User manual D-LINK DFL-200 NETDEFEND

[. . . ] D-Link DFL-200 Network Security Firewall Manual Building Networks for People Ver. 1. 01 2005/01/13 Contents Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Features and Benefits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Introduction to Firewalls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [. . . ] Just fill in the following settings: VPN Name, Source Subnet (Local Net), Destination Gateway (If LAN-to-LAN), Destination Subnet (If LAN-to-LAN) and Authentication Method (Pre-shared key or Certificate). The firewalls on both ends must use the same Preshared key or set of Certificates and IPSec lifetime to make a VPN connection. 42 Introduction to PPTP PPTP, Point-to-Point Tunneling Protocol, is used to provide IP security at the network layer. A PPTP based VPN is made up by these parts: · · · · Point-to-Point Protocol (PPP) Authentication Protocols (PAP, CHAP, MS-CHAP v1, MS-CHAP v2) Microsoft Point-To-Point Encryption (MPPE) Generic Routing Encapsulation (GRE) PPTP uses TCP port 1723 for it's control connection and uses GRE (IP protocol 47) for the PPP data. PPTP supports data encryption by using MPPE. Introduction to L2TP L2TP, Layer 2 Tunneling Protocol, is used to provide IP security at the network layer. An L2TP based VPN is made up by these parts: · · · Point-to-Point Protocol (PPP) Authentication Protocols (PAP, CHAP, MS-CHAP v1, MS-CHAP v2) Microsoft Point-To-Point Encryption (MPPE) L2TP uses UDP to transport the PPP data, this is often encapsulated in IPSec for encryption instead of using MPPE. Point-to-Point Protocol PPP (Point-to-Point Protocol) is a standard for transporting datagram's over point-to-point links. It is used to encapsulate IP packets for transport between two peers. PPP consists of these three components: · · · Link Control Protocols (LCP), to negotiate parameters, test and establish the link. Network Control Protocol (NCP), to establish and negotiate different network layer protocols (DFL-200 only supports IP) Data encapsulation, to encapsulate datagram's over the link. To establish a PPP tunnel, both sides send LCP frames to negotiate parameters and test the data link. If authentication is used, at least one of the peers has to authenticate itself before the network layer protocol parameters can be negotiated using NCP. During the LCP and NCP negotiation optional parameters such as encryption, can be negotiated. When LCP and NCP negotiation is done, IP datagram's can be sent over the link. Authentication Protocols PPP supports different authentication protocols, PAP, CHAP, MS-CHAP v1 and MSCHAP v2 is supported. Which authentication protocol to use is negotiated during LCP negotiation. PAP PAP (Password Authentication Protocol) is a simple, plaintext authentication scheme, which means that user name and password are sent in plaintext. PAP is therefore not a secure authentication protocol. CHAP CHAP (Challenge Handshake Authentication Protocol) is a challenge-response authentication protocol specified in RFC 1994. CHAP uses a MD5 one-way encryption scheme to hash the response to a challenge issued by the DFL-200. CHAP is better then PAP in that the password is never sent over the link. Instead the password is used to create the one-way MD5 hash. That means that CHAP requires passwords to be stored in a reversibly encrypted form. MS-CHAP v1 MS-CHAP v1 (Microsoft Challenge Handshake Authentication Protocol version 1) is similar to CHAP, the main difference is that with MS-CHAP v1 the password only needs to be stored as a MD4 hash instead of a reversibly encrypted form. Another difference is that MSCHAP v1 uses MD4 instead of MD5. MS-CHAP v2 MS-CHAP v2 (Microsoft Challenge Handshake Authentication Protocol version 1) is more secure then MS-CHAP v1 as it provides two ­way authentication. MPPE, Microsoft Point-To-Point Encryption MPPE is used is used to encrypt Point-to-Point Protocol (PPP) packets. MPPE uses the RSA RC4 algorithm to provide data confidentiality. The length of the session key to be used for the encryption can be negotiated. MPPE currently supports 40-bit, 56-bit and 128-bit RC4 session keys. 44 L2TP/PPTP Clients General parameters Name ­ Specifies a name for the PPTP/L2TP Client. Username - Specify the username to use for this PPTP/L2TP Client. [. . . ] If you for example don't want users to be able to download executable files add *. exe in this list. 2. Make sure the http-outbound service exists and is using the HTTP ALG, Firewall->Services: Find the http-outbound service in the list and click Edit. If there is no service with that name you will have to create one by clicking Add new at the bottom of the list. TCP / UDP Service should be selected and protocol should be set to TCP. [. . . ]