User manual SMC BR21VPN

[. . . ] SMC reserves the right to change specifications at any time without notice. Copyright © 2008 by SMC Networks, Inc. 20 Mason Irvine, CA 92618 All rights reserved. Printed in Taiwan Trademarks: SMC is a registered trademark; and EZ Connect is a trademark of SMC Networks, Inc. [. . . ] It can forbid the user browsing stock exchange website. . . etc. 112 Download Restrict the Internal Users to access to video, audio, and some specific sub-name file from http or ftp protocol directly STEP 1Enter the following settings in Download of Content Blocking function: Select All Types Blocking Click OK Complete the setting of Download Blocking. (Figure9-13) Figure9-13 Download Blocking WebUI 113 STEP 2Add a new Outgoing Policy and use in Content Blocking function: (Figure9-14) Figure9-14 Add New Download Blocking Policy Setting STEP 3Complete the Outgoing Policy of restricting the internal users to access to video, audio, and some specific sub-name file by http protocol directly: (Figure9-15) Figure9-15 Complete Download Blocking Policy Setting 114 P2P / IM Limit internal user access internet resources by P2P software. Step1. In IM / P2P Blocking Setting, add the following settings Click New Entry. Fig. Select eDonkey, Bit Torrent, WinMX, Foxy, KuGoo, AppleJuice, AudioGalaxy, DirectConnect, iMesh and MUTE. 10-6 Fig. 10-5 P2P blocking setting Fig. 10-6 Complete the P2P blocking setting 115 Step2. In Policy Outgoing, add one policy applied to P2P blocking setting. Fig. 10-7 Fig. 10-7 Set the policy applied to P2P blocking Step3. In Policy Outgoing , complete the policy setting of limit internal user to access internet resources by P2P software Fig. 10-8 Fig. 10-8 Complete the Policy setting of P2P blocking 116 Use P2P will seriously occupy network bandwidth and it can change its service port. So the MIS engineer not only set the service port in Service, but also need to set IM / P2P Blocking P2P Blocking. 117 Chapter 10 Virtual Server Virtual Server The real IP address provided from ISP is always not enough for all the users when the system manager applies the network connection from ISP. Generally speaking, in order to allocate enough IP addresses for all computers, an enterprise assigns each computer a private IP address, and converts it into a real IP address through SMC BR21VPN's NAT (Network Address Translation) function. (Take Web service for example) Virtual Server The external user use VoIP to connect with VoIP of LAN. (VoIP Port: TCP 1720, TCP 15328-15333, UDP 15328-15333) Virtual Server Make several servers that provide several same services, to provide service through policy by Virtual Server. (Take HTTP, POP3, SMTP, and DNS Group for example) 116 Ex3 Ex4 120 Preparation Apply for two ADSL that have static IP (WAN1 static IP is 61. 11. 11. 10~ 61. 11. 11. 14) (WAN2 static IP is 211. 22. 22. 18~ 211. 22. 22. 30) 121 Example Make a single server that provides several services such as FTP, Web, and Mail, to provide service by policy STEP 1Setting a server that provide several services in LAN, and set up the network card's IP as 192. 168. 1. 100. STEP 2Enter the following setting in LAN of Address function: (Figure10-1) Figure10-1 Mapped IP Settings of Server in Address STEP 3Enter the following data in Mapped IP of Virtual Server function: Click New Entry WAN IP: Enter 61. 11. 11. 12 (click Assist for assistance) Map to Virtual IP: Enter 192. 168. 1. 100 Click OK Complete the setting of adding new mapped IP (Figure10-2) Figure10-2 Mapped IP Setting WebUI 122 STEP 4Group the services (DNS, FTP, HTTP, POP3, SMTP. . . ) that provided and used by server in Service function. And add a new service group for server to send mails at the same time. (Figure10-3) Figure10-3 Service Setting STEP 5Add a policy that includes settings of STEP3, 4 in Incoming Policy. (Figure10-4) Figure10-4 Complete the Incoming Policy STEP 6Add a policy that includes STEP2, 4 in Outgoing Policy. It makes the server to send e-mail to external mail server by mail service. (Figure10-5) Figure10-5 Complete the Outgoing Policy 123 STEP 7Complete the setting of providing several services by mapped IP. (Figure10-6) Figure10-6 A Single Server that Provides Several Services by Mapped IP Strong suggests not to choose ANY when setting Mapped IP and choosing service. Otherwise the Mapped IP will be exposed to Internet easily and may be attacked by Hacker. 124 Make several servers that provide a single service, to provide service through policy by Virtual Server (Take Web service for example) STEP 1Setting several servers that provide Web service in LAN network, which IP Address is 192. 168. 1. 101, 192. 168. 1. 102, 192. 168. 1. 103, and 192. 168. 1. 104 125 STEP 2Enter the following data in Server 1 of Virtual Server function: Click the button next to Virtual Server Real IP ("click here to configure") in Server 1 Virtual Server Real IP: Enter 211. 22. 22. 23 (click Assist for assistance) Click OK (Figure10-7) Figure10-7 Virtual Server Real IP Setting Click New Entry Service: Select HTTP (80) External Service Port: Change to 8080 Load Balance Server1: Enter 192. 168. 1. 101 Load Balance Server2: Enter 192. 168. 1. 102 Load Balance Server3: Enter 192. 168. 1. 103 Load Balance Server4: Enter 192. 168. 1. 104 Click OK Complete the setting of Virtual Server (Figure10-8) Figure10-8 Virtual Server Configuration WebUI 126 STEP 3Add a new policy in Incoming Policy, which includes the virtual server, set by STEP2. [. . . ] DurationThe period of time starts from the first packet to the last packet to be recorded. Total TrafficThe SMC BR21VPN will record the sum of time and show the percentage of each WAN user's upstream / downstream to LAN service server. Reset CounterClick the Reset Counter button to refresh the Accounting Report. 234 Figure19-6 Inbound Destination IP Statistics Report 235 STEP 2Enter Inbound in Accounting Report and select Top Services to inquire the statistics website of Send/Receive packets, Downstream/Upstream, First packet/Last packet/Duration and the service from the WAN Server to pass the SMC BR21VPN. (Figure19-7) TOPSelect the data you want to view. [. . . ]