocking
Automatic or manual update virus and signature database Anomaly: Syn Flood, UDP Flood, ICMP Flood and more Pre-defined: Backdoor, DDoS, DoS, Exploit, NetBIOS and Spyware Custom: User defined based on TCP, UDP, ICMP or IP protocol Yearly, Monthly, Weekly and Daily Report support
Email attachment virus scanning by SMTP, POP3 Inbound scanning for internal and external Mail Server
ction of infected mail: Delete, Deliver to the recipient, forward to an account and store in quarantine Automatic or manual update virus database
Support Spam Fingerprint, Bayesian, Signature, RBL and Graylist filtering, checking sender account and IP to filter the spam mail Black list and white list support auto training system Action of spam mail: Delete, Deliver to the recipient, forward to an account and store in quarantine Yearly, Monthly, Weekly and Daily Report support
Guarantee and maximum bandwidth with 3 priority levels Classify traffics based on IP, IP subnet, TCP/UDP port
- 4 -
CS-2000 UTM Content Security Gateway User’s Manual
User authentication Built-in user database with up to 500 entries
Support local database, RADIUS, POP3 and LDAP authentication
Logs Traffic Log, Event Log and Connection Log
Log can be saved from web, backup by e-mail or syslog server
Accounting Report Record Inbound and Outbound traffic’s utilization by Source IP, Destination IP
and Service Backup Accounting Report for Outbound and Inbound traffic
Statistics WAN Ports traffic statistic and policies statistic with graph display Others Dynamic DNS
NTP support Multiple Server load balancing Outbound / Inbound load balancing High Availability Multiple Subnet SNMP v1, v2, v3
- 5 -
CS-2000 UTM Content Security Gateway User’s Manual

Chapter 2: Installation

2.1 Installation Requirements

Before installing CS-2000, make sure your network meets the following requirements.
- Mechanical Requirements
CS-2000 is installed between your Internet connection and local area network. You can place it on the
table or rack, and locate the unit near the power outlet.
- Electrical Requirements
CS-2000 is a power-required device, which means, it will not work until it is powered. If your network PCs
will need to transmit data all the time, please consider use an UPS (Uninterrupted Power Supply) for your
CS-2000. It will prevent you from network data loss. In some area, installing a surge suppression device
may also help to protect your device from being damaged by unregulated surge or current to the CS-2000.
- Network Requirements
In order for CS-2000 to secure your network traffic, the traffic must pass through the device at a useful
point in a network. In most situations, CS-2000 should be placed behind the Internet connection device.

2.2 Front Panel

Fig. 1 Interface description
Power LED: Lights green, it means the CS-2000 appliance is power on, and it’s starting
up time takes about 1 minute.
Hard Disk LED: Glitters green as system is reading or accessing data.
Console Port: A 9-pin serial port for checking LAN interface setting and can reset the
factory setting.
LAN Port:The LAN interface that links internal network.
WAN 1/2 Port:The WAN interface 1/2 connects to an external network.
DMZ Port: The Demilitarized Zone is the small sub network that sits between a trusted
internal network and untrusted external network. The opened DMZ server is well protected
by the CS-2000 appliance because it’s isolated from the internal network. The network
user cannot directly access the internal resources
- 6 -
CS-2000 UTM Content Security Gateway User’s Manual

2.3 Login

STEP 1:
Connect both the Administrator’s PC and the LAN port of the Content Security Gateway to a hub or switch. Make sure there is a link light on the hub/switch for both connections. The CS-2000 has an embedded web server used for management and configuration. Use a web browser to display the configurations of the Content Security Gateway (such as Internet Explorer 4 (or above) or Netscape 4.0 (or above) with full java script support). The default IP address of the Content Security Gateway is 192.168.1.1 with a subnet mask of
255.255.255.0. Therefore, the IP address of the Administrator PC must be in the range between 192.168.1.2–
192.168.1.254.
By default, the CS-2000 is shipped with its DHCP Server function enabled. This means the client computers on the LAN network including the Administrator PC can set their TCP/IP settings to automatically obtain an IP address from the Content Security Gateway.
The following table is a list of private IP addresses. These addresses may not be used as a WAN IP address.
10.0.0.0 ~ 10.255.255.255
172.16.0.0 ~ 172.31.255.255
192.168.0.0 ~ 192.168.255.255
STEP 2:
Once the Administrator’s PC has an IP address on the same network as the Content Security Gateway, open up an Internet web browser and type in http://192.168.1.1
STEP 3:
A pop-up screen will appear and prompt for a username and password. A username and password is required to connect to the Content Security Gateway. Enter the default login username and password of Administrator (Figure-1).
Username: admin Password: admin
Click OK to login the CS-2000.
in the address bar.
Figure-1 Login Web UI
- 7 -
Loading...