User manual BILLION BIPAC 6404VP

[. . . ] BiPAC 6404VP / 6404VGP VoIP/(802. 11g) Broadband Firewall Router User's Manual Version Release 5. 08a Last Revision Date: 05-07-2007 Table of Contents CHAPTER 1: INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 INTRODUCTION TO YOUR ROUTER . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 FEATURES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 CHAPTER 2: INSTALLING THE ROUTER . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [. . . ] Block Duration: Victim Protection Block Duration: This is the duration for blocking Smurf attacks. Scan Attack Block Duration: This is the duration for blocking hosts that attempt a possible Scan attack. Scan attack types include X'mas scan, IMAP SYN/FIN scan and similar attempts. DoS Attack Block Duration: This is the duration for blocking hosts that attempt a possible Denial of Service (DoS) attack. Possible DoS attacks this attempts to block include Ascend Kill and WinNuke. Max TCP Open Handshaking Count: This is a threshold value to decide whether a SYN Flood attempt is occurring or not. Default value is 100 TCP SYN per seconds. Max PING Count: This is a threshold value to decide whether an ICMP Echo Storm is occurring or not. Default value is 15 ICMP Echo Requests (PING) per second. Max ICMP Count: This is a threshold to decide whether an ICMP flood is occurring or not. Default value is 100 ICMP packets per seconds except ICMP Echo Requests (PING). For SYN Flood, ICMP Echo Storm and ICMP flood, IDS will just warn the user in the Event Log. It cannot protect against such attacks. Chapter 4: Configuration 54 VoIP/(802. 11g) Broadband Firewall Router Table 2: Hacker attack types recognized by the IDS Intrusion Name Ascend Kill WinNuke Smurf Land attack Echo/CharGen Scan Echo Scan CharGen Scan X'mas Tree Scan IMAP SYN/FIN Scan SYN/FIN/RST/ACK Scan Detect Parameter Blacklist Ascend Kill data TCP Port 135, 137~139, Flag: URG ICMP type 8 Des IP is broadcast SrcIP = DstIP UDP Echo Port and CharGen Port UDP Dst Port = Echo(7) UDP Dst Port = CharGen(19) TCP Flag: X'mas TCP Flag: SYN/FIN DstPort: IMAP(143) SrcPort: 0 or 65535 TCP, No Existing session And Scan Hosts more than five. TCP No Existing session DstPort = Net Bus 12345, 12346, 3456 UDP, DstPort = Orifice Port (31337) Max TCP Open Handshaking Count (Default 100 c/sec) Max ICMP Count (Default 100 c/sec) Max PING Count (Default 15 c/sec) Src IP Src IP Type of Block Drop Packet Duration DoS DoS Victim Protection Yes Yes Show Log Yes Yes Dst IP Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Src IP Src IP Src IP Src IP Scan Scan Scan Scan Yes Yes Yes Yes Src IP Scan Yes Yes Net Bus Scan SrcIP Scan Yes Yes Back Orifice Scan SYN Flood ICMP Flood ICMP Echo SrcIP Scan Yes Yes Yes Yes Yes Src IP: Source IP Dst Port: Destination Port Src Port: Source Port Dst IP: Destination IP Chapter 4: Configuration 55 VoIP/(802. 11g) Broadband Firewall Router URL Filter URL (Uniform Resource Locator ­ e. g. an address in the form of http://www. abcde. com or http://www. example. com) filter rules allow you to prevent users on your network from accessing particular websites by their URL. There are no pre-defined URL filter rules; you can add filter rules to meet your requirements. Enable/Disable: To enable or disable URL Filter feature. Block Mode: A list of the modes that you can choose to check the URL filter rules. Disabled: No action will be performed by the Block Mode. URL filter rules will be monitoring and checking at all hours of the TimeSlot1 ~ TimeSlot16: It is self-defined time period. You may specify the time period to check the URL filter rules, i. e. For setup and detail, refer to Time Schedule section. Keywords Filtering: Allows blocking by specific keywords within a particular URL rather than having to specify a complete URL (e. g. [. . . ] Once the authentication has succeeded, users from this IP address will be able to view and modify the data. SNMP Version: SNMPv2c and SNMPv3 SNMPv2c is the combination of the enhanced protocol features of SNMPv2 without the SNMPv2 security. The "c" comes from the fact that SNMPv2c uses the SNMPv1 community string paradigm for "security", but is widely accepted as the SNMPv2 standard. SNMPv3 is a strong authentication mechanism, authorization with fine granularity for remote monitoring. Traps supported: Cold Start, Authentication Failure. [. . . ]