Home » D-Link Manuals » Networking » D-Link DFL-210-AV-12 » Manual Viewer

D-Link DFL-210-AV-12 User Manual - Page 549

Max L2TP Length setting

Get D-Link DFL-210-AV-12 PDF manuals and user guides

View all D-Link DFL-210-AV-12 manuals

Add to My Manuals
Save this manual to your list of manuals

Page 549 highlights

advanced settings, 61 memlog, 58 SNMP traps, 60 syslog, 58 login authentication, 372 log messages, 57 Log non IP4 setting, 511 Log Open Fails setting, 521 Logout at shutdown (RADIUS) setting, 65, 66 logout from CLI, 41 Log Oversized Packets setting, 526 Log Received TTL 0 setting, 511 Log Reverse Opens setting, 521 Log State Violations setting, 521 loopback interfaces, 93, 94 Low Broadcast TTL Action setting, 514 M MAC addresses, 112 management interfaces, 28 advanced settings, 50 configuring remote access, 41 managing NetDefendOS, 28 Max AH Length setting, 525 Max Auto Routes (DHCP) setting, 237 Max Concurrent (reassembly) setting, 531 Max Connections (reassembly) setting, 532 Max Connections setting, 522 Max ESP Length setting, 525 Max GRE Length setting, 525 Max Hops (DHCP) setting, 236 Max ICMP Length setting, 525 Max IPIP/FWZ Length setting, 526 Max IPsec IPComp Length setting, 526 Max L2TP Length setting, 526 Max lease Time (DHCP) setting, 236 Max Memory (reassembly) setting, 532 Max OSPF Length setting, 526 Max Other Length setting, 526 Max Pipe Users setting, 532 Max PPM (DHCP) setting, 236 Max PPP Resends setting, 437 Max Radius Contexts setting, 66 Max Reassembly Time Limit setting, 529 max sessions services parameter, 88 Max Size (reassembly) setting, 531 Max SKIP Length setting, 526 Max TCP Length setting, 525 Max time drift setting, 142 Max Transactions (DHCP) setting, 236 Max UDP Length setting, 525 memlog, 58 MIME filetype verification in FTP ALG, 252 in HTTP ALG, 247 in POP3 ALG, 268 in SMTP ALG, 259 list of filetypes, 540 Min Broadcast TTL setting, 514 Minimum Fragment Length setting, 529 multicast, 199 Alphabetical Index address translation, 202 forwarding, 200 IGMP, 204 reverse path forwarding, 199 Multicast Enet Sender setting, 225 Multicast Mismatch setting, 514 Multicast TTL on Low setting, 512 multiple login authentication, 372 multiplex rules, 200 creating with CLI, 202 N NAT, 341 anonymizing with, 344 IP rules, 125 pools, 346 stateful pools, 346 traversal, 405 network address translation (see NAT) NTP (see time synchronization) Null Enet Sender setting, 224 O open shortest path first (see OSPF) OSPF, 176 aggregates, 181, 189 areas, 180, 186 autonomous system, 179 checking deployment, 195 command, 195 concepts, 179 dynamic routing rules, 190 interface, 187 neighbors, 189 router process, 184 setting up, 193 virtual links, 181, 189 Other Idle Lifetimes setting, 523 overriding content filtering, 304 P packet flow full description, 23 simplified, 123 password length, 40 pcapdump, 72 downloading output files, 73 output file cleanup, 73 output file naming, 73 pcap file format (see pcapdump) phishing (see content filtering) Ping Idle Lifetime setting, 523 Ping poll interval setting, 161 pipe rules, 452 pipes, 452 policies, 121 policy based routing, 165 Poll Interval setting, 67 POP3 ALG, 268 Port 0 setting, 532 port address translation, 356 549

Section	Page
User Manual	3
Table of Contents	4
Preface	14
Chapter 1. NetDefendOS Overview	16
1.1. Features	16
1.2. NetDefendOS Architecture	19
1.2.1. State-based Architecture	19
1.2.2. NetDefendOS Building Blocks	19
1.2.3. Basic Packet Flow	20
1.3. NetDefendOS State Engine Packet Flow	23
Chapter 2. Management and Maintenance	28
2.1. Managing NetDefendOS	28
2.1.1. Overview	28
2.1.2. The Default Administrator Account	29
2.1.3. The Web Interface	30
2.1.4. The CLI	34
2.1.5. CLI Scripts	43
2.1.6. Secure Copy	46
2.1.7. The Console Boot Menu	48
2.1.8. Management Advanced Settings	50
2.1.9. Working with Configurations	51
2.2. Events and Logging	57
2.2.1. Overview	57
2.2.2. Log Messages	57
2.2.3. Creating Log Receivers	58
2.2.4. Logging to MemoryLogReceiver	58
2.2.5. Logging to Syslog Hosts	58
2.2.6. SNMP Traps	60
2.2.7. Advanced Log Settings	61
2.3. RADIUS Accounting	62
2.3.1. Overview	62
2.3.2. RADIUS Accounting Messages	62
2.3.3. Interim Accounting Messages	64
2.3.4. Activating RADIUS Accounting	64
2.3.5. RADIUS Accounting Security	64
2.3.6. RADIUS Accounting and High Availability	64
2.3.7. Handling Unresponsive Servers	65
2.3.8. Accounting and System Shutdowns	65
2.3.9. Limitations with NAT	65
2.3.10. RADIUS Advanced Settings	65
2.4. Hardware Monitoring	67
2.5. SNMP Monitoring	69
2.5.1. SNMP Advanced Settings	70
2.6. The pcapdump Command	72
2.7. Maintenance	75
2.7.1. Auto-Update Mechanism	75
2.7.2. Backing Up Configurations	75
2.7.3. Restore to Factory Defaults	77
Chapter 3. Fundamentals	80
3.1. The Address Book	80
3.1.1. Overview	80
3.1.2. IP Addresses	80
3.1.3. Ethernet Addresses	82
3.1.4. Address Groups	83
3.1.5. Auto-Generated Address Objects	84
3.1.6. Address Book Folders	84
3.2. Services	85
3.2.1. Overview	85
3.2.2. Creating Custom Services	86
3.2.3. ICMP Services	89
3.2.4. Custom IP Protocol Services	91
3.2.5. Service Groups	91
3.2.6. Custom Service Timeouts	92
3.3. Interfaces	93
3.3.1. Overview	93
3.3.2. Ethernet Interfaces	95
3.3.2.1. Useful CLI Commands for Ethernet Interfaces	99
3.3.3. VLAN	101
3.3.4. PPPoE	105
3.3.5. GRE Tunnels	107
3.3.6. Interface Groups	111
3.4. ARP	112
3.4.1. Overview	112
3.4.2. The NetDefendOS ARP Cache	112
3.4.3. Creating ARP Objects	114
3.4.4. Using ARP Advanced Settings	116
3.4.5. ARP Advanced Settings Summary	117
3.5. IP Rule Sets	121
3.5.1. Security Policies	121
3.5.2. IP Rule Evaluation	124
3.5.3. IP Rule Actions	125
3.5.4. Editing IP rule set Entries	126
3.5.5. IP Rule Set Folders	126
3.5.6. Configuration Object Groups	127
3.6. Schedules	131
3.7. Certificates	133
3.7.1. Overview	133
3.7.2. Certificates in NetDefendOS	134
3.7.3. CA Certificate Requests	135
3.8. Date and Time	137
3.8.1. Overview	137
3.8.2. Setting Date and Time	137
3.8.3. Time Servers	138
3.8.4. Settings Summary for Date and Time	141
3.9. DNS	144
Chapter 4. Routing	147
4.1. Overview	147
4.2. Static Routing	148
4.2.1. The Principles of Routing	148
4.2.2. Static Routing	152
4.2.3. Route Failover	156
4.2.4. Host Monitoring for Route Failover	159
4.2.5. Advanced Settings for Route Failover	161
4.2.6. Proxy ARP	162
4.3. Policy-based Routing	165
4.3.1. Overview	165
4.3.2. Policy-based Routing Tables	165
4.3.3. Policy-based Routing Rules	165
4.3.4. Routing Table Selection	166
4.3.5. The Ordering parameter	166
4.4. Route Load Balancing	170
4.5. OSPF	176
4.5.1. Dynamic Routing	176
4.5.2. OSPF Concepts	179
4.5.3. OSPF Components	184
4.5.3.1. OSPF Router Process	184
4.5.3.2. OSPF Area	186
4.5.3.3. OSPF Interface	187
4.5.3.4. OSPF Neighbors	189
4.5.3.5. OSPF Aggregates	189
4.5.3.6. OSPF VLinks	189
4.5.4. Dynamic Routing Rules	190
4.5.4.1. Overview	190
4.5.4.2. Dynamic Routing Rule	191
4.5.4.3. OSPF Action	192
4.5.4.4. Routing Action	192
4.5.5. Setting Up OSPF	193
4.5.6. An OSPF Example	196
4.6. Multicast Routing	199
4.6.1. Overview	199
4.6.2. Multicast Forwarding with SAT Multiplex Rules	200
4.6.2.1. Multicast Forwarding - No Address Translation	200
4.6.2.2. Multicast Forwarding - Address Translation Scenario	202
4.6.3. IGMP Configuration	204
4.6.3.1. IGMP Rules Configuration - No Address Translation	205
4.6.3.2. IGMP Rules Configuration - Address Translation	207
4.6.4. Advanced IGMP Settings	209
4.7. Transparent Mode	212
4.7.1. Overview	212
4.7.2. Enabling Internet Access	217
4.7.3. Transparent Mode Scenarios	218
4.7.4. Spanning Tree BPDU Support	222
4.7.5. Advanced Settings for Transparent Mode	223
Chapter 5. DHCP Services	228
5.1. Overview	228
5.2. DHCP Servers	229
5.2.1. Static DHCP Hosts	232
5.2.2. Custom Options	233
5.3. DHCP Relaying	235
5.3.1. DHCP Relay Advanced Settings	236
5.4. IP Pools	238
Chapter 6. Security Mechanisms	242
6.1. Access Rules	242
6.1.1. Overview	242
6.1.2. IP Spoofing	243
6.1.3. Access Rule Settings	243
6.2. ALGs	245
6.2.1. Overview	245
6.2.2. The HTTP ALG	246
6.2.3. The FTP ALG	249
6.2.4. The TFTP ALG	258
6.2.5. The SMTP ALG	259
6.2.5.1. Anti-Spam Filtering	262
6.2.6. The POP3 ALG	268
6.2.7. The PPTP ALG	269
6.2.8. The SIP ALG	270
6.2.9. The H.323 ALG	280
6.2.10. The TLS ALG	294
6.3. Web Content Filtering	297
6.3.1. Overview	297
6.3.2. Active Content Handling	297
6.3.3. Static Content Filtering	298
6.3.4. Dynamic Web Content Filtering	300
6.3.4.1. Overview	300
6.3.4.2. Setting Up WCF	301
6.3.4.3. Content Filtering Categories	305
6.3.4.4. Customizing HTML Pages	312
6.4. Anti-Virus Scanning	314
6.4.1. Overview	314
6.4.2. Implementation	314
6.4.3. Activating Anti-Virus Scanning	315
6.4.4. The Signature Database	316
6.4.5. Subscribing to the D-Link Anti-Virus Service	316
6.4.6. Anti-Virus Options	316
6.5. Intrusion Detection and Prevention	320
6.5.1. Overview	320
6.5.2. IDP Availability for D-Link Models	320
6.5.3. IDP Rules	322
6.5.4. Insertion/Evasion Attack Prevention	324
6.5.5. IDP Pattern Matching	325
6.5.6. IDP Signature Groups	326
6.5.7. IDP Actions	327
6.5.8. SMTP Log Receiver for IDP Events	328
6.6. Denial-of-Service Attack Prevention	332
6.6.1. Overview	332
6.6.2. DoS Attack Mechanisms	332
6.6.3. Ping of Death and Jolt Attacks	332
6.6.4. Fragmentation overlap attacks: Teardrop, Bonk, Boink and Nestea	333
6.6.5. The Land and LaTierra attacks	333
6.6.6. The WinNuke attack	333
6.6.7. Amplification attacks: Smurf, Papasmurf, Fraggle	334
6.6.8. TCP SYN Flood Attacks	335
6.6.9. The Jolt2 Attack	335
6.6.10. Distributed DoS Attacks	335
6.7. Blacklisting Hosts and Networks	337
Chapter 7. Address Translation	340
7.1. Overview	340
7.2. NAT	341
7.3. NAT Pools	346
7.4. SAT	349
7.4.1. Translation of a Single IP Address (1:1)	349
7.4.2. Translation of Multiple IP Addresses (M:N)	354
7.4.3. All-to-One Mappings (N:1)	356
7.4.4. Port Translation	356
7.4.5. Protocols Handled by SAT	357
7.4.6. Multiple SAT Rule Matches	357
7.4.7. SAT and FwdFast Rules	358
Chapter 8. User Authentication	361
8.1. Overview	361
8.2. Authentication Setup	363
8.2.1. Setup Summary	363
8.2.2. The Local Database	363
8.2.3. External RADIUS Servers	365
8.2.4. External LDAP Servers	365
8.2.5. Authentication Rules	372
8.2.6. Authentication Processing	374
8.2.7. A Group Usage Example	375
8.2.8. HTTP Authentication	375
8.3. Customizing HTML Pages	379
Chapter 9. VPN	383
9.1. Overview	383
9.1.1. VPN Usage	383
9.1.2. VPN Encryption	384
9.1.3. VPN Planning	384
9.1.4. Key Distribution	385
9.1.5. The TLS Alternative for VPN	385
9.2. VPN Quick Start	387
9.2.1. IPsec LAN to LAN with Pre-shared Keys	388
9.2.2. IPsec LAN to LAN with Certificates	389
9.2.3. IPsec Roaming Clients with Pre-shared Keys	390
9.2.4. IPsec Roaming Clients with Certificates	392
9.2.5. L2TP Roaming Clients with Pre-Shared Keys	393
9.2.6. L2TP Roaming Clients with Certificates	394
9.2.7. PPTP Roaming Clients	395
9.3. IPsec Components	397
9.3.1. Overview	397
9.3.2. Internet Key Exchange (IKE)	397
9.3.3. IKE Authentication	403
9.3.4. IPsec Protocols (ESP/AH)	404
9.3.5. NAT Traversal	405
9.3.6. Algorithm Proposal Lists	407
9.3.7. Pre-shared Keys	408
9.3.8. Identification Lists	409
9.4. IPsec Tunnels	412
9.4.1. Overview	412
9.4.2. LAN to LAN Tunnels with Pre-shared Keys	414
9.4.3. Roaming Clients	414
9.4.4. Fetching CRLs from an alternate LDAP server	419
9.4.5. Troubleshooting with ikesnoop	420
9.4.6. IPsec Advanced Settings	427
9.5. PPTP/L2TP	431
9.5.1. PPTP Servers	431
9.5.2. L2TP Servers	432
9.5.3. L2TP/PPTP Server advanced settings	436
9.5.4. PPTP/L2TP Clients	437
9.6. CA Server Access	440
9.7. VPN Troubleshooting	443
9.7.1. General Troubleshooting	443
9.7.2. Troubleshooting Certificates	443
9.7.3. IPsec Troubleshooting Commands	444
9.7.4. Management Interface Failure with VPN	445
9.7.5. Specific Error Messages	445
9.7.6. Specific Symptoms	448
Chapter 10. Traffic Management	451
10.1. Traffic Shaping	451
10.1.1. Overview	451
10.1.2. Traffic Shaping in NetDefendOS	452
10.1.3. Simple Bandwidth Limiting	454
10.1.4. Limiting Bandwidth in Both Directions	455
10.1.5. Creating Differentiated Limits Using Chains	456
10.1.6. Precedences	457
10.1.7. Pipe Groups	462
10.1.8. Traffic Shaping Recommendations	465
10.1.9. A Summary of Traffic Shaping	466
10.1.10. More Pipe Examples	467
10.2. IDP Traffic Shaping	472
10.2.1. Overview	472
10.2.2. Setting Up IDP Traffic Shaping	472
10.2.3. Processing Flow	473
10.2.4. The Importance of Specifying a Network	473
10.2.5. A P2P Scenario	474
10.2.6. Viewing Traffic Shaping Objects	475
10.2.7. Guaranteeing Instead of Limiting Bandwidth	476
10.2.8. Logging	476
10.3. Threshold Rules	477
10.3.1. Overview	477
10.3.2. Limiting the Connection Rate/Total Connections	477
10.3.3. Grouping	478
10.3.4. Rule Actions	478
10.3.5. Multiple Triggered Actions	478
10.3.6. Exempted Connections	478
10.3.7. Threshold Rules and ZoneDefense	478
10.3.8. Threshold Rule Blacklisting	478
10.4. Server Load Balancing	480
10.4.1. Overview	480
10.4.2. SLB Distribution Algorithms	481
10.4.3. Selecting Stickiness	482
10.4.4. SLB Algorithms and Stickiness	483
10.4.5. Server Health Monitoring	484
10.4.6. Setting Up SLB_SAT Rules	485
Chapter 11. High Availability	489
11.1. Overview	489
11.2. HA Mechanisms	491
11.3. Setting Up HA	494
11.3.1. HA Hardware Setup	494
11.3.2. NetDefendOS Manual HA Setup	495
11.3.3. Verifying the Cluster Functions	496
11.3.4. Unique Shared Mac Addresses	497
11.4. HA Issues	498
11.5. Upgrading an HA Cluster	500
11.6. HA Advanced Settings	502
Chapter 12. ZoneDefense	504
12.1. Overview	504
12.2. ZoneDefense Switches	505
12.3. ZoneDefense Operation	506
12.3.1. SNMP	506
12.3.2. Threshold Rules	506
12.3.3. Manual Blocking and Exclude Lists	506
12.3.4. ZoneDefense with Anti-Virus Scanning	508
12.3.5. Limitations	508
Chapter 13. Advanced Settings	511
13.1. IP Level Settings	511
13.2. TCP Level Settings	515
13.3. ICMP Level Settings	520
13.4. State Settings	521
13.5. Connection Timeout Settings	523
13.6. Length Limit Settings	525
13.7. Fragmentation Settings	527
13.8. Local Fragment Reassembly Settings	531
13.9. Miscellaneous Settings	532
Appendix A. Subscribing to Updates	534
Appendix B. IDP Signature Groups	536
Appendix C. Verified MIME filetypes	540
Appendix D. The OSI Framework	544

Match case Limit results 1 per page

advanced settings, 61

memlog, 58

SNMP traps, 60

syslog, 58

log messages, 57

Log non IP4 setting, 511

Log Open Fails setting, 521

Logout at shutdown (RADIUS) setting, 65, 66

logout from CLI, 41

Log Oversized Packets setting, 526

Log Received TTL 0 setting, 511

Log Reverse Opens setting, 521

Log State Violations setting, 521

loopback interfaces, 93, 94

Low Broadcast TTL Action setting, 514

MAC addresses, 112

management interfaces, 28

advanced settings, 50

configuring remote access, 41

managing NetDefendOS, 28

Max AH Length setting, 525

Max Auto Routes (DHCP) setting, 237

Max Concurrent (reassembly) setting, 531

Max Connections (reassembly) setting, 532

Max Connections setting, 522

Max ESP Length setting, 525

Max GRE Length setting, 525

Max Hops (DHCP) setting, 236

Max ICMP Length setting, 525

Max IPIP/FWZ Length setting, 526

Max IPsec IPComp Length setting, 526

Max L2TP Length setting, 526

Max lease Time (DHCP) setting, 236

Max Memory (reassembly) setting, 532

Max OSPF Length setting, 526

Max Other Length setting, 526

Max Pipe Users setting, 532

Max PPM (DHCP) setting, 236

Max PPP Resends setting, 437

Max Radius Contexts setting, 66

Max Reassembly Time Limit setting, 529

max sessions

services parameter, 88

Max Size (reassembly) setting, 531

Max SKIP Length setting, 526

Max TCP Length setting, 525

Max time drift setting, 142

Max Transactions (DHCP) setting, 236

Max UDP Length setting, 525

memlog, 58

MIME filetype verification

in FTP ALG, 252

in HTTP ALG, 247

in POP3 ALG, 268

in SMTP ALG, 259

list of filetypes, 540

Min Broadcast TTL setting, 514

Minimum Fragment Length setting, 529

multicast, 199

address translation, 202

forwarding, 200

IGMP, 204

reverse path forwarding, 199

Multicast Enet Sender setting, 225

Multicast Mismatch setting, 514

Multicast TTL on Low setting, 512

multiple login authentication, 372

multiplex rules, 200

creating with CLI, 202

NAT, 341

anonymizing with, 344

IP rules, 125

pools, 346

stateful pools, 346

traversal, 405

network address translation (see NAT)

NTP (see time synchronization)

Null Enet Sender setting, 224

open shortest path first (see OSPF)

OSPF, 176

aggregates, 181, 189

areas, 180, 186

autonomous system, 179

checking deployment, 195

command, 195

concepts, 179

dynamic routing rules, 190

interface, 187

neighbors, 189

router process, 184

setting up, 193

virtual links, 181, 189

Other Idle Lifetimes setting, 523

overriding content filtering, 304

packet flow

full description, 23

simplified, 123

password length, 40

pcapdump, 72

downloading output files, 73

output file cleanup, 73

output file naming, 73

pcap file format (see pcapdump)

phishing (see content filtering)

Ping Idle Lifetime setting, 523

Ping poll interval setting, 161

pipe rules, 452

pipes, 452

policies, 121

policy based routing, 165

Poll Interval setting, 67

POP3 ALG, 268

Port 0 setting, 532

port address translation, 356

Alphabetical Index

549