D-Link DFL-200 Product Manual - Page 41

Protocol-independent settings, To use an Application Layer Gateway - problems

Get D-Link DFL-200 - Security Appliance PDF manuals and user guides
UPC - 790069268823
View all D-Link DFL-200 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 41 highlights

Protocol-independent settings Allow ICMP errors from the destination to the source - ICMP error messages are sent in several situations: for example, when an IP packet cannot reach its destination. The purpose of these error control messages is to provide feedback about problems in the communication environment. However, ICMP error messages and firewalls are usually not a very good combination; the ICMP error messages are initiated at the destination host (or a device within the path to the destination) and sent to the originating host. The result is that the ICMP error message will be interpreted by the firewall as a new connection and dropped, if not explicitly allowed by the firewall rule-set. It is generally not a good idea to allow any inbound ICMP message to be able to have those error messages forwarded. To solve this problem, the DFL-200 can be instructed to pass an ICMP error message only if it is related to an existing connection. Check this option to enable this feature for connections using this service. ALG - Similar to the way most stateful inspection firewalls behave, the DFL-200 filters only information found in packet headers, such as IP, TCP, UDP, or ICMP headers. In some situations though, filtering only header data is not sufficient. The FTP protocol, for instance, includes IP address and port information in the protocol payload. In these cases, the firewall needs to be able to examine the payload data and carry out appropriate actions. The DFL-200 provides this functionality using Application Layer Gateways (ALG). To use an Application Layer Gateway, the appropriate Application Layer Gateway definition is selected in the dropdown menu. The selected Application Layer Gateway will thus manage network traffic that matches the policy using this service. Currently, the DFL-200 supports two Application Layer Gateways, one is used to manage the FTP protocol and the other one is a HTTP Content Filtering ALG. For detailed information about how to configure the HTTP Application Layer Gateway, please see the Content Filtering chapter.

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
Protocol-independent settings
Allow ICMP errors from the destination to the source
– ICMP error messages are sent
in several situations: for example, when an IP packet cannot reach its destination. The
purpose of these error control messages is to provide feedback about problems in the
communication environment.
However, ICMP error messages and firewalls are usually not a very good combination; the
ICMP error messages are initiated at the destination host (or a device within the path to the
destination) and sent to the originating host. The result is that the ICMP error message will be
interpreted by the firewall as a new connection and dropped, if not explicitly allowed by the
firewall rule-set. It is generally not a good idea to allow any inbound ICMP message to be able
to have those error messages forwarded.
To solve this problem, the DFL-200 can be instructed to pass an ICMP error message only
if it is related to an existing connection. Check this option to enable this feature for
connections using this service.
ALG
– Similar to the way most stateful inspection firewalls behave, the DFL-200 filters
only information found in packet headers, such as IP, TCP, UDP, or ICMP headers.
In some situations though, filtering only header data is not sufficient. The FTP protocol, for
instance, includes IP address and port information in the protocol payload. In these cases, the
firewall needs to be able to examine the payload data and carry out appropriate actions. The
DFL-200 provides this functionality using Application Layer Gateways (ALG).
To use an Application Layer Gateway, the appropriate Application Layer Gateway
definition is selected in the dropdown menu. The selected Application Layer Gateway will thus
manage network traffic that matches the policy using this service.
Currently, the DFL-200 supports two Application Layer Gateways, one is used to manage
the FTP protocol and the other one is a HTTP Content Filtering ALG. For detailed information
about how to configure the HTTP Application Layer Gateway, please see the Content Filtering
chapter.