StoneGate Administrators Guide v5-2

STONEGATE 5.
ADMINISTRATOR’S GUIDE
F I R EWA L L
I N T R U S I ON P R EV E N T I O N S Y S T E M
MANAGEMENT CENTER
V IR TUAL PRIVATE NETWORKS
Legal Information
End-User License Agreement
The use of the products described in these materials is subject to the then current end-user license agreement, which can be found at
the Stonesoft website:
www.stonesoft.com/en/support/eula.html
Third Party Licenses

The StoneGate software includes several open source or third-party software packages. The appropriate software licensing information for
those products at the Stonesoft website:
www.stonesoft.com/en/support/third_party_licenses.html
U.S. Government Acquisitions

If Licensee is acquiring the Software, including accompanying documentation on behalf of the U.S. Government, the following provisions
apply. If the Software is supplied to the Department of Defense (“DoD”), the Software is subject to “Restricted Rights”, as that term is
defined in the DOD Supplement to the Federal Acquisition Regulations (“DFAR”) in paragraph 252.227-7013(c) (1). If the Software is
supplied to any unit or agency of the United States Government other than DOD, the Government’s rights in the Software will be as
defined in paragraph 52.227-19(c) (2) of the Federal Acquisition Regulations (“FAR”). Use, duplication, reproduction or disclosure by the
Government is subject to such restrictions or successor provisions.
Product Export Restrictions

The products described in this document are subject to export control under the laws of Finland and the European Council Regulation (EC)
N:o 1334/2000 of 22 June 2000 setting up a Community regime for the control of exports of dual-use items and technology (as
amended). Thus, the export of this Stonesoft software in any manner is restricted and requires a license by the relevant authorities.
General Terms and Conditions of Support and Maintenance Services

The support and maintenance services for the products described in these materials are provided pursuant to the general terms for
support and maintenance services and the related service description, which can be found at the Stonesoft website:
www.stonesoft.com/en/support/view_support_offering/terms/
Replacement Service
The instructions for replacement service can be found at the Stonesoft website:
www.stonesoft.com/en/support/view_support_offering/return_material_authorization/
Hardware Warranty
The appliances described in these materials have a limited hardware warranty. The terms of the hardware warranty can be found at the
Stonesoft website:
www.stonesoft.com/en/support/view_support_offering/warranty_service/
Trademarks and Patents

The products described in these materials are protected by one or more of the following European and US patents: European Patent Nos.
1065844, 1189410, 1231538, 1259028, 1271283, 1289183, 1289202, 1304849, 1313290, 1326393, 1379046, 1330095,
131711, 1317937 and 1443729 and US Patent Nos. 6,650,621; 6 856 621; 6,885,633; 6,912,200; 6,996,573; 7,099,284;
7,127,739; 7,130,266; 7,130,305; 7,146,421; 7,162,737; 7,234,166; 7,260,843; 7,280,540; 7,302,480; 7,386,525; 7,406,534;
7,461,401; 7,721,084; and 7,739,727 and may be protected by other EU, US, or other patents, or pending applications. Stonesoft, the
Stonesoft logo and StoneGate, are all trademarks or registered trademarks of Stonesoft Corporation. All other trademarks or registered
trademarks are property of their respective owners.
Disclaimer
Although every precaution has been taken to prepare these materials, THESE MATERIALS ARE PROVIDED "AS-IS" and Stonesoft makes
no warranty to the correctness of information and assumes no responsibility for errors, omissions, or resulting damages from the use of
the information contained herein. All IP addresses in these materials were chosen at random and are used for illustrative purposes only.
Copyright © 2010 Stonesoft Corporation. All rights reserved. All specifications are subject to change.
Revision: SGAG_20101027
2
TABLE OF CONTENTS
G ETTING S TARTED Other Changes in Firewall/VPN 5.2 . . . . . . . . . 31

64-Bit Software Version . . . . . . . . . . . . . . . . 31
CHAPTER 1 Aggregated Network Links . . . . . . . . . . . . . . 31
Using StoneGate Documentation . . . . . . . . . . . 21 Concurrent Connection Rate Limits . . . . . . . . 31
Objectives and Audience . . . . . . . . . . . . . . . . . 22 IPv6 Support on Single Firewalls . . . . . . . . . . 31
Typographical Conventions . . . . . . . . . . . . . . 22 IGMP Policy Routing . . . . . . . . . . . . . . . . . . . 31
Integrated DHCP Server on Clusters . . . . . . . 31
Documentation Available . . . . . . . . . . . . . . . . . 23
Rule Hit Counters for NAT Rules . . . . . . . . . . 31
Product Documentation. . . . . . . . . . . . . . . . . 23
Other Changes in IPS 5.2 . . . . . . . . . . . . . . . . 32
Support Documentation . . . . . . . . . . . . . . . . 24
64-Bit Software Version . . . . . . . . . . . . . . . . 32
System Requirements. . . . . . . . . . . . . . . . . . 24
DNS Protocol Enforcement . . . . . . . . . . . . . . 32
Contact Information . . . . . . . . . . . . . . . . . . . . 24
Fingerprint Improvements . . . . . . . . . . . . . . . 32
Licensing Issues . . . . . . . . . . . . . . . . . . . . . 24
Web Filtering . . . . . . . . . . . . . . . . . . . . . . . . 32
Technical Support . . . . . . . . . . . . . . . . . . . . . 24
Your Comments . . . . . . . . . . . . . . . . . . . . . . 24 Notes on Policy Editing Changes for Upgrading
Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Security Related Questions and Comments . . 25
Notes on New Rule Table Editing Logic . . . . . 33
Other Queries. . . . . . . . . . . . . . . . . . . . . . . . 25
Notes on Inspection Rule Changes . . . . . . . . 34
CHAPTER 2
What’s New? . . . . . . . . . . . . . . . . . . . . . . . . . . 27 CHAPTER 3
Using the Management Client . . . . . . . . . . . . . 35
Important Changes . . . . . . . . . . . . . . . . . . . . . 28
Overview to the Management Client . . . . . . . . 36
VPNs: End of Support for Legacy UDP
Rearranging the General Layout. . . . . . . . . . . . 40
Encapsulation . . . . . . . . . . . . . . . . . . . . . . 28
SMC: End of Support for Legacy VPN Bookmarking Views . . . . . . . . . . . . . . . . . . . . 41
Clients. . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Managing Bookmarks. . . . . . . . . . . . . . . . . . 41
Other Changes in SMC 5.2.2. . . . . . . . . . . . . . 28 Creating New Bookmarks . . . . . . . . . . . . . . . 42
Automatic Update Proxy Server Authentication 28 Creating New Bookmark Folders . . . . . . . . . . 43
Disable Connection Synchronization. . . . . . . . 28 Adding Bookmarks to the Toolbar . . . . . . . . . 43
Changing the Startup View . . . . . . . . . . . . . . . 44
Other Changes in SMC 5.2 . . . . . . . . . . . . . . . 29
Using the Search Features . . . . . . . . . . . . . . . 44
Color Selection for Comment Rules . . . . . . . . 29
Connections and Blacklist Snapshots . . . . . . 29 Using Basic Element Search . . . . . . . . . . . . . 44
Custom Backup Import for Demo Mode Searching for Element References. . . . . . . . . 46
Installations. . . . . . . . . . . . . . . . . . . . . . . . 29 Searching for Users . . . . . . . . . . . . . . . . . . . 46
Editing Logic Changes in the Policy Editor . . . . 29 Searching for Duplicate IP Addresses . . . . . . 47
Element Import Enhancements . . . . . . . . . . . 29 Using the DNS Search . . . . . . . . . . . . . . . . . 48
Inspection Rule Configuration Reworked. . . . . 29 Creating Host Elements Based on DNS
Integrated MIB Browsing Tool . . . . . . . . . . . . 29 Queries . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Log to Rule Links for Inspection and NAT Searching for Unused Elements . . . . . . . . . . 49
Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Using Type-Ahead Search . . . . . . . . . . . . . . . . 49
New Search Tools . . . . . . . . . . . . . . . . . . . . . 30 Saving as PDF or HTML . . . . . . . . . . . . . . . . . 50
OCSP Support . . . . . . . . . . . . . . . . . . . . . . . 30 PDF Output Settings. . . . . . . . . . . . . . . . . . . 50
Save and Browse Logs as Zip Archives. . . . . . 30
Adding Style Templates For PDF Output . . . . . 51
Simpler Alert Severity Scale . . . . . . . . . . . . . 30
Managing PDF Style Templates . . . . . . . . . . . 52
Statistics-Based Alerts . . . . . . . . . . . . . . . . . 30
Sending Messages to Other Administrators . . . 52
Third-Party Device Monitoring Improvements . . 30
VPN Troubleshooting Shortcuts . . . . . . . . . . . 30 Enabling/Disabling Administrator Messaging . 52
Table of Contents 3
Sending Messages to Other Administrators . . 53 Default Arrangement of System Status View . 85
Adding Custom Commands to Element Menus . 53 System Summary. . . . . . . . . . . . . . . . . . . . . 86
Creating a Tools Profile . . . . . . . . . . . . . . . . . 53 Viewing System Status for a Selected
Attaching a Tools Profile to an Element. . . . . . 54 Element . . . . . . . . . . . . . . . . . . . . . . . . . . 86
Info Panel . . . . . . . . . . . . . . . . . . . . . . . . . . 87
CHAPTER 4
Setting up the System . . . . . . . . . . . . . . . . . . . 55 Commands for Monitoring Components . . . . . 87
Monitoring Tools in the Main Menu . . . . . . . . 88
Getting Started with the Management Center . . 56
Reading Component Statuses. . . . . . . . . . . . 88
Getting Started with the Firewall . . . . . . . . . . . 56
Engine Hardware Malfunction Icons . . . . . . . . 89
Getting Started with the IPS . . . . . . . . . . . . . . 57
Replication Malfunction Icon . . . . . . . . . . . . . 89
CHAPTER 5
Element Status Colors . . . . . . . . . . . . . . . . . 89
Configuring System Communications . . . . . . . . 59
Node Status Colors . . . . . . . . . . . . . . . . . . . 90
Getting Started with System Communications. . 60 NetLink Status Colors . . . . . . . . . . . . . . . . . 90
Defining Locations . . . . . . . . . . . . . . . . . . . . . 61 VPN Status Colors . . . . . . . . . . . . . . . . . . . . 91
Defining Contact IP Addresses. . . . . . . . . . . . . 62 Connectivity Status Colors . . . . . . . . . . . . . . 91
Defining Engine Location . . . . . . . . . . . . . . . . 62 Creating Overviews. . . . . . . . . . . . . . . . . . . . . 92
Defining Contact Addresses for a Single Creating a New Overview . . . . . . . . . . . . . . . 93
Firewall or a Cluster Virtual IP Address . . . . . . 63
Adding a New System Summary Section to
Defining Contact Addresses for Node an Overview. . . . . . . . . . . . . . . . . . . . . . . . . 93
Dedicated IP Addresses . . . . . . . . . . . . . . . . 65
Adding a New Statistics Section to an
Defining Contact Addresses for an IPS Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
Engine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
Selecting Statistical Items . . . . . . . . . . . . . . 95
Defining Server Contact Addresses . . . . . . . . 67
Setting Thresholds for Monitored Items . . . . . 96
Defining a Contact Address for External
Security Gateway End-Point . . . . . . . . . . . . . . 68 Monitoring Open Connections and Blacklists . . 97
Selecting the Management Client Location . . . . 69 Checking Open Connections and Blacklists . . 97
Configuring Multi-Link System Communications. 70 Saving Blacklist and Connections Snapshots . 99
CHAPTER 6 Exporting Blacklist and Connections
Managing Elements . . . . . . . . . . . . . . . . . . . . . 71 Snapshots. . . . . . . . . . . . . . . . . . . . . . . . . . 100
Opening Blacklist and Connections
Using Categories . . . . . . . . . . . . . . . . . . . . . . 72 Snapshots. . . . . . . . . . . . . . . . . . . . . . . . . . 100
Configuration Overview . . . . . . . . . . . . . . . . . 72 Comparing Blacklist and Connections
Creating New Categories . . . . . . . . . . . . . . . . 72 Snapshots. . . . . . . . . . . . . . . . . . . . . . . . . . 101
Selecting Categories for Elements . . . . . . . . . 73 Monitoring Connections on a Map . . . . . . . . . . 103
Activating Categories . . . . . . . . . . . . . . . . . . 73 Defining a New Geolocation . . . . . . . . . . . . . 104
Filtering With Several Categories . . . . . . . . . . 74 Setting a Geolocation for an Element in the
System Status View . . . . . . . . . . . . . . . . . . . 105
Importing, Exporting and Restoring Elements . . 75
Monitoring Configurations and Policies . . . . . . 105
Exporting Elements. . . . . . . . . . . . . . . . . . . . 75
Monitoring Administrator Actions . . . . . . . . . . . 105
Importing Elements . . . . . . . . . . . . . . . . . . . 76
Monitoring Task Execution . . . . . . . . . . . . . . . 106
Restoring Elements from Policy Snapshots . . . . 78
Checking Maintenance Contract Information . . 107
Locking and Unlocking Elements . . . . . . . . . . . 79
Enabling Automatic Maintenance Contract
Deleting Elements . . . . . . . . . . . . . . . . . . . . . 79 Checking . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Viewing Maintenance Contract Information. . . 107
M ONITORING Viewing Maintenance Contract Information for
SOHO Firewalls . . . . . . . . . . . . . . . . . . . . . . 108
CHAPTER 7 Fetching Maintenance Contract Information . . 108
Monitoring the System. . . . . . . . . . . . . . . . . . . 83
Checking When Internal Certificates or Internal
Getting Started with System Monitoring . . . . . . 84 CAs Expire . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
Monitoring the System Status . . . . . . . . . . . . . 84
4 Table of Contents
CHAPTER 8 Changing the Time Zone for Log Browsing . . . 139
Monitoring Third-Party Devices . . . . . . . . . . . . 111 Changing Data Columns in the Log Entry
Getting Started with Third-Party Device Table. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139
Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 Resolving Log Details to DNS Names or
Configuration Overview . . . . . . . . . . . . . . . . . 112 StoneGate Elements . . . . . . . . . . . . . . . . . . 140
Receiving Logs From External Devices . . . . . . . 113 Deactivating/Activating Log Entry Highlighting 141
Creating a Logging Profile Element . . . . . . . . . 114 Exporting Data from the Logs View . . . . . . . . . 141
Defining Ordered Field Logging Patterns . . . . . 115 Exporting Extracts of Log Data . . . . . . . . . . . 141
Defining Key-Value Pair Logging Patterns . . . . 116 Exporting IPS Traffic Recordings . . . . . . . . . . 142
Defining Field Resolvers . . . . . . . . . . . . . . . . 117 Attaching Logs to Incident Cases . . . . . . . . . 143
Defining a Field Resolver for Multiple Creating Rules From Logs . . . . . . . . . . . . . . . . 143
Values . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 CHAPTER 10
Defining a Field Resolver for Date and Reports. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
Getting Started with Reports. . . . . . . . . . . . . . 146
Validating a Logging Profile . . . . . . . . . . . . . . 118
Configuration Overview . . . . . . . . . . . . . . . . . 147
Monitoring the Status of Third-Party Devices . . . 119
Creating and Editing Report Designs . . . . . . . . 148
Importing MIBs. . . . . . . . . . . . . . . . . . . . . . . 120
Creating a New Report Design . . . . . . . . . . . 148
Creating a Probing Profile . . . . . . . . . . . . . . . 121
Adding Sections to a Report Design . . . . . . . 150
Activating Monitoring of a Third-Party Device . . . 123
Adding Items to a Report Section . . . . . . . . . 151
Configuring a Third-Party Device for Monitoring . 124
Generating and Viewing Reports . . . . . . . . . . . 151
Changing the Ports for Third-Party Device
Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 Generating a Report . . . . . . . . . . . . . . . . . . . 152
Activating/Deactivating Third-Party Status Defining the Report Task . . . . . . . . . . . . . . 153
Monitoring Alerts . . . . . . . . . . . . . . . . . . . . . . 125 Selecting Data Sources . . . . . . . . . . . . . . . 154
CHAPTER 9 Cancelling Ongoing Report Tasks . . . . . . . . . 155
Browsing Logged Data . . . . . . . . . . . . . . . . . . . 127 Viewing Reports. . . . . . . . . . . . . . . . . . . . . . 155
Getting Started with the Logs View. . . . . . . . . . 128 Exporting Reports . . . . . . . . . . . . . . . . . . . . . 156
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 Exporting a Report as Tab-delimited Text File . 156
Opening the Logs View . . . . . . . . . . . . . . . . . 128 Exporting a Report as a PDF File . . . . . . . . . . 156
Default (Records) Arrangement, Panels, and Printing a Generated Report to PDF . . . . . . . 156
Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 E-Mailing Reports. . . . . . . . . . . . . . . . . . . . . 157
Details Arrangement . . . . . . . . . . . . . . . . . . . 131 Creating a System Audit Report. . . . . . . . . . . . 157
Statistics Arrangement . . . . . . . . . . . . . . . . . 132
CHAPTER 11
Browsing Log Data . . . . . . . . . . . . . . . . . . . . . 133 Filtering Data . . . . . . . . . . . . . . . . . . . . . . . . . 159
Viewing Log Entry Details in the Side Panel . . 133 Getting Started with Filtering Data . . . . . . . . . . 160
Filtering Logs in the Logs View. . . . . . . . . . . . 134 Defining Filter Elements . . . . . . . . . . . . . . . . . 160
Specifying Filters for a Query . . . . . . . . . . . . 134 Basics of Constructing Data Filters . . . . . . . . 161
Viewing Logs From Specific Components . . . 136
Creating a Filter Element . . . . . . . . . . . . . . . 162
Viewing Logs From Specific Servers and
Archive Folders. . . . . . . . . . . . . . . . . . . . . . 136 Adding and Modifying Filtering Criteria in
Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163
Browsing Log Entries on a Timeline . . . . . . . . 137
Removing Filtering Criteria from Filters. . . . . . 164
Viewing Temporary Log Entries. . . . . . . . . . . . 137
Organizing Filter Elements . . . . . . . . . . . . . . . 164
Sorting Log Entries . . . . . . . . . . . . . . . . . . . . 138
Creating New Filter Tags . . . . . . . . . . . . . . . . 164
Checking WHOIS Records for IP Addresses in
Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138 Changing the Tag of a Filter. . . . . . . . . . . . . . 165
Changing How Data Entries Are Displayed . . . . 139 Applying Filters . . . . . . . . . . . . . . . . . . . . . . . 165
Increasing and Decreasing Text Size in Data
Entries. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139
Table of Contents 5
CHAPTER 12 C ONTROLLING E NGINES
Diagrams . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167
Getting Started with Diagrams . . . . . . . . . . . . . 168 CHAPTER 14
Configuration Overview . . . . . . . . . . . . . . . . . 168 Controlling Engine Operation. . . . . . . . . . . . . . 189
Creating Diagrams . . . . . . . . . . . . . . . . . . . . . 169 Commanding Engines Remotely . . . . . . . . . . . 190
Defining the Diagram Background . . . . . . . . . . 169 Turning Engines Online . . . . . . . . . . . . . . . . . 190
Adding Elements to Diagrams . . . . . . . . . . . . . 170 Turning Engines Offline . . . . . . . . . . . . . . . . . 191
Inserting New Elements Manually . . . . . . . . . 171 Setting Nodes to Standby . . . . . . . . . . . . . . . 191
Creating Diagrams from Configured Elements . 171 Rebooting Nodes . . . . . . . . . . . . . . . . . . . . . 191
Adding Text Comments to a Diagram . . . . . . . 172 Refreshing the Currently Installed Policy . . . . 192
Arranging Elements in Diagrams . . . . . . . . . . . 172 Commanding Engines Locally . . . . . . . . . . . . . 192
Connecting Elements in Diagrams . . . . . . . . . . 173 Setting Engine Options . . . . . . . . . . . . . . . . . . 192
Connecting Elements Automatically . . . . . . . . 173 Enabling/Disabling Engine Status Monitoring . 192
Connecting Elements Manually . . . . . . . . . . . 173 Enabling/Disabling Firewall/VPN Diagnostics . 193
Creating Links Between Diagrams . . . . . . . . . . 174 Disabling/Enabling User Database Replication 193
Specifying a Parent Diagram . . . . . . . . . . . . . 174 Enabling/Disabling Status Surveillance . . . . . 193
Creating Links from One Diagram to Another. . 174 Enabling/Disabling SSH Access to the Engine 194
Viewing Diagrams . . . . . . . . . . . . . . . . . . . . . . 175 Changing the Engine Password . . . . . . . . . . . 194
Adjusting the Element Details in Diagrams . . . 175 Changing NetLink State Manually . . . . . . . . . . 195
Collapsing and Expanding Groups of Elements Disabling/Enabling Cluster Nodes . . . . . . . . . . 195
in Diagrams . . . . . . . . . . . . . . . . . . . . . . . . . 175 Disabling Nodes of a Cluster Temporarily . . . . 195
Zooming and Navigating Diagrams . . . . . . . . . 176 Re-Enabling Disabled Cluster Nodes . . . . . . . 196
Printing Diagrams . . . . . . . . . . . . . . . . . . . . . . 176 Editing Engine Configurations . . . . . . . . . . . . . 196
Exporting Diagrams as Images . . . . . . . . . . . . 176 CHAPTER 15
CHAPTER 13 Stopping Traffic Manually . . . . . . . . . . . . . . . . 197
Incident Cases . . . . . . . . . . . . . . . . . . . . . . . . . 177
Terminating Connections Manually. . . . . . . . . . 198
Getting Started with Incident Cases . . . . . . . . . 178 Blacklisting Connections Manually. . . . . . . . . . 198
Configuration Overview . . . . . . . . . . . . . . . . . 178 CHAPTER 16
Creating a New Incident Case . . . . . . . . . . . . . 179 Working on the Engine Command Line. . . . . . . 201
Setting an Incident Context . . . . . . . . . . . . . . . 179 Getting Started with the Engine Command Line 202
Attaching Data to Incident Cases . . . . . . . . . . . 180 Accessing the Engine Command Line . . . . . . . 202
Attaching Logs and Audit Entries to Incident Reconfiguring Basic Engine Settings . . . . . . . . 203
Cases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180
Creating Engine Scripts . . . . . . . . . . . . . . . . . 204
Attaching Policy Snapshots to Incident Cases . 181
Restoring a Previous Configuration Manually . . 205
Attaching Memos to Incident Cases . . . . . . . . 182
Attaching Files to Incident Cases . . . . . . . . . . 182 M ANAGEMENT C ENTER C ONFIGURATION
Adding Players to Incident Cases . . . . . . . . . . . 183
Adding Journal Entries to Incident Cases . . . . . 183 CHAPTER 17
Working With Existing Incident Cases . . . . . . . . 184 Automatic Updates and Engine Upgrades . . . . . 209
Opening an Incident Case for Editing . . . . . . . 184 Getting Started with Automatic Updates and
Changing the Priority of an Incident Case . . . . 184 Engine Upgrades . . . . . . . . . . . . . . . . . . . . . . 210
Changing the State of an Incident Case . . . . . 185 Configuring Automatic Updates and Engine
Upgrades . . . . . . . . . . . . . . . . . . . . . . . . . . . 210
Checking Incident History . . . . . . . . . . . . . . . 185
6 Table of Contents
CHAPTER 18 Testing Alerts. . . . . . . . . . . . . . . . . . . . . . . . . 244
Administrator Accounts . . . . . . . . . . . . . . . . . . 213
CHAPTER 20
Getting Started with Administrator Accounts . . . 214 Domains . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245
Configuration Overview. . . . . . . . . . . . . . . . . 214 Getting Started with Domains . . . . . . . . . . . . . 246
Defining Administrator Roles and Access Control Configuration Overview . . . . . . . . . . . . . . . . . 246
Lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215
Creating Domains . . . . . . . . . . . . . . . . . . . . . 247
Defining Administrator Roles . . . . . . . . . . . . . 215
Defining a Domain Logo . . . . . . . . . . . . . . . . 248
Defining Access Control Lists . . . . . . . . . . . . 217
Logging in to a Domain . . . . . . . . . . . . . . . . . . 249
Defining Administrator Accounts . . . . . . . . . . . 218
Logging out of a Domain. . . . . . . . . . . . . . . . . 250
Creating a New Administrator Element . . . . . . 218
Deleting Domains . . . . . . . . . . . . . . . . . . . . . 250
Defining Administrator Permissions . . . . . . . . 219
Moving Elements Between Domains . . . . . . . . 250
Defining Rights for Restricted Administrator
Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . 220 Using the Domain Overview . . . . . . . . . . . . . . 252
Restricting the Logs an Administrator Can CHAPTER 21
View . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222 Setting up the Web Portal . . . . . . . . . . . . . . . . 255
Customizing Log Colors. . . . . . . . . . . . . . . . . . 222 Getting Started with Web Portal Access . . . . . . 256
Defining Password and Login Settings for Configuration Overview . . . . . . . . . . . . . . . . . 256
Administrators . . . . . . . . . . . . . . . . . . . . . . . . 223
Defining Web Portal Server Settings . . . . . . . . 257
Enabling Enforcement of Password Settings . . 224
Activating HTTPS on the Web Portal Server. . . . 258
Defining Password Policy Settings . . . . . . . . . 225
Allowing Web Portal Connections. . . . . . . . . . . 259
Changing Administrator Passwords . . . . . . . . . 226
Defining Web Portal User Accounts . . . . . . . . . 260
Authenticating Administrators Using RADIUS. . . 226
Granting Engines to a Web Portal User . . . . . 261
Deleting Administrator Accounts . . . . . . . . . . . 227
Selecting Policy Permissions for a Web Portal
CHAPTER 19 User . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262
Alert Escalation . . . . . . . . . . . . . . . . . . . . . . . . 229
Selecting Log Browsing Permissions for a
Getting Started with Alert Escalation . . . . . . . . 230 Web Portal User. . . . . . . . . . . . . . . . . . . . . . 263
Configuration Overview . . . . . . . . . . . . . . . . . 230 Selecting Report Data Permissions for a Web
Portal User . . . . . . . . . . . . . . . . . . . . . . . . . 264
Creating Alerts . . . . . . . . . . . . . . . . . . . . . . . . 231
Customizing the Web Portal . . . . . . . . . . . . . . 264
Defining Custom Alerts . . . . . . . . . . . . . . . . . 231
Adding a New Web Portal Language. . . . . . . . 264
Defining What Triggers an Alert . . . . . . . . . . . 232
Importing a Web Portal Language File
Defining Alert Chains . . . . . . . . . . . . . . . . . . . 233 through the Management Client . . . . . . . . . 264
Defining Alert Channels. . . . . . . . . . . . . . . . . 233 Importing a Web Portal Language File
Creating New Alert Chains. . . . . . . . . . . . . . . 234 on the Command Line . . . . . . . . . . . . . . . . 265
Modifying Existing Alert Chains . . . . . . . . . . . 235 Enabling/Disabling a Web Portal Localization . 265
Editing Alert Chains . . . . . . . . . . . . . . . . . . . 235 Customizing the Look of the Web Portal. . . . . 266
Defining the Final Action of an Alert Chain . . . 237 Writing Announcements to Web Portal Users . . 266
Defining Alert Policies . . . . . . . . . . . . . . . . . . . 238 CHAPTER 22
Distributing Management Clients Through Web
Creating New Alert Policies . . . . . . . . . . . . . . 238 Start . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269
Modifying Existing Alert Policies . . . . . . . . . . . 239
Getting Started with Web Start Distribution . . . 270
Editing Alert Policy Rules . . . . . . . . . . . . . . . . 239
Installing Alert Policies . . . . . . . . . . . . . . . . . . 240
Activating Web Start on Management Server . . 271
Acknowledging Alerts . . . . . . . . . . . . . . . . . . . 240
Distributing Web Start from External Servers . . 272
Acknowledging Individual Alerts . . . . . . . . . . . 241
Accessing the Web Start Clients . . . . . . . . . . . 273
Acknowledging All Active Alerts . . . . . . . . . . . 241
Using Custom Scripts for Alert Escalation. . . . . 242
Setting up a Dedicated Alert Server . . . . . . . . . 243
Table of Contents 7
CHAPTER 23 Changing the Management Platform . . . . . . . . 304
Log Server Configuration . . . . . . . . . . . . . . . . . 275 Changing IP Addressing . . . . . . . . . . . . . . . . . 304
Defining a Log Server . . . . . . . . . . . . . . . . . . . 276 Changing the Management Server’s IP
Defining a Log Server Element. . . . . . . . . . . . 276 Address . . . . . . . . . . . . . . . . . . . . . . . . . . . 304
Selecting Secondary Log Servers. . . . . . . . . . 277 Changing the Log Server’s IP Address . . . . . . 305
Certifying the Log Server . . . . . . . . . . . . . . . . 278 Changing IP Addresses of Combined
Management/Log Servers . . . . . . . . . . . . . . 306
Configuring an Alert Server . . . . . . . . . . . . . . 278
If Configuration Changes Prevent Managing the
Changing Log Server Configuration Parameters . 279 Engines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307
Exporting Log Data to Syslog . . . . . . . . . . . . . . 282
Defining General Syslog Settings . . . . . . . . . . 282 E NGINE E LEMENT C ONFIGURATION
Exporting Log Filters for Syslog Sending . . . . . 284
Configuring Syslog Filter Settings. . . . . . . . . . 285 CHAPTER 26
Creating a Rule Allowing Traffic to the Creating and Modifying Engine Elements . . . . . 311
Syslog Server . . . . . . . . . . . . . . . . . . . . . . . . 285 Getting Started with Engine Elements . . . . . . . 312
CHAPTER 24 Configuration Overview . . . . . . . . . . . . . . . . 312
Secondary SMC Server Configuration . . . . . . . . 287
Creating New Engine Elements . . . . . . . . . . . . 313
About Secondary SMC Servers . . . . . . . . . . . . 288
Creating a New Single Firewall Element . . . . . 313
Installing a Secondary Management Server . . . 288
Creating a New Firewall Cluster Element . . . . 314
Creating One New SOHO Firewall Element . . . 315
Defining a Secondary Management Server Creating Multiple New SOHO Firewall Elements 316
Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289
Creating a New Analyzer Element . . . . . . . . . 318
Installing a License for a Secondary
Management Server . . . . . . . . . . . . . . . . . . . 290 Creating a New Single Sensor Element . . . . . 319
Creating Access Rules for a Secondary Creating a New Sensor Cluster Element. . . . . 320
Management Server . . . . . . . . . . . . . . . . . . . 291 Creating a New Combined Sensor-Analyzer
Installing Secondary Management Server Element . . . . . . . . . . . . . . . . . . . . . . . . . . . 321
Software . . . . . . . . . . . . . . . . . . . . . . . . . . . 291 Creating a New SSL VPN Gateway Element . . 322
Installing a Secondary Log Server . . . . . . . . . . 293 Duplicating an Existing Engine Element . . . . . 323
Configuration Overview . . . . . . . . . . . . . . . . . 293 Modifying Existing Engine Elements . . . . . . . . . 323
Creating a Secondary Log Server Element . . . 293 Modifying the Properties of One Engine
Installing a License for a Secondary Log Element . . . . . . . . . . . . . . . . . . . . . . . . . . . 324
Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295 Modifying Properties of Several Engines at
Setting a Log Server as a Secondary Log Once. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 324
Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295 Converting a Single Firewall to a Firewall
Creating Access Rules for a Secondary Log Cluster . . . . . . . . . . . . . . . . . . . . . . . . . . . . 325
Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 296 Preparing for Conversion to a Firewall
Installing Secondary Log Server Software . . . . 296 Cluster . . . . . . . . . . . . . . . . . . . . . . . . . . . 326
Converting a Single Firewall Element to
Changing the Active Management Server . . . . . 297 a Firewall Cluster . . . . . . . . . . . . . . . . . . . . 326
Disabling and Enabling Automatic Database Activating the Clustered Configuration After
Replication. . . . . . . . . . . . . . . . . . . . . . . . . . . 298 Conversion . . . . . . . . . . . . . . . . . . . . . . . . 329
Synchronizing Management Databases Converting a Single Sensor to a Sensor
Manually . . . . . . . . . . . . . . . . . . . . . . . . . . . . 298 Cluster . . . . . . . . . . . . . . . . . . . . . . . . . . . . 329
Restoring a Backup Taken from a Different Adding a Node to a Firewall or Sensor
Management Server . . . . . . . . . . . . . . . . . . . . 299 Cluster . . . . . . . . . . . . . . . . . . . . . . . . . . . . 330
CHAPTER 25 Changing an Engine’s Control IP Address . . . . 331
Reconfiguring the Management Center . . . . . . . 301
Changing an Engine’s Control Address . . . . 331
Modifying a Management Server Element . . . . . 302 Changing a Firewall’s Control Address to
Changing the Management Database Password 303 a Different Network . . . . . . . . . . . . . . . . . . 332
Editing Single Firewall Properties. . . . . . . . . . . 333
8 Table of Contents
Editing Firewall Cluster Properties . . . . . . . . . . 334 Defining Wireless Settings for SOHO Firewalls 373
Editing SOHO Firewall Properties . . . . . . . . . . . 335 Defining Wireless Security Settings for
Editing Analyzer Properties . . . . . . . . . . . . . . . 336 SOHO Firewalls . . . . . . . . . . . . . . . . . . . . . 374
Defining Wireless Channel Settings for
Editing Single Sensor Properties . . . . . . . . . . . 337 SOHO Firewalls . . . . . . . . . . . . . . . . . . . . . 375
Editing Sensor Cluster Properties . . . . . . . . . . 338 Completing the SOHO Firewall Configuration . 376
Editing Combined Sensor-Analyzer Properties . . 339 Completing the “Create Multiple SOHO
About Engine Time Synchronization . . . . . . . . . 340 Firewalls” Wizard . . . . . . . . . . . . . . . . . . . . . 376
CHAPTER 27 Sensor and Analyzer Interface Configuration. . . 377
Network Interface Configuration . . . . . . . . . . . 341 Defining System Communication Interfaces for
Getting Started with Interface Configuration . . . 342 IPS Engines . . . . . . . . . . . . . . . . . . . . . . . . . 378
Configuration Overview . . . . . . . . . . . . . . . . . 342 Defining Traffic Inspection Interfaces for
Sensors . . . . . . . . . . . . . . . . . . . . . . . . . . . 379
Firewall Interface Configuration . . . . . . . . . . . . 343 Defining Logical Interfaces for Sensors . . . . 380
Defining Physical Interfaces for Firewall Defining Reset Interfaces for Sensors . . . . . 381
Engines . . . . . . . . . . . . . . . . . . . . . . . . . . . . 344
Defining Capture Interfaces for Sensors . . . 381
Adding VLAN Interfaces for Firewall Engines . . 346 Defining Inline Interfaces for Sensors . . . . . 383
Adding ADSL Interfaces for Single Firewalls . . 348 Adding VLAN Interfaces for Sensors . . . . . . 384
Configuring Advanced Interface Properties for Setting Interface Options for IPS Engines. . . . 385
Firewalls . . . . . . . . . . . . . . . . . . . . . . . . . . . 349
Configuring Manual ARP Settings . . . . . . . . . . 387
Configuring Single Firewall IP Addresses. . . . . 351
Activating the Internal DHCP Server on a Firewall
Adding an IPv4 Address for a Single Firewall . . 352 Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . 388
Configuring VRRP Settings for Single Firewalls 353 CHAPTER 28
Configuring PPPoE Settings for Single Firewalls 354 Connecting Engines to the StoneGate Management
Adding an IPv6 Address for a Single Firewall . . 355 Center . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 391
Configuring Firewall Cluster IP Addresses . . . . 356 Getting Started with Connecting Engines to the
SMC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 392
Adding IPv4 Addresses for a Firewall Cluster. . 357
Configuration Overview . . . . . . . . . . . . . . . . 392
Defining Modem Interfaces for Single Firewalls 358
Changing/Removing the PIN Code of a Saving an Initial Configuration for Firewall or IPS
Modem Interface . . . . . . . . . . . . . . . . . . . . . 360 Engines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 393
Setting Firewall Interface Options. . . . . . . . . . 361 Creating One-Time Passwords . . . . . . . . . . . . 393
About Using a Dynamic IP Address on a Saving Initial Configuration Details . . . . . . . . 394
Firewall Interface . . . . . . . . . . . . . . . . . . . . . 362 Saving an Initial Configuration for SOHO Firewall
Changing ISP Settings for ADSL Interface . . . . 363 Engines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 395
SOHO Firewall Interface Configuration . . . . . . . 364 Connecting SSL VPN Gateways to the SMC . . . 396
Selecting SOHO Firewall Interface Types . . . . . 364 CHAPTER 29
Configuring the Engine Tester . . . . . . . . . . . . . 397
Defining External Interfaces for SOHO
Firewalls . . . . . . . . . . . . . . . . . . . . . . . . . . . 366 Getting Started with the Engine Tester . . . . . . . 398
Defining Ethernet External Interface Configuration Overview . . . . . . . . . . . . . . . . . 398
Properties on SOHO Firewalls . . . . . . . . . . . 366
Specifying Global Engine Tester Settings . . . . . 399
Defining ADSL or PPPoE Interface
Properties on SOHO Firewalls . . . . . . . . . . . 367 Adding Engine Tests . . . . . . . . . . . . . . . . . . . . 400
Defining Advanced ADSL Settings for Configuring Additional Test-Specific Settings . 402
SOHO Firewalls . . . . . . . . . . . . . . . . . . . . . 368 Additional Settings for the External Test . . . 402
Defining Corporate Interfaces for SOHO Additional Settings for the File System
Firewalls . . . . . . . . . . . . . . . . . . . . . . . . . . . 370 Space Test . . . . . . . . . . . . . . . . . . . . . . . . 403
Defining Guest Interfaces for SOHO Firewalls . 372 Additional Settings for the Free Swap
Space Test . . . . . . . . . . . . . . . . . . . . . . . . 403
Additional Settings for the Link Status
Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 403
Additional Settings for the Multiping Test. . . 404
Table of Contents 9
Checking Configured Tests . . . . . . . . . . . . . . . 404 R OUTING
Removing Engine Tests . . . . . . . . . . . . . . . . . . 405
Disabling/Enabling Configured Engine Tests . . . 406 CHAPTER 34
Disabling/Enabling Individual Engine Tests . . . 406 Configuring Routing . . . . . . . . . . . . . . . . . . . . 439
Disabling/Enabling All Custom Engine Tests . . 406 Getting Started with Routing . . . . . . . . . . . . . . 440
CHAPTER 30 Configuration Overview . . . . . . . . . . . . . . . . . 440
Engine Permissions . . . . . . . . . . . . . . . . . . . . . 407 Adding Routes for Firewalls . . . . . . . . . . . . . . . 441
Getting Started with Engine Permissions . . . . . 408 Defining a Single-Link Route for a Firewall . . . 441
Configuration Overview . . . . . . . . . . . . . . . . . 408 Defining a Multi-Link Route for a Firewall . . . . 442
Defining an Engine’s Administrator Permissions 408 Creating NetLinks . . . . . . . . . . . . . . . . . . . 443
Selecting Permitted Policies for an Engine . . . . 409 Adding a Multi-Link Route . . . . . . . . . . . . . . 444
CHAPTER 31 Routing DHCP Messages . . . . . . . . . . . . . . . 445
Alias Translations for Engines . . . . . . . . . . . . . 411 Defining a DHCP Server . . . . . . . . . . . . . . . 446
Getting Started with Alias Translations . . . . . . . 412 Enabling DHCP Relay . . . . . . . . . . . . . . . . . 447
Defining Alias Translation Values . . . . . . . . . . . 412 Activating the DHCP Relay Sub-policy. . . . . . 447
Adding Alias Translation Values . . . . . . . . . . . 413 Routing Multicast Traffic . . . . . . . . . . . . . . . . 447
Removing Alias Translation Values . . . . . . . . . 413 Defining Static Multicast . . . . . . . . . . . . . . 448
Defining IGMP-Based Multicast Forwarding. . 449
CHAPTER 32
Advanced Engine Settings . . . . . . . . . . . . . . . . 415 Defining Policy Routing . . . . . . . . . . . . . . . . . 451
Adding Routes for IPS Components . . . . . . . . . 453
Getting Started with Advanced Engine Settings . 416
Removing Routes . . . . . . . . . . . . . . . . . . . . . . 454
Adjusting Firewall System Parameters . . . . . . . 416
Modifying Antispoofing for Firewalls . . . . . . . . . 454
Adjusting Firewall Traffic Handling Parameters. . 418
Deactivating Antispoofing for an IP Address/
Adjusting Firewall Clustering Options . . . . . . . . 419 Interface Pair . . . . . . . . . . . . . . . . . . . . . . . . 455
Adjusting General Clustering Options . . . . . . . 419 Activating Antispoofing for Routable IP
Tuning the Firewall Load Balancing Filter. . . . . 421 Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . 456
Manually Tuning the Load Balancing Filter . . 421 Checking Routes . . . . . . . . . . . . . . . . . . . . . . 456
Adding Load Balancing Filter Entries . . . . . . 422 CHAPTER 35
Adjusting Single Firewall’s Contact Policy . . . . . 423 Outbound Traffic Management . . . . . . . . . . . . 459
Configuring Anti-Virus Settings . . . . . . . . . . . . . 424 Getting Started with Outbound Traffic
Configuring Default SYN Flood Protection for a Management . . . . . . . . . . . . . . . . . . . . . . . . . 460
Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 425 Configuration Overview . . . . . . . . . . . . . . . . . 461
Configuring Log Handling Settings . . . . . . . . . . 426 Configuring Outbound Multi-Link Settings . . . . . 461
Adjusting Sensor-Analyzer Advanced Settings . . 427 Creating an Outbound Multi-Link Element. . . . 462
Adjusting Analyzer Advanced Settings. . . . . . . . 427 Selecting NetLinks for an Outbound Multi-Link 463
Adjusting Sensor Advanced Settings . . . . . . . . 428 Defining Destination Cache Settings . . . . . . . 464
Adjusting Sensor Clustering Options . . . . . . . 429 Creating Outbound Load Balancing NAT Rules . 465
Adjusting SOHO Firewall Management Monitoring And Testing Outbound Traffic
Connection. . . . . . . . . . . . . . . . . . . . . . . . . . . 430 Management . . . . . . . . . . . . . . . . . . . . . . . . . 466
CHAPTER 33 CHAPTER 36
Setting up SNMP for Engines. . . . . . . . . . . . . . 431 Inbound Traffic Management. . . . . . . . . . . . . . 467
Getting Started with SNMP Configuration . . . . . 432 Getting Started with Inbound Traffic
Configuring SNMP Version 1 or 2c . . . . . . . . . . 432 Management . . . . . . . . . . . . . . . . . . . . . . . . . 468
Configuring SNMP Version 3 . . . . . . . . . . . . . . 433 Configuration Overview . . . . . . . . . . . . . . . . . 469
Configuring What Triggers SNMP Traps . . . . . . . 434 Defining a Server Pool . . . . . . . . . . . . . . . . . . 469
Activating the SNMP Agent on Engines . . . . . . . 435 Creating a New Server Pool Element . . . . . . . 469
Defining Server Pools’ External Address(es) . . 470
10 Table of Contents
Adding Server Pool Members. . . . . . . . . . . . . 471 Moving the Policy Under a Different Template . . 506
Installing Monitoring Agents . . . . . . . . . . . . . . 472 Deleting Policies, Templates, and Sub-Policies . 507
Uninstalling Monitoring Agents. . . . . . . . . . . . . 473 CHAPTER 38
Configuring Monitoring Agents . . . . . . . . . . . . . 474 Editing Policies . . . . . . . . . . . . . . . . . . . . . . . . 509
Editing sgagent.local.conf . . . . . . . . . . . . . . . 474 Getting Started with Editing the Rules in
Editing sgagent.conf . . . . . . . . . . . . . . . . . . . 475 Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 510
Editing the sgagent.conf Statement Section . 476 Using the Policy Editing View. . . . . . . . . . . . . . 511
Options in the sgagent.conf Statement Editing Rule Tables. . . . . . . . . . . . . . . . . . . . 512
Section . . . . . . . . . . . . . . . . . . . . . . . . . . . 477 Editing Rule Cells. . . . . . . . . . . . . . . . . . . . . 512
Monitoring Agent Statement Configuration Adding Comments in Policies . . . . . . . . . . . . 513
Examples. . . . . . . . . . . . . . . . . . . . . . . . . . 478 Reading Rule Identifiers . . . . . . . . . . . . . . . . 513
Editing the sgagent.conf Test Section . . . . . 480
Searching in Rules . . . . . . . . . . . . . . . . . . . . 514
Monitoring Agent Test Configuration
Examples. . . . . . . . . . . . . . . . . . . . . . . . . . 482 Finding Unused Rules in Firewall Policies (Hit
Counters) . . . . . . . . . . . . . . . . . . . . . . . . . . 515
Editing Monitoring Agents’ Internal Tests . . . 483
Monitoring Agent Internal Test Examples . . . 485 Adding Insert Points in Policy Templates . . . . . 516
Enabling Monitoring Agents . . . . . . . . . . . . . . . 488 Editing Ethernet Rules . . . . . . . . . . . . . . . . . . 516
Entering the Server Pool’s IP Addresses on Your Defining Logging Options for Ethernet Rules. . 517
DNS Server . . . . . . . . . . . . . . . . . . . . . . . . . . 488 Defining a MAC Address for Ethernet Rules . . 518
Creating Access Rules for Inbound Load Editing Access Rules . . . . . . . . . . . . . . . . . . . 518
Balancing. . . . . . . . . . . . . . . . . . . . . . . . . . . . 489 Defining What Traffic an Access Rule
Configuring Dynamic DNS Updates. . . . . . . . . . 490 Matches . . . . . . . . . . . . . . . . . . . . . . . . . . . 519
Configuration Overview . . . . . . . . . . . . . . . . . 490 Defining What Action an Access Rule Takes . . 521
Improving DDNS Security. . . . . . . . . . . . . . . . 490 Defining Access Rule Action Options . . . . . . . 522
Defining an External DNS Server . . . . . . . . . . 491 Defining “Apply Blacklist” Action Options . . . 522
Defining the Dynamic DNS Update Information 492 Defining “Jump” Action Options . . . . . . . . . 522
Defining a Dynamic DNS Rule . . . . . . . . . . . . 493 Defining Firewall “Allow” Action Options. . . . 523
Defining Firewall “Continue” Action Options
Monitoring and Testing Monitoring Agents. . . . . 493 in Access Rules . . . . . . . . . . . . . . . . . . . . . 526
Defining Firewall “Use VPN” Action
T RAFFIC I NSPECTION P OLICIES Options . . . . . . . . . . . . . . . . . . . . . . . . . . . 526
Defining IPS “Allow” Action Options. . . . . . . 527
CHAPTER 37 Defining IPS “Continue” Action Options in
Creating and Managing Policy Elements . . . . . . 497 Access Rules. . . . . . . . . . . . . . . . . . . . . . . 527
Getting Started with Policies . . . . . . . . . . . . . . 498 Defining IPS “Discard” Action Options . . . . . 528
Defining IPS “Refuse” Action Options . . . . . 528
Defining Access Rule Logging Options . . . . . . 528
Creating a New Template Policy or a Policy . . . . 499
Defining Access Rule Authentication Options . 530
Creating a New Sub-Policy . . . . . . . . . . . . . . . . 500
Editing Inspection Rules . . . . . . . . . . . . . . . . . 531
Creating a New Empty Sub-Policy . . . . . . . . . . 500
Modifying the Inspection Rules Tree . . . . . . . 531
Converting Existing Rules into a Sub-Policy . . . 500
Changing Inspection Rules Tree Settings . . . 532
Installing Policies . . . . . . . . . . . . . . . . . . . . . . 501
Defining Logging Options for Inspection
Tracking Policy Changes . . . . . . . . . . . . . . . . . 504 Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . 533
Checking the Currently Installed Policy . . . . . . 504 Adding Situations to the Rules Tree. . . . . . . 534
Previewing the Currently Installed Policy . . . . . 504 Removing Overrides From the Rules Tree. . . 535
Checking and Comparing Policy Versions . . . . 504 Adding Exceptions to Inspection Rules. . . . . . 535
Viewing Policy Snapshots . . . . . . . . . . . . . . 505 Defining What Traffic an Inspection
Comparing Two Policy Snapshots. . . . . . . . . 505 Exception Rule Matches . . . . . . . . . . . . . . . 536
Checking for Untransferred Configuration
Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . 506
Table of Contents 11
Defining What Action an Inspection Defining Network Elements . . . . . . . . . . . . . . 569
Exception Rule Takes . . . . . . . . . . . . . . . . . 537 Defining Router Elements . . . . . . . . . . . . . . . 570
Defining Firewall “Continue” Action Options
in Inspection Exceptions . . . . . . . . . . . . . . . 538 Using Feature-Specific Elements in Policies . . . 571
Defining Firewall “Permit” Action Options . . . 538 CHAPTER 40
Defining Firewall “Terminate” Action Defining Network Services. . . . . . . . . . . . . . . . 573
Options . . . . . . . . . . . . . . . . . . . . . . . . . . . 539 Getting Started with Services . . . . . . . . . . . . . 574
Defining IPS “Continue” Action Options in Configuration Overview . . . . . . . . . . . . . . . . . 574
Inspection Exceptions . . . . . . . . . . . . . . . . . 541
Defining IPS “Permit” Action Options in Defining Services . . . . . . . . . . . . . . . . . . . . . . 575
Inspection Exceptions . . . . . . . . . . . . . . . . . 541 Defining a New IP-Based Service . . . . . . . . . . 575
Defining IPS “Terminate” Action Options . . . 542 Defining a New Ethernet Service . . . . . . . . . . 577
Defining Logging Options for Inspection Grouping Services . . . . . . . . . . . . . . . . . . . . 578
Exceptions . . . . . . . . . . . . . . . . . . . . . . . . . 543
Using Protocol Elements. . . . . . . . . . . . . . . . . 579
Editing NAT Rules . . . . . . . . . . . . . . . . . . . . . . 545
Defining Protocol Parameters . . . . . . . . . . . . . 579
Adding a NAT Rule . . . . . . . . . . . . . . . . . . . . 546
Defining DNS Protocol Parameters . . . . . . . . 580
Defining What Traffic a NAT Rule Matches. . . . 546
Defining FTP Protocol Parameters . . . . . . . . . 580
Overwriting the Source Address in Packets . . . 547
Defining GRE Protocol Parameters. . . . . . . . . 582
Defining Static Source Translation Options . . 548
Defining H323 Protocol Parameters. . . . . . . . 582
Defining Dynamic Source Translation
Options . . . . . . . . . . . . . . . . . . . . . . . . . . . 549 Defining HTTP/HTTPS Protocol Parameters . . 583
Overwriting the Destination Address in Packets 550 Defining IPv4 Encapsulation Protocol
Parameters . . . . . . . . . . . . . . . . . . . . . . . . . 584
NAT Rule Examples. . . . . . . . . . . . . . . . . . . . 551
Defining IPv6 Encapsulation Protocol
Example of a Static Source Translation Parameters . . . . . . . . . . . . . . . . . . . . . . . . . 585
Rule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 551
Example of a Dynamic Source Translation Defining MSRPC Protocol Parameters . . . . . . 585
Rule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 552 Defining NetBIOS Protocol Parameters. . . . . . 586
Example of a Destination Translation Defining Oracle Protocol Parameters . . . . . . . 587
Rule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 553
Defining Shell (RSH) Protocol Parameters . . . 588
Example of a Combined Source And
Destination Translation Rule . . . . . . . . . . . . 554 Defining SIP Protocol Parameters . . . . . . . . . 589
Limiting the Time when a Rule Is Active . . . . . . 555 Defining SMTP Protocol Parameters . . . . . . . 590
Validating Rules Automatically . . . . . . . . . . . . . 556 Defining SSH Protocol Parameters . . . . . . . . 590
Overriding Default Validation Options for Rules 557 Defining SunRPC Protocol Options. . . . . . . . . 591
Selecting Rule Validation Settings . . . . . . . . . 558 Defining TCP Proxy Protocol Parameters. . . . . 592
Viewing Policy Validation Issues. . . . . . . . . . . 558 Defining TFTP Protocol Parameters . . . . . . . . 593
Disabling a Validation Warning for a Rule . . . . 559 CHAPTER 41
Defining Situations . . . . . . . . . . . . . . . . . . . . . 595
Excluding Rules from Policy Validation . . . . . . 559
Adding Comments to Policies . . . . . . . . . . . . . 560 Getting Started With Situations . . . . . . . . . . . . 596
Changing Default Rules. . . . . . . . . . . . . . . . . . 560 Configuration Overview . . . . . . . . . . . . . . . . . 597
CHAPTER 39 Creating New Situation Elements . . . . . . . . . . 597
Defining IP Addresses . . . . . . . . . . . . . . . . . . . 561 Defining Context Options for Situations . . . . . . 599
Getting Started with Defining IP Addresses . . . . 562 Defining HTTP URL Filter Options. . . . . . . . . . 600
Defining IP Addresses as Elements . . . . . . . . . 563 Defining Port/Host Scan Detection Options . . 600
Defining Address Range Elements . . . . . . . . . 563 Defining Context Options for Correlation
Situations . . . . . . . . . . . . . . . . . . . . . . . . . . . 602
Defining Alias Elements . . . . . . . . . . . . . . . . 564
Configuring Compress Contexts . . . . . . . . . . 603
Defining Expression Elements . . . . . . . . . . . . 565
Configuring Count Contexts. . . . . . . . . . . . . . 604
Defining Group Elements. . . . . . . . . . . . . . . . 567
Configuring Group Contexts . . . . . . . . . . . . . 604
Defining Host Elements. . . . . . . . . . . . . . . . . 568
Configuring Match Contexts . . . . . . . . . . . . . 605
Configuring Sequence Contexts . . . . . . . . . . . 606 Defining User Accounts for Authentication . . . . 637
Defining Tags for Situations . . . . . . . . . . . . . . . 607 Defining User Groups . . . . . . . . . . . . . . . . . . 638
Creating a New Tag . . . . . . . . . . . . . . . . . . . . 607 Defining Users. . . . . . . . . . . . . . . . . . . . . . . 640
Adding Tags to One Situation at a Time . . . . . 607 Defining Authentication Rules . . . . . . . . . . . . . 642
Adding Tags to Several Situations at Once . . . 608 Managing User Information . . . . . . . . . . . . . . . 644
Removing Tags from Situations . . . . . . . . . . . 608 Adding/Removing Users From User Groups . . 644
Working With Vulnerabilities. . . . . . . . . . . . . . . 609 Importing and Exporting User Information . . . 644
Creating New Vulnerability Elements . . . . . . . 609 Importing Users from an LDIF File . . . . . . . . 644
Associating Vulnerabilities With Situations . . . 610 Exporting Users to an LDIF File . . . . . . . . . . 645
CHAPTER 42 Changing Users’ Passwords . . . . . . . . . . . . . 646
Defining User Responses . . . . . . . . . . . . . . . . . 611 Clearing Users’ Authentication Settings . . . . . 646
Getting Started with User Responses. . . . . . . . 612 Resetting the Firewalls’ Local User Database. 646
Configuration Overview . . . . . . . . . . . . . . . . . 612 Setting User Database Replication to Firewalls
on or off . . . . . . . . . . . . . . . . . . . . . . . . . . . 647
Creating User Responses . . . . . . . . . . . . . . . . 612
Authenticating to a StoneGate Firewall. . . . . . . 647
Defining User Response Entries. . . . . . . . . . . . 613
Customizing the User Authentication Dialog . . . 648
CHAPTER 43
Monitoring and Testing User Authentication . . . 649
Quality of Service (QoS) . . . . . . . . . . . . . . . . . . 615
CHAPTER 45
Getting Started with QoS. . . . . . . . . . . . . . . . . 616 Filtering Web Addresses . . . . . . . . . . . . . . . . . 651
Getting Started with Web Filtering . . . . . . . . . . 652
Creating QoS Classes . . . . . . . . . . . . . . . . . . . 617 Configuration Overview . . . . . . . . . . . . . . . . . 652
Defining QoS Policies . . . . . . . . . . . . . . . . . . . 618
Blacklisting/Whitelisting Web URLs Manually . . 653
Creating New QoS Policies . . . . . . . . . . . . . . 618
Creating Web Filtering Rules . . . . . . . . . . . . . . 654
Editing QoS Rules. . . . . . . . . . . . . . . . . . . . . 619
CHAPTER 46
Matching QoS Rules to Network Traffic . . . . . . . 620 Setting up HTTPS Inspection. . . . . . . . . . . . . . 655
Defining Interfaces’ Speed and QoS Policy . . . . 621
Getting Started with HTTPS Inspection. . . . . . . 656
CHAPTER 44
Setting up User Authentication . . . . . . . . . . . . 623
Configuring Server Protection . . . . . . . . . . . . . 658
Getting Started with User Authentication . . . . . 624
Configuring Client Protection . . . . . . . . . . . . . . 659
Creating Client Protection Certificate Authority
Integrating External LDAP Databases . . . . . . . . 626 Elements. . . . . . . . . . . . . . . . . . . . . . . . . . . 659
Configuring Schema Files on External LDAP Importing a Private Key and Signing
Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . 627 Certificate for HTTPS Client Protection. . . . . . 660
Defining an Active Directory Server Element . . 627 Generating a Private Key and Signing
Configuring the Active Directory Server’s Certificate for HTTPS Client Protection. . . . . . 661
LDAP Settings . . . . . . . . . . . . . . . . . . . . . . 628 Exporting an HTTPS Client Protection
Configuring Active Directory Server’s Certificate . . . . . . . . . . . . . . . . . . . . . . . . . . 662
Authentication Settings. . . . . . . . . . . . . . . . 629 Defining Trusted Certificate Authorities for HTTPS
Defining a Generic LDAP Server Element . . . . 629 Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . 662
Configuring the LDAP Server’s User Creating Trusted Certificate Authority Elements 663
Services . . . . . . . . . . . . . . . . . . . . . . . . . . 631 Importing a Trusted Certificate Authority
Adding Object Classes for the LDAP Certificate for HTTPS Inspection . . . . . . . . . . 663
Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . 632 Configuring Certificate Revocation List Checks
Defining LDAP Domains . . . . . . . . . . . . . . . . 633 for HTTPS Inspection . . . . . . . . . . . . . . . . . . 664
Integrating External Authentication Services . . . 634 Activating HTTPS Inspection on the Engine. . . . 665
Defining an Authentication Server . . . . . . . . . 635 Excluding Domains from HTTPS Inspection. . . . 666
Defining an Authentication Service. . . . . . . . . 637 Defining a Custom HTTPS Service . . . . . . . . . . 667
Creating Access Rules for HTTPS Inspection . . . 668 Managing VPN Client Addresses in
Configuration 3 . . . . . . . . . . . . . . . . . . . . . . 701
CHAPTER 47
External Content Inspection. . . . . . . . . . . . . . . 669 Creating Gateway Elements for
Configuration 3 . . . . . . . . . . . . . . . . . . . . . . 702
Getting Started with External Content Inspection 670
Adding VPN Client Settings for
Configuration Overview . . . . . . . . . . . . . . . . . 670 Configuration 3 . . . . . . . . . . . . . . . . . . . . . . 703
Defining a Content Inspection Server Element . 671 Creating a VPN Element for Configuration 3 . . 705
Defining a Service for CIS Redirection . . . . . . . 672 Creating Users for VPN Configuration 3 . . . . . 706
Creating a Service for CIS Redirection . . . . . . 672 Creating Rules for VPN Configuration 3 . . . . . 707
Defining Protocol Parameters for CIS Configuration 4: Basic VPN Hub . . . . . . . . . . . 709
Redirection . . . . . . . . . . . . . . . . . . . . . . . . . 673 Creating Gateway Elements for VPN
Defining Access Rules for CIS Redirection . . . . 674 Configuration 4 . . . . . . . . . . . . . . . . . . . . . . 709
Defining NAT Rules for CIS Redirection . . . . . . . 675 Creating a VPN Element for VPN
Configuration 4 . . . . . . . . . . . . . . . . . . . . . . 710
CHAPTER 48
Blacklisting Traffic . . . . . . . . . . . . . . . . . . . . . 677 Defining Site Properties for VPN
Configuration 4 . . . . . . . . . . . . . . . . . . . . . . 711
Getting Started with Blacklisting . . . . . . . . . . . 678 Creating Rules for VPN Configuration 4 . . . . . 712
CHAPTER 50
Enabling Blacklist Enforcement . . . . . . . . . . . . 680 Configuring IPsec VPNs . . . . . . . . . . . . . . . . . 715
Configuring Automatic Blacklisting . . . . . . . . . . 681 Getting Started With IPsec VPNs . . . . . . . . . . . 716
Defining Destination Interfaces for Automatic Configuration Overview . . . . . . . . . . . . . . . . . 717
Blacklisting . . . . . . . . . . . . . . . . . . . . . . . . . 681
Configuring IPsec VPNs . . . . . . . . . . . . . . . . 718
Defining Which Traffic is Blacklisted
Automatically . . . . . . . . . . . . . . . . . . . . . . . . 682 Defining Gateway Profiles . . . . . . . . . . . . . . . . 718
Adding a Rule for Blacklisting . . . . . . . . . . . 682 Defining a Custom Gateway Profile . . . . . . . . 718
Defining Blacklisting Rule Action Options . . . 683 Defining Security Gateways . . . . . . . . . . . . . . . 720
Blacklisting Traffic Manually. . . . . . . . . . . . . . . 684 Creating a New Security Gateway Element . . . 721
Defining End-Points for Internal Security
V IRTUAL P RIVATE N ETWORKS Gateways . . . . . . . . . . . . . . . . . . . . . . . . . . 722
Defining End-Points for External Security
Gateways . . . . . . . . . . . . . . . . . . . . . . . . . . 724
CHAPTER 49
Basic VPN Configurations . . . . . . . . . . . . . . . . 687 Defining Trusted CAs for a Gateway . . . . . . . . 726
Getting Started With Basic VPN Configuration . . 688 Defining Gateway-Specific VPN Client Settings 727
Configuration 1: Basic VPN Between StoneGate Defining Sites for VPN Gateways . . . . . . . . . . . 729
Gateways . . . . . . . . . . . . . . . . . . . . . . . . . . . . 688 Disabling/Re-Enabling Automatic VPN Site
Creating Gateway Elements for Configuration 1 689 Management . . . . . . . . . . . . . . . . . . . . . . . . 730
Creating a VPN Element for Configuration 1 . . 690 Adjusting Automatic VPN Site Management . . 731
Creating Rules for VPN Configuration 1 . . . . . 691 Adding a New VPN Site. . . . . . . . . . . . . . . . . 731
Configuration 2: Basic VPN With a Partner Defining Protected Networks for VPN Sites. . . 732
Gateway. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 692 Adjusting VPN-Specific Site Settings . . . . . . . 732
Creating an Internal Gateway Element for Disabling a VPN Site Temporarily in All VPNs . 733
Configuration 2. . . . . . . . . . . . . . . . . . . . . . . 693 Removing a VPN Site Permanently from All
Creating an External Gateway Element for VPNs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 734
Configuration 2. . . . . . . . . . . . . . . . . . . . . . . 694 Defining VPN Profiles . . . . . . . . . . . . . . . . . . . 734
Defining a Site for External Gateway in Creating a New VPN Profile . . . . . . . . . . . . . . 734
Configuration 2. . . . . . . . . . . . . . . . . . . . . . . 695
Modifying an Existing VPN Profile. . . . . . . . . . 735
Creating a VPN Profile for Configuration 2. . . . 696
Defining IKE (Phase 1) Settings for a VPN . . . 735
Creating a VPN Element for Configuration 2 . . 698
Defining IPsec (Phase 2) Settings for a VPN. . 737
Creating Rules for Configuration 2 . . . . . . . . . 700
Defining VPN Client Settings . . . . . . . . . . . . . 740
Configuration 3: Basic VPN for Remote Clients . 701
Defining Trusted CAs for a VPN . . . . . . . . . . . 742 Forwarding All SOHO Corporate Traffic to the
Defining a VPN Element . . . . . . . . . . . . . . . . . 742 VPN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 772
Creating a New VPN Element . . . . . . . . . . . . . 743 Routing Traffic Between VPN Tunnels . . . . . . . . 772
Modifying an Existing VPN Element . . . . . . . . 744 Renewing or Generating Pre-Shared Keys . . . . . 773
Defining VPN Topology . . . . . . . . . . . . . . . . . 744 Generating a New Pre-Shared Key
Automatically . . . . . . . . . . . . . . . . . . . . . . . . 773
Defining VPN Tunnel Settings. . . . . . . . . . . . . 746
Configuring Pre-Shared Keys Manually . . . . . . 774
Creating VPN Rules. . . . . . . . . . . . . . . . . . . . . 748
Advanced VPN Tuning . . . . . . . . . . . . . . . . . . . 774
Creating Basic VPN Rules for Gateway
Connections. . . . . . . . . . . . . . . . . . . . . . . . . 749 Defining a Custom Gateway Settings Element 774
Creating Basic Rules for VPN Client Adjusting General Gateway Settings . . . . . . 776
Connections. . . . . . . . . . . . . . . . . . . . . . . . . 750 Adjusting Negotiation Retry Settings . . . . . . 777
Creating Forwarding VPN Rules on Hub Adjusting Certificate Cache Settings . . . . . . 778
Gateways . . . . . . . . . . . . . . . . . . . . . . . . . . . 751 Adjusting Anti-Clogging Settings . . . . . . . . . 778
Preventing Other Access Rules from Matching Assigning the Gateway Settings for a
VPN Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . 752 Firewall/VPN Engine . . . . . . . . . . . . . . . . . . . 779
Creating NAT Rules for VPN Traffic . . . . . . . . . 752 CHAPTER 53
Monitoring VPNs . . . . . . . . . . . . . . . . . . . . . . . 753 VPN Client Settings . . . . . . . . . . . . . . . . . . . . 781
CHAPTER 51 Getting Started With VPN Client Settings . . . . . 782
Managing VPN Certificates . . . . . . . . . . . . . . . 755 List of VPN Client Settings in the Management
Getting Started With VPN Certificates. . . . . . . . 756 Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 783
Configuration Overview . . . . . . . . . . . . . . . . . 756 Managing VPN Client IP Addresses . . . . . . . . . 785
Configuring NAT Pool for VPN Clients . . . . . . . 786
Defining a VPN Certificate Authority . . . . . . . . . 757
Configuring Virtual IP Addressing for VPN
Creating and Signing VPN Certificates . . . . . . . 759 Clients . . . . . . . . . . . . . . . . . . . . . . . . . . . . 787
Creating a VPN Certificate or Certificate Configuring the Gateway for Virtual IP
Request for an Internal Gateway . . . . . . . . . . 759 Address Clients . . . . . . . . . . . . . . . . . . . . . . 787
Signing External Certificate Requests Internally 761 Allowing DHCP Relay in the Policy . . . . . . . . . 789
Uploading VPN Certificates Manually . . . . . . . . 762 Exporting VPN Client Configuration to a File . . . 789
Renewing VPN Certificates . . . . . . . . . . . . . . . 763
Exporting the Certificate of VPN Gateway or VPN M AINTENANCE AND U PGRADES
CA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 764
Importing a VPN Gateway Certificate . . . . . . . . 765
CHAPTER 54
Checking When Gateway Certificates Expire . . . 765 Backing up and Restoring System
Checking When an Internal VPN CA Expires . . . 766 Configurations . . . . . . . . . . . . . . . . . . . . . . . . 793
CHAPTER 52 Getting Started with Backups . . . . . . . . . . . . . 794
Reconfiguring Existing VPNs . . . . . . . . . . . . . . 767 Configuration Overview . . . . . . . . . . . . . . . . . 794
Adding or Removing Tunnels Within a VPN . . . . 768 Creating Backups. . . . . . . . . . . . . . . . . . . . . . 795
Configuring NAT Settings for an Existing VPN . . 768 Storing Backup Files . . . . . . . . . . . . . . . . . . . 796
Activating NAT Traversal . . . . . . . . . . . . . . . . 768 Restoring Backups . . . . . . . . . . . . . . . . . . . . . 796
Translating Addresses of VPN Communications Restoring a Management Server Backup . . . . 797
Between Gateways . . . . . . . . . . . . . . . . . . . . 769
Restoring a Log Server Backup . . . . . . . . . . . 797
Translating Addresses in Traffic Inside a VPN
Tunnel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 769 Recovering from a Hardware Failure . . . . . . . . . 798
Adding New Gateways to an Existing VPN . . . . . 770 CHAPTER 55
Managing Log Data . . . . . . . . . . . . . . . . . . . . . 799
Changing Gateway IP Addressing in an Existing
VPN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 770 Getting Started with Log Data Management . . . 800
Giving VPN Access to Additional Hosts . . . . . . . 771 Configuration Overview . . . . . . . . . . . . . . . . . 800
Routing Internet Traffic Through VPNs. . . . . . . . 771 Defining When Logs Are Generated . . . . . . . . . 801
Archiving Log Data . . . . . . . . . . . . . . . . . . . . . 802
Creating an Archive Log Task . . . . . . . . . . . . . 802 CHAPTER 58
Selecting Log Data for Archiving. . . . . . . . . . . 803 Upgrading the Management Center . . . . . . . . . 833
Selecting Operation Settings for Archiving Log Getting Started with Upgrading the SMC . . . . . 834
Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 804 Configuration Overview . . . . . . . . . . . . . . . . . 835
Deleting Log Data . . . . . . . . . . . . . . . . . . . . . . 805 Obtaining the SMC Installation Files . . . . . . . . 835
Creating a Delete Log Task . . . . . . . . . . . . . . 805 Upgrading Management Center Servers . . . . . . 836
Selecting Data for Deleting Logs . . . . . . . . . . 806 Default Installation Directories for SMC . . . . . . 837
Selecting Operation Settings for Deleting Logs 806
CHAPTER 59
Pruning Log Data . . . . . . . . . . . . . . . . . . . . . 807 Upgrading the Engines . . . . . . . . . . . . . . . . . . 839
Disabling Pruning Filters . . . . . . . . . . . . . . . . 808 Getting Started with Upgrading Engines . . . . . . 840
Exporting Log Data . . . . . . . . . . . . . . . . . . . . . 809 Configuration Overview . . . . . . . . . . . . . . . . . 840
Creating an Export Log Task . . . . . . . . . . . . . 809
Obtaining Engine Upgrade Files . . . . . . . . . . . . 841
Selecting Data for Log Export . . . . . . . . . . . . 810
Upgrading Engines Remotely. . . . . . . . . . . . . . 841
Selecting Operation Settings for Log Export . . 811
CHAPTER 60
Viewing a History of Executed Log Tasks . . . . . 812 Manual Dynamic Updates. . . . . . . . . . . . . . . . . 845
CHAPTER 56
Getting Started with Manual Dynamic Updates . 846
Managing and Scheduling Tasks . . . . . . . . . . . . 813
Getting Started with Tasks. . . . . . . . . . . . . . . . 814
Importing an Update Package . . . . . . . . . . . . . 846
Activating an Update Package . . . . . . . . . . . . . 847
Task Types . . . . . . . . . . . . . . . . . . . . . . . . . . . 815
Creating New Task Definitions . . . . . . . . . . . . . 817
T ROUBLESHOOTING
Creating Backup Tasks . . . . . . . . . . . . . . . . . 817
Creating Policy Refresh Tasks . . . . . . . . . . . . 818 CHAPTER 61
Creating Policy Upload Tasks . . . . . . . . . . . . . 818 General Troubleshooting Tips. . . . . . . . . . . . . . 851
Creating Remote Upgrade Tasks . . . . . . . . . . 819 If Your Problem Is Not Listed. . . . . . . . . . . . . . 852
Creating SGInfo Tasks. . . . . . . . . . . . . . . . . . 820 Tools For Further Troubleshooting . . . . . . . . . . 852
Scheduling Tasks . . . . . . . . . . . . . . . . . . . . . . 820 CHAPTER 62
Starting Tasks Manually . . . . . . . . . . . . . . . . . 821 Troubleshooting Accounts and Passwords . . . . 853
Pausing the Scheduled Execution of a Task . . . 821 Forgotten Passwords . . . . . . . . . . . . . . . . . . . 854
Cancelling a Task Schedule . . . . . . . . . . . . . . . 821 User Account Changes Have no Effect . . . . . . . 854
Stopping Task Execution . . . . . . . . . . . . . . . . . 822 Creating an Emergency Administrator Account . 855
CHAPTER 57 CHAPTER 63
Managing Licenses. . . . . . . . . . . . . . . . . . . . . . 823 Troubleshooting Alerts, Errors, and Log
Getting Started with Licenses . . . . . . . . . . . . . 824 Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . 857
Generating New Licenses . . . . . . . . . . . . . . . . 826 Alert Log Messages . . . . . . . . . . . . . . . . . . . . 858
Upgrading Licenses Manually . . . . . . . . . . . . . 827 Certificate Authority Expired/Expiring Alerts . . 858
Changing License Binding Details . . . . . . . . . . 828 Certificate Expired/Expiring Alerts . . . . . . . . . 858
Installing Licenses . . . . . . . . . . . . . . . . . . . . . 828 “Log Spool Filling” . . . . . . . . . . . . . . . . . . . . 858
Installing a License for an Unlicensed “Status Surveillance: Inoperative Security
Component . . . . . . . . . . . . . . . . . . . . . . . . . 828 Engines” . . . . . . . . . . . . . . . . . . . . . . . . . . . 858
Replacing the License of a Previously “System Alert”. . . . . . . . . . . . . . . . . . . . . . . 859
Licensed Component . . . . . . . . . . . . . . . . . . 829 “Test Failed” . . . . . . . . . . . . . . . . . . . . . . . . 859
Checking If All Components Are Licensed . . . . . 831 “Throughput Based License Exceeded” . . . . . 859
Checking License Validity and State . . . . . . . . . 831 Log Messages . . . . . . . . . . . . . . . . . . . . . . . . 860
Connection Closed/Reset by Client/Server . . 860
“Connection Removed During Connection Problems Logging In with the Management
Setup”. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 860 Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 889
“Connection State Might Be Too Large” . . . . . 860 Problems with Layout and Views . . . . . . . . . . . 890
“Connection Timeout...” . . . . . . . . . . . . . . . . 861 Problems With Viewing Statistics. . . . . . . . . . . 890
“Incomplete Connection Closed” . . . . . . . . . . 862 Problems with Status Monitoring . . . . . . . . . . . 890
“NAT Balance: Remote Host Does Not Problems Installing Web Start on an External
Respond” . . . . . . . . . . . . . . . . . . . . . . . . . . 862 Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 891
“Not a Valid SYN packet” . . . . . . . . . . . . . . . 863 CHAPTER 69
“Requested NAT Cannot Be Done”. . . . . . . . . 864 Troubleshooting NAT . . . . . . . . . . . . . . . . . . . 893
Spoofed Packets . . . . . . . . . . . . . . . . . . . . . 864 Troubleshooting NAT Errors . . . . . . . . . . . . . . . 894
IPsec VPN Log Messages . . . . . . . . . . . . . . . 864 NAT Is Not Applied Correctly . . . . . . . . . . . . . . 894
Error Messages . . . . . . . . . . . . . . . . . . . . . . . 864 NAT Is Applied When it Should Not Be . . . . . . . 895
Command Failed/Connect Timed out . . . . . . . 864 CHAPTER 70
PKIX Validation Failed . . . . . . . . . . . . . . . . . . 865 Troubleshooting Policies . . . . . . . . . . . . . . . . . 897
Policy Installation Errors . . . . . . . . . . . . . . . . 865 Troubleshooting Firewall Policy Installation . . . . 898
Unexpected Error . . . . . . . . . . . . . . . . . . . . . 865 The Engine Performs a Roll-Back at Policy
Installation . . . . . . . . . . . . . . . . . . . . . . . . . 898
CHAPTER 64
Troubleshooting Certificates . . . . . . . . . . . . . . 867 The Management Server Contact to Nodes
Times Out . . . . . . . . . . . . . . . . . . . . . . . . . . 898
Understanding Certificate-Related Problems . . . 868
Policy Installation Fails for Some Other
Replacing Expired/Missing Certificates . . . . . . 870 Reason . . . . . . . . . . . . . . . . . . . . . . . . . . . . 899
Renewing SMC Server Certificates. . . . . . . . . 870 Warning “Automatic Proxy ARP Option Is
Renewing Engine Certificates . . . . . . . . . . . . 871 Ignored” . . . . . . . . . . . . . . . . . . . . . . . . . . . 899
Dealing with Expiring Certificate Authorities . . . 872 Troubleshooting IPS Policy Installation . . . . . . . 900
CHAPTER 65
Troubleshooting Rules . . . . . . . . . . . . . . . . . . 900
Troubleshooting Engine Operation . . . . . . . . . . 875 Validating Rules . . . . . . . . . . . . . . . . . . . . . . 900
Node Does not Go or Stay Online. . . . . . . . . . . 876 Rule That Allows ANY Service Does Not
Allow All Traffic. . . . . . . . . . . . . . . . . . . . . . . 900
Error Commanding an Engine. . . . . . . . . . . . . . 876
Inspection Rules Produce False Positives. . . . 901
Errors with Heartbeat and Synchronization . . . . 877
How to Enable Passthrough for PPTP Traffic . . 901
Problems Contacting the Management Server. . 877
Traffic I Want to Allow Is Stopped by the
CHAPTER 66 Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . 902
Troubleshooting Licensing . . . . . . . . . . . . . . . . 879 Packets Are Dropped as Spoofed . . . . . . . . . 903
Troubleshooting Licensing . . . . . . . . . . . . . . . . 880 Unsupported Definitions in IPv6 Access Rules 903
License Is Shown as ‘Retained’ . . . . . . . . . . . . 880 CHAPTER 71
License Is Shown as ‘Unassigned’. . . . . . . . . . 881 Troubleshooting Reporting . . . . . . . . . . . . . . . 905
“Throughput Based License Exceeded” Alerts. . 881 Troubleshooting Reporting . . . . . . . . . . . . . . . 906
CHAPTER 67 No Report is Generated at All . . . . . . . . . . . . . 906
Troubleshooting Logging . . . . . . . . . . . . . . . . . 883 Empty Report Sections or Incomplete Data . . . 907
Problems With Viewing Logs . . . . . . . . . . . . . . 884 CHAPTER 72
Logs Are Filling up the Storage Space . . . . . . . 884 Troubleshooting Upgrades . . . . . . . . . . . . . . . . 909
Log Server Does not Run . . . . . . . . . . . . . . . . 885 Upgrade Fails Because of Running Services . . . 910
CHAPTER 68 “StoneGate will not be installed properly” . . . . 910
Troubleshooting the Management Client. . . . . . 887
CHAPTER 73
Cannot View Online Help: “Help File Not Found” 888 Troubleshooting VPNs. . . . . . . . . . . . . . . . . . . 911
Some Options Are Disabled. . . . . . . . . . . . . . . 888 Checking Automatic VPN Validation Results . . . 912
Slow Startup and Use . . . . . . . . . . . . . . . . . . . 889 Reading VPN-related Logs . . . . . . . . . . . . . . . . 912
VPN Certificate Issues . . . . . . . . . . . . . . . . . . 913
Problems with Internal to External Gateway VPN 913 Exportable SSL VPN Log Entry Fields . . . . . . . 997
Problems Connecting With a StoneGate VPN Facility Field Values . . . . . . . . . . . . . . . . . . . . 997
Client. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 914 Type Field Values . . . . . . . . . . . . . . . . . . . . . . 999
Action Field Values . . . . . . . . . . . . . . . . . . . . . 1000
A PPENDICES Event Field Values . . . . . . . . . . . . . . . . . . . . . 1000
IPsec VPN Log Messages . . . . . . . . . . . . . . . . 1005
APPENDIX A
Command Line Tools . . . . . . . . . . . . . . . . . . . . 917 VPN Notifications . . . . . . . . . . . . . . . . . . . . . 1005
VPN Errors. . . . . . . . . . . . . . . . . . . . . . . . . . 1007
Management Center Commands . . . . . . . . . . . 918
VPN Error Codes . . . . . . . . . . . . . . . . . . . . . 1009
Engine Commands . . . . . . . . . . . . . . . . . . . . . 926
Audit Entry Types . . . . . . . . . . . . . . . . . . . . . . 1010
Server Pool Monitoring Agent Commands . . . . . 931
Syslog Entries . . . . . . . . . . . . . . . . . . . . . . . . 1014
APPENDIX B
Default Communication Ports. . . . . . . . . . . . . . 933 Log Fields Controlled by the Additional Payload
Option. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1015
Management Center Ports. . . . . . . . . . . . . . . . 934 Connection States . . . . . . . . . . . . . . . . . . . . . 1016
Firewall/VPN Engine Ports . . . . . . . . . . . . . . . . 936
APPENDIX H
IPS Engine Ports. . . . . . . . . . . . . . . . . . . . . . . 940 Keyboard Shortcuts. . . . . . . . . . . . . . . . . . . . . 1019
APPENDIX C General Shortcuts . . . . . . . . . . . . . . . . . . . . . 1020
Predefined Aliases . . . . . . . . . . . . . . . . . . . . . . 943
Shortcuts for Browsing Logs and Alerts . . . . . . 1021
Pre-Defined User Aliases . . . . . . . . . . . . . . . . . 944 Other View-Specific Shortcuts . . . . . . . . . . . . . 1023
System Aliases. . . . . . . . . . . . . . . . . . . . . . . . 944 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1025
APPENDIX D
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1055
Regular Expression Syntax . . . . . . . . . . . . . . . . 947
Syntax for StoneGate Regular Expressions . . . . 948
Special Character Sequences . . . . . . . . . . . . . 950
Pattern-Matching Modifiers . . . . . . . . . . . . . . . 951
Bit Variable Extensions . . . . . . . . . . . . . . . . . . 952
Variable Expression Evaluation . . . . . . . . . . . . 954
Stream Operations . . . . . . . . . . . . . . . . . . . . 956
Other Expressions . . . . . . . . . . . . . . . . . . . . 957
System Variables . . . . . . . . . . . . . . . . . . . . . . 958
Independent Subexpressions. . . . . . . . . . . . . . 959
Parallel Matching Groups. . . . . . . . . . . . . . . . . 960
APPENDIX E
SNMP Traps and MIBs . . . . . . . . . . . . . . . . . . . 961
APPENDIX F
Schema Updates for External LDAP Servers . . . 973
APPENDIX G
Log Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . 975
Log Entry Fields . . . . . . . . . . . . . . . . . . . . . . . 976
Non-exportable Log Entry Fields. . . . . . . . . . . 976
Exportable Alert Log Entry Fields . . . . . . . . . . 980
Exportable Alert Trace Log Entry Fields . . . . . . 980
Exportable Audit Log Entry Fields . . . . . . . . . . 981
Exportable Firewall Log Entry Fields . . . . . . . . 982
Exportable IPS Log Entry Fields . . . . . . . . . . . 984
Exportable IPS Recording Log Entry Fields . . . 996
G ETTING S TARTED
In this section:
Using StoneGate Documentation - 21
What’s New? - 27
Using the Management Client - 35
Setting up the System - 55
Configuring System Communications - 59
Managing Elements - 71
19
20
C H A P TE R 1
USING STONEGATE DOCUMENTATION
Welcome to the StoneGate™ product family by Stonesoft Corporation. This chapter describes
how to use this guide and related documentation. It also provides directions for obtaining
technical support and giving feedback on the documentation.
The following sections are included:
Objectives and Audience (page 22)

Documentation Available (page 23)
Contact Information (page 24)
21
Objectives and Audience
The StoneGate Administrator’s Guide is intended for the administrators of any StoneGate
installation in tasks that involve the StoneGate Management Center (SMC) and the various
components that the SMC controls. This guide describes step by step how to complete
StoneGate configuration and management tasks.
The guide continues from where the Installation Guide ends. The chapters in this guide are
organized according to StoneGate administrative tasks. Each chapter focuses on one area of
administration. As a general rule, the chapters proceed from basic configuration tasks to more
advanced topics. Although overviews are provided, the emphasis in this guide is more on
completing specific tasks than developing a deep understanding of how the system works
(consult the Reference Guides for more background information).
This guide explains features included in the software versions mentioned on page 1. If you are
using older versions of the software you will not be able to use all the features explained in this
manual and some features that are available may not work as explained.
To launch the Online Help system, press F1 on your keyboard in any Management Client window
or dialog.
Typographical Conventions
We use the following typographical conventions throughout the guide:
Table 1.1 Typographical Conventions
Formatting Informative Uses

Normal text This is normal text.
Interface elements (buttons, menus, etc.) and any other

User interface text
interaction with the user interface are in bold-face.
Cross-references and first use of acronyms and terms are

References, terms
in italics.
File names, directories, and text displayed on the screen

Command line
are monospaced.
User input User input on screen is monospaced bold-face.
Command parameter names are in monospaced

Command parameters
italics.
We use the following ways to indicate important or additional information:

Prerequisites: Many of the sections start with a list of prerequisites that point out tasks you must perform
before the procedure outlined in the section. Obvious prerequisites (such as having installed a firewall if you
want to configure a firewall feature) are not included in these prerequisites.
Note – Notes provide important information that may help you complete a task.
22 Chapter 1 Using StoneGate Documentation

Caution – Cautions provide important information that you must take into account before
performing an action to prevent critical mistakes.
Tip – Tips provide information that is not essential, but makes working with the system easier.
Example Examples clarify points made in the adjacent text.
What’s Next?
 The What’s Next lists at the ends of secions contain tasks that you must or may want to
perform after completing a procedure. If several of the procedures listed apply, pick the
first one; you will encounter a new What’s Next section when you are finished with the
first item.
Documentation Available
StoneGate technical documentation is divided into two main categories: product documentation
and support documentation.
Product Documentation
The table below lists the available product documentation. PDF guides are available on the
Management Center CD-ROM and at http://www.stonesoft.com/support/.
Table 1.2 Product Documentation
Guide Description
Explains the operation and features of StoneGate comprehensively.
Demonstrates the general workflow and provides example scenarios
Reference Guide
for each feature area. Available for StoneGate Management Center,
Firewall/VPN, and StoneGate IPS.
Instructions for planning, installing, and upgrading a StoneGate

Installation Guide system. Available for StoneGate Management Center, Firewall/VPN,
IPS, and SOHO firewall products.
Describes how to configure and manage the system step-by-step.

Accessible through the Help menu and by using the Help button or
the F1 key in any window or dialog. Available in the StoneGate
Online Help
Management Client and the StoneGate Web Portal. An HTML-based
system is available in the StoneGate SSL VPN Administrator through
help links and icons.
Describes how to configure and manage the system step-by-step.

Available as a combined guide for both StoneGate Firewall/VPN and
Administrator’s Guide
StoneGate IPS, and as separate guides for StoneGate SSL VPN and
StoneGate IPsec VPN Client.
Instructions for end-users. Available for the StoneGate IPsec VPN

User’s Guide
Client and the StoneGate Web Portal.
Documentation Available 23
Table 1.2 Product Documentation (Continued)
Guide Description
Instructions for physically installing and maintaining StoneGate
Appliance Installation Guide appliances (rack mounting, cabling, etc.). Available for all StoneGate
hardware appliances.
Support Documentation
The StoneGate support documentation provides additional and late-breaking technical
information. These technical documents support the StoneGate guide books, for example, by
giving further examples on specific configuration scenarios.
The latest StoneGate technical documentation is available on the Stonesoft website at http://
www.stonesoft.com/support/.
System Requirements
The certified platforms for running StoneGate engine software can be found at the product
pages at www.stonesoft.com/en/products_and_solutions/products/ (select the correct product
and click “Software Solutions” on the left).
The hardware and software requirements for the Management Center and version-specific
details for all software products can be found in the Release Notes included on the Management
Center CD-ROM and on the software download page at the Stonesoft website.
Contact Information
For street addresses, phone numbers, and general information about StoneGate and Stonesoft
Corporation, visit our website at http://www.stonesoft.com/.
Licensing Issues
You can view your current licenses at the License Center section of the Stonesoft website at
https://my.stonesoft.com/managelicense.do.
For license-related queries, e-mail order@stonesoft.com.
Technical Support
Stonesoft offers global technical support services for Stonesoft’s product families. For more
information on technical support, visit the Support section at the Stonesoft website at http://
www.stonesoft.com/support/.
Your Comments
We want to make our products fulfill your needs as well as possible. We are always pleased to
receive any suggestions you may have for improvements.
• To comment on software and hardware products, e-mail feedback@stonesoft.com.
• To comment on the documentation, e-mail documentation@stonesoft.com.

Security Related Questions and Comments
You can send any questions or comments relating to StoneGate IPS and network security to
security-alert@stonesoft.com.
Other Queries
For queries regarding other matters, e-mail info@stonesoft.com.
Contact Information 25
C H A P TE R 2
WHAT’S NEW?
This section lists major changes since the previous release. Most new or reworked features in
the software are listed here. Changes that do not significantly affect the way StoneGate is
configured are not listed. For a full list of changes in the software and detailed version-specific
information, consult the Release Notes.
Important Changes (page 28)

Other Changes in SMC 5.2.2 (page 28)
Other Changes in SMC 5.2 (page 29)
Other Changes in Firewall/VPN 5.2 (page 31)
Other Changes in IPS 5.2 (page 32)
Notes on Policy Editing Changes for Upgrading Users (page 33)
27
Important Changes
The changes listed here either automatically change existing configurations or require you to
manually check the existing configurations in your system.
VPNs: End of Support for Legacy UDP Encapsulation

The 5.2 Firewall/VPN engine release no longer supports StoneGate’s proprietary UDP
encapsulation method for NAT traversal. If NAT traversal is required, reconfigure your VPNs to
use NAT-T encapsulation. Deactivate the option before firewall/VPN gateways are upgraded to
version 5.2. Removing the UDP encapsulation does not require any changes in the
configurations of third-party VPN gateways, since the method is proprietary to StoneGate (the
option has never enforced encapsulation with unsupported components).
• For more details, see Defining End-Points for Internal Security Gateways (page 722).
SMC: End of Support for Legacy VPN Clients

The SMC release 5.2 no longer contains options for VPN client versions 2.6 and older. Legacy
VPN clients will not be able to connect through firewall engines that are managed with SMC 5.2
regardless of the software version of the engines.
Other Changes in SMC 5.2.2
Automatic Update Proxy Server Authentication

You can now set a username and password for the HTTPS proxy server that is used for
downloading upgrades and updates. This allows you to display maintenance contract
information, and import dynamic updates, engine upgrades, and/or updated licenses
automatically when your web proxy requires authentication.
• For more details, see Configuring Automatic Updates and Engine Upgrades (page 210).
Disable Connection Synchronization

In each firewall Access rule (Action options), you can now select that connections are not
synchronized between clustered firewall engines when the connections are allowed by the rule.
This reduces the overhead, but prevents connection failover to other nodes in the cluster. This
option requires firewall software version 5.2.1 or higher on all clustered engine nodes.
• For more details, see Defining Firewall “Allow” Action Options (page 523).
28 Chapter 2 What’s New?

Other Changes in SMC 5.2
See also Important Changes!
Color Selection for Comment Rules

You can now set the color of comment rules in policies through the comment rule’s right-click
menu.
Connections and Blacklist Snapshots

You can now save snapshots of active blacklist entries and firewall connection entries.
• For more details, see Saving Blacklist and Connections Snapshots (page 99).
Custom Backup Import for Demo Mode Installations

When you install the SMC demo environment, you can now import your own backup to create a
simulation of your actual environment. The demo installation cannot interact with any physical
components, so the environment is not completely realistic; the engines in the demo are only
local simulations, and the log data is randomly generated.
• For more details, see the Management Center Installation Guide.
Editing Logic Changes in the Policy Editor

Several changes in how rules are edited make the policy editor more consistent to use.
• For more details, see Notes on New Rule Table Editing Logic (page 33).
Element Import Enhancements

You can now restore elements from Policy Snapshots and import elements from plain text or
CSV files. You can now preview and compare element contents before elements are imported.
• For more details, see Restoring Elements from Policy Snapshots (page 78).
Inspection Rule Configuration Reworked

The tools for configuring Inspection rules in Firewall and IPS Policies have been modified
extensively to allow you to activate and deactivate inspection checks in a much simpler way than
before. This change does not automatically change your configurations, but makes new tools
available in existing policies. In most cases, this change allows a much simpler and easier to
read policy, but you must edit the policies manually to achieve the benefits.
• For more details, see Notes on Inspection Rule Changes (page 34).
Integrated MIB Browsing Tool

You can import SNMP MIBs for third-party log data reception and browse the MIB file contents in
the Management Client.
• For more details, see Importing MIBs (page 120).
Other Changes in SMC 5.2 29

Log to Rule Links for Inspection and NAT Rules
In addition to Access rules, the Logs view now allows you to open Inspection and NAT rules that
have generated information shown in the log entries.
New Search Tools

New Type-Ahead Searching allow you to quickly filter any long element listing simply by typing
some identifying detail. A new duplicate IP address search allows you to find redundant
elements in the system. A new DNS search allows you to search existing elements and create
new elements by typing in a DNS name (that your DNS servers are able to resolve).
• For more details, see Using the Search Features (page 44).
OCSP Support
Engines can now check IPsec VPN certificate validity using the OCSP protocol.
• For more details, see Defining a VPN Certificate Authority (page 757).
Save and Browse Logs as Zip Archives

You can now save logs into a zip archive and view them directly from this archive on any
computer that has the Management Client installed.
Simpler Alert Severity Scale

The alert severities shown in most parts of the user interface are now Info, Low, High, and
Critical. Internally, the system uses the same ten numerical identifiers as before (for example, in
the raw log data files).
Statistics-Based Alerts
It is now possible to define a threshold for automatic tracking of monitored items in Overviews.
An alert is sent if the threshold is exceeded.
• For more details, see Setting Thresholds for Monitored Items (page 96).
Third-Party Device Monitoring Improvements

The maximum number of third party components that one Log Server can monitor has been
increased from 50 to 200. The Logging Profile editor and Field Resolver editor have been
improved and made easier to use.
• For more details, see Receiving Logs From External Devices (page 113) and Defining Field
Resolvers (page 117).
VPN Troubleshooting Shortcuts

The VPN monitoring diagrams now contain shortcuts to related logs in the right-click menus of
the displayed tunnels, gateways, and end-points.

Other Changes in Firewall/VPN 5.2
See also Important Changes (page 28)!
64-Bit Software Version

To support increased memory requirements, a 64-bit version of the software is now available.
Separate versions of the engine software are provided for 32-bit and 64-bit installations. It is not
possible to upgrade from a 32-bit installation to 64-bit installation. If you run the engines on
your own hardware, you can install the 64-bit version as a fresh installation on existing
hardware. StoneGate appliances do not support switching between 32-bit and 64-bit
installations. In clusters, it is not possible to have both 32-bit and 64-bit engines online at the
same time.
Aggregated Network Links

Firewalls now support the IEEE 802.3ad link aggregation standard for load-balancing and high-
availability of network links with routers that are configured for link aggregation.
• For more details, see Defining Physical Interfaces for Firewall Engines (page 344).
Concurrent Connection Rate Limits

You can now set limits to the number of connections that can be opened between each IP
address pair in the firewall Access rules.
• For more details, see Defining Firewall “Allow” Action Options (page 523).
IPv6 Support on Single Firewalls

Single firewalls can now filter IPv6 traffic and be configured with IPv6 addresses on their
network interfaces. Some features do not work with IPv6 traffic at this time. NAT rules (including
features that rely on NAT, such as outbound and inbound Multi-Link, and CIS redirection), all
deep packet inspection features, and VPNs are not supported for IPv6 traffic at this time.
IGMP Policy Routing

Firewalls now support IGMP-based multicast forwarding (IGMP proxying).
• For more details, see Defining IGMP-Based Multicast Forwarding (page 449).
Integrated DHCP Server on Clusters

In addition to single firewalls, also clusters can now act as a DHCP server for the local
networks.
• For more details, see Activating the Internal DHCP Server on a Firewall Interface (page 388).
Rule Hit Counters for NAT Rules

In addition to Access rules, the firewall engines now provide counters for how many connections
hit your NAT rules.
• For more details, see Finding Unused Rules in Firewall Policies (Hit Counters) (page 515).
Other Changes in Firewall/VPN 5.2 31

Other Changes in IPS 5.2
See also Important Changes (page 28)!
64-Bit Software Version

To support increased memory requirements, a 64-bit version of the software is now available.
Separate versions of the engine software are provided for 32-bit and 64-bit installations. It is not
possible to upgrade from a 32-bit installation to 64-bit installation. If you run the engines on
your own hardware, you can install the 64-bit version as a fresh installation on existing
hardware. StoneGate appliances do not support switching between 32-bit and 64-bit
installations. Clusters cannot have both 32-bit and 64-bit engines online at the same time.
DNS Protocol Enforcement

Sensors now have additional application layer checks that can recognize DNS traffic. You can
enforce the use of DNS protocol to prevent other applications, such as peer-to-peer file sharing
applications, from masquerading as DNS queries.
• For more details, see Defining DNS Protocol Parameters (page 580).
Fingerprint Improvements
The regular expression syntax for context definitions in Situations has been enhanced to allow
more flexible variable definitions.
• For more details, see Regular Expression Syntax (page 947).
Web Filtering
IPS sensors now support manually entered URL lists and category-based web filtering. Category-
based filtering controls web access using general classifications of web content. For example,
you can prevent users from accessing game sites. Category-based web filtering is a separately
licensed feature.
• For more details, see Getting Started with Web Filtering (page 652).

Notes on Policy Editing Changes for Upgrading Users
Notes on New Rule Table Editing Logic

The editing logic in rule tables in Firewall and IPS policies has changed. The table below details
the main changes.
Table 2.1 Changes in Editing Logic
Version 5.1 Behavior Version 5.2 Behavior

Left-click the Action cell to activate a list that
you must click again to open and choose the Right-click the Action cell to open a menu that
Action. allows you to choose the Action.
Right-click opens a menu of general rule editing Left-click just selects the cell.
items.
If you right-click a cell that has cell-specific

Right-click menu in all cells contains general actions, the rule-specific actions are in a
rule-specific items (such as “Add rule before”) “Rule” sub-menu.
at the main level together with cell-specific If you right-click a cell that has no cell-specific
actions (such as “Set to ANY”). action (ID or Tag), the rule-specific actions are
shown directly.
Rules have a “Logging” cell for the logging

Rules have an “Options” cell for additional options.
options for the Actions and logging. Options for The Action cell contains the options specific to
all Actions are shown regardless of the Action the Action. The dialog only shows options that
selected for the rule. the currently selected Action supports. The
Some Actions have required additional options dialog opens automatically if you select an
in the Action cell. The dialog opens Action that always requires you to set
automatically if you select an Action that always additional options.
requires you to set additional options. You can double-click the Action or the Logging
cell to adjust the options.
Notes on Policy Editing Changes for Upgrading Users 33

Notes on Inspection Rule Changes
Illustration 2.1 The New Inspection Rules
The Inspection tab in Firewall and IPS Policies is now divided in two parts:
• At the top, the Exceptions panel contains the rule table, which is functionally unchanged.
• Below, the Rules panel contains a tree of inspection checks, the Rules tree.
• The Situations are organized in the Rules tree under a new type of categorization called
Situation Type. Situation Types otherwise work like Situation Tags, except that you can only
select one Situation Type for each Situation and that all Situations that have a Situation Type
are included in the Rules tree in all policies.
The Rules tree is the main configuration tool. It allows you to select an action (Allow or
Terminate) and the logging options per Situation or per Situation Type. Both the action and
logging options can be set to a default setting, which means that the setting is inherited from
the parent element and changed when the parent’s setting is changed, allowing you to quickly
change the settings for many Situations.
However, the Rules tree does not allow any other configurations than what is discussed above.
For example, IP addresses cannot be added to the main Rules. For more detailed control and for
some features (such as blacklisting) you must use the Exceptions rule table. Some additional
options, such as User Responses, can be set for the Rules tree in a Continue rule created as an
Exception. If you use Template Policies to delegate and restrict administrator editing rights, note
that the Rules tree can be edited freely in all policies regardless of the definitions in the higher-
level Template Policy. The Exceptions continue to follow the familiar old logic.
Although the Rules tree is now shown in all policies, the configurations in your existing IPS
policies remain unchanged. Your existing Inspection rules are shown in the Exceptions table.
The recommended new editing logic is to use the Rules tree whenever possible and only make
Exceptions when the Rules tree does not have all suitable options for your intended use. With
existing policies, most rules that do not need to apply to some specific Source, Destination, or
a Sensor’s Logical Interface are candidates to be removed and replaced by the Rules tree. If you
take the time to clean up the existing policies in this way, they will be easier to manage in the
future.
For more information, see Editing Inspection Rules (page 531).
Tip – See the IPS Reference Guide for background information on the new IPS rule configuration tools
and new information about the overall rule design considerations.

C H A P TE R 3
USING THE MANAGEMENT CLIENT
The sections listed below provide an introduction to the StoneGate Management Client.
Overview to the Management Client (page 36)

Rearranging the General Layout (page 40)
Bookmarking Views (page 41)
Changing the Startup View (page 44)
Using the Search Features (page 44)
Using Type-Ahead Search (page 49)
Saving as PDF or HTML (page 50)
Sending Messages to Other Administrators (page 52)
Adding Custom Commands to Element Menus (page 53)
35
Overview to the Management Client
Prerequisites: None
This section presents a general overview to the Management Client. For detailed information on
using these views, see the Related Tasks at the end of this section.
The Management Client offers several task-specific views. There are alternative ways to switch
between the different views:
• The main menu and the toolbar shortcuts are always available.
• Additional links are provided, for example, in the right-click menus of elements and in the
logs. You can also bookmark your most frequently visited views.
You have several options for opening a new view.
• Clicking replaces the current view with the new one.
• Ctrl-clicking opens the new view as a new tab.
• Shift-clicking opens the new view as a new window.
You can open a new empty tab in any view, by using the keyboard shortcut Ctrl+T. You can also
do it by clicking the plus icon on the right of the previous tab. From the list of views that opens,
select the view to be shown in the new tab.
The System Status View
Illustration 3.1 The System Status View
Automatically
generated
connectivity
diagram for
the selected
element and
its peers.
Status of
monitored
system
elements.
Details of
the selected
element
Information messages of the Active alert

Management Client itself. notification.
36 Chapter 3 Using the Management Client

By default, when you launch the Management Client, you see the System Status view. This view
provides the operating and connectivity status of system components and third party
components that are set up to be monitored through the StoneGate Management Center. The
right-click menus of the elements offer shortcuts to many configuration and maintenance tasks.
The Configuration Views
Illustration 3.2 The Firewall Configuration View
Elements of the type

selected in the tree.
Tree of relevant
element types.
There are separate configuration views for Firewall, IPS, VPN, Administration, and Monitoring
configuration tasks. These views can be opened both through the main menu and the shortcut
buttons in the toolbar. Additionally, there is a combined Configuration view that lists all
elements.
The Configuration views allow you to set up and modify all features of the system. The
configurations are stored as elements, which are shown in a tree structure. Elements are
created and modified through the right-click menus that open when you right-click a tree branch
or an element.
Overview to the Management Client 37

Overviews
Illustration 3.3 An Example Overview
A side panel can be opened

Information is through the View menu to
displayed as conveniently edit the content and
resizeable tiles. appearance of the selected tile.
Overviews can contain information on the system’s status, bookmarks to views you use often
(such as logs filtered with specific criteria), and statistical charts on the system’s operation
(such as engine load) and the traffic flow. You can create several different overviews for different
purposes. Several default overviews are provided as templates.

Logs View
Illustration 3.4 The Logs View in the Records Arrangement
Query panel
selects data
for display.
This default view

arrangement displays
logs as a table.
Related Tasks
 Bookmarking Views (page 41)
 Changing the Startup View (page 44)
 Managing Elements (page 71)
 Getting Started with System Monitoring (page 84)
 Creating Overviews (page 92)
 Getting Started with the Logs View (page 128)
Overview to the Management Client 39

Rearranging the General Layout
Prerequisites: None
You can select different panels and view options through the View menu. Some layout options
are specific to the currently active view, and some options are global.
You can drag and drop the panels to several preconfigured places within each specific view. The
layout is saved as your preference for further use, but you can reset it through the
ViewLayoutReset Layout option in the main menu.
• To resize a panel, drag by the outer edge of the panel as usual when resizing.
• To move a panel, drag by the title bar at the top like you would move a window (see illustration
below).
Illustration 3.5 Positioning a Panel
You can move the panels in

a number of positions that
are highlighted as you drag
the panel around. Drop the
panel where you prefer to
have it.
If the highlighted area
completely covers some
other panel, the second
panel adds a new tab.
You can also bookmark alternative layouts to quickly return to a specific view and layout at any
later time, see Bookmarking Views.

Bookmarking Views
Prerequisites: None
Bookmark-related actions can be found through the Bookmark menu. Bookmarks can also be
added to the toolbar. Bookmarks can store many of the settings you have selected in views. For
example, you can bookmark a Logs view with particular filtering settings. Several windows and
tabs can be stored behind a single click when you combine bookmarks into Bookmark Folders.
Bookmarks in the default Shared Bookmarks folder are shown to all administrators that log in
to the same Management Server. Other bookmarks are private to the Management Clients of
individual administrators.
Managing Bookmarks
Bookmarks can be managed in the Administration Configuration view, under the Bookmarks
branch. There is a shortcut to this view: select BookmarkManage Bookmarksin the main
menu.
You can, for example, copy Bookmarks and Bookmark Folders from one group to another. All
actions are available through the right-click menu for the Bookmarks and Bookmark folders.
Illustration 3.6 Bookmarks
Bookmarking Views 41
Creating New Bookmarks
You can create a bookmark for the currently active tab and other window-level elements in the
configuration you select. Some view-specific options are also stored in bookmarks, such as the
currently active filter in the Logs view, or the type of elements that are listed in a Configuration
view at the time the bookmark is created.
Bookmarking is a main window action, so the properties dialogs for the various elements are
never included in the bookmark.
 To bookmark the active view

1. Arrange the view as you would like to see it when the bookmark is opened.
2. Select BookmarkAdd Bookmark from the menu. The Bookmark Properties dialog opens.
Illustration 3.7 Bookmark Properties
3. (Optional) Change the Name and add a Comment for your reference.
• The default name is taken from the bookmarked view’s title.
4. (Optional) For In Folder, click the Select button and select the folder where the Bookmark is
placed.
• The default Bookmarks creates the folder at the top level of the bookmarks tree.
• Select the Shared Bookmarks folder if you want other administrators to see this
Bookmark. All other folders are private to your Management Client.
• Select the Toolbar folder or one of its sub-folders to add the bookmark folder to the
toolbar. If the Toolbar folder is not available, activate the feature as explained in Adding
Bookmarks to the Toolbar (page 43).
5. (Optional) Deselect Window Layout if you prefer the bookmark not to change the layout of
the window when you open it, but use whichever layout the view had when you last used it.
6. Click OK.
 To bookmark all tabs in the window

1. Open the tabs you want to bookmark in the same window (and close any tabs you do not
want to bookmark).
2. Select BookmarkBookmark All Tabs from the menu. The Bookmark Folder Properties
dialog opens.

3. Fill in the Bookmark Folder properties (see Creating New Bookmark Folders (page 43)) and
click OK. A new Bookmark Folder is created, containing a bookmark for each tab you had
open.
Related Tasks
 To further edit and organize the bookmarks, see Managing Bookmarks (page 41).
Creating New Bookmark Folders

Bookmark folders organize bookmarks and make it easier to open several bookmarks at once.
The folders you create are also added as items in the Bookmark menu.
As an alternative to the steps explained below, you can bookmark all tabs that are open in the
current view in a bookmark folder that is automatically created to contain the new bookmarks.
See To bookmark all tabs in the window (page 42) for detailed instructions.
 To create a new bookmark folder

1. Select BookmarkManage Bookmarks from the menu. The Bookmarks tree is displayed.
2. Right-click the Bookmarks category in the tree and select New Bookmark Folder. The
Bookmark Folder Properties dialog opens.
3. Enter a Name and optionally also a Comment for your reference.
4. (Optional) For In Folder, click the Select button and select the folder where the Bookmark is
placed.
• The default Bookmarks creates the folder at the top level of the bookmarks tree.
• Select the Shared Bookmarks folder if you want other administrators to see this
Bookmark. All other folders are private to your Management Client.
• Select the Toolbar folder or one of its sub-folders to add the bookmark folder to the
toolbar. If the Toolbar folder is not available, activate the feature as explained in Adding
Bookmarks to the Toolbar (page 43).
5. Click OK.
Adding Bookmarks to the Toolbar

You can add your bookmarks to the toolbar below the shortcut icons. After you activate the
bookmarks toolbar as explained below, you can add any new bookmark to the toolbar by storing
the bookmark in the Toolbar folder or one of its sub-folders. You can also move any existing
bookmark to the toolbar by dragging and dropping the bookmark or bookmark folder to the
Toolbar folder in the BookmarkManage Bookmarks tree.
 To activate the bookmarks toolbar

1. Select ViewLayoutBookmark Toolbar from the menu. The bookmark toolbar is shown
below the toolbar icons.
Illustration 3.8 Bookmarks Toolbar in the Default State
Bookmarks toolbar
Bookmarking Views 43
2. Click the default New Toolbar Folder item. The Create Toolbar Folder dialog opens.
3. Enter the name for the first folder to add to the toolbar and click OK. The first folder
appears in the toolbar and the Toolbar folder is added to the bookmark hierarchy, allowing
you to add, remove, and edit the bookmarks in the toolbar.
Changing the Startup View

Prerequisites: None
You can freely choose which view opens whenever you log in to the Management Client,
replacing the default System Status view.
 To change the startup view

1. Arrange the screen with the windows, tabs, and views you want to have open at each login.
2. Select BookmarkSave as Startup Session from the menu.
Using the Search Features

Prerequisites: None
Using Basic Element Search

You can use the basic search to quickly find elements by a simple element property, such as
name, comment, or IP address.
 To search for elements

1. Select ViewSearch from the menu. The basic element search opens.
Illustration 3.9 Search View
View all search

types
Search
Search results
criteria
2. Enter the search criteria (name, IP address, comment, vulnerability reference, etc.) in the
Search for field.
• You can use wildcard symbols in your query (for example, win*, or 192.168*100).
• You can use the + symbol to require search criteria.
• You can use the - symbol to exclude search criteria.

3. (Optional) Select options to limit the search:
Table 3.1 Search Options
Option Explanation
Limit by Type Restrict the search to one type of element.
Restrict the search to elements modified by a particular administrator. Select the

Changed by administrator from the list of recently used elements or click Other to see all
Administrator elements.
Changed Search elements that were last changed between certain dates. You can type in the
Between dates or select them from a calendar.
Search Across Search within all configured administrative Domains. This options is only visible if
Domains Domain elements have been configured.
Illustration 3.10 Search Panel
Select
options to
limit the
search
4. Click the Search button to launch the search. The search results are displayed.
Tip – If the element you searched for does not exist, you can right-click the empty search results and
create a new Host or Network that has the Name and/or IP address configured according to
your search terms.
Related Tasks
 Searching for Element References (page 46)
 Searching for Users (page 46)
 Searching for Duplicate IP Addresses (page 47)
 Using the DNS Search (page 48)
 Searching for Unused Elements (page 49)
Using the Search Features 45

Searching for Element References
If you need to check where an element is used, you can quickly search for references to it. This
is useful, for example, when you want to delete an element (since referenced elements cannot
be deleted until the references are removed).
 To search for element references

1. Right-click the element and select ToolsReferences. A References view opens showing
the elements that reference the element you right-clicked.
2. (Optional) Select Show References in the Search panel if you also want to view further
references for the elements that are found and click the Search button to relaunch the
search. The search results are now displayed as a tree that allows you to follow the trail of
references.
Tip – Click the Up icon in the toolbar to view a list of all available searches.
Searching for Users

 To search for users
1. Select ViewSearch from the menu. The Search view opens.
2. Click the Up icon at the top of the search panel. A list of the different search types opens.
3. Select Users - search. The Users view opens.
4. Select the LDAP Domain in which you want to search for the user(s).
5. Select the user attributes for the search as described in the table below:
Table 3.2 User Attribute Options
Option Explanation
UserID User’s login name.
Name The name of the user in the User properties.
Authentication
The authentication method configured for the user.
Service
The first date (yyyy-mm-dd) on which the user is allowed to log in through the
Activation Date
firewall.
Expiration Date The last date (yyyy-mm-dd) on which the user is allowed to log in through the firewall.
The number of days the user is allowed to log in through the firewall (from the
Expiration Delay
Activation Date to the Expiration Date).

6. Specify the Query type as described in the table below:
Table 3.3 Query Type Options
Option Explanation
Contains The user information contains the value (for example, a name) that is searched for.
The Activation Date or Expiration Date of the user is the same or later than the date
Greater Than
entered for the search (yyyy-mm-dd).
The Activation Date or Expiration Date of the user is the same or earlier than the
Lesser Than
date entered for the search (yyyy-mm-dd).
Is Defined Returns all user accounts that have some value for the selected attribute.
7. (Depending on attribute selected) Enter the required value (for example, a name or date)
that you want to search for among the user information.
8. Click Search. A list of users that match the search criteria is displayed.
Searching for Duplicate IP Addresses

 To search for duplicate IP addresses
3. Select Duplicate IPs - search. The Duplicate IPs view opens.
4. Select the search criteria as described in the table below:
Table 3.4 Search Criteria Options
Option Explanation
Limit by Type Restrict the search to the type element that you select.

Changed by administrator from the list or select Other to select an administrator in the dialog
that opens.
Restrict the search to elements changed between certain dates. Enter the date
Changed
information or click the button next to the date fields to select the dates from a
Between
calendar.
Search Across Make the search across all configured administrative Domains. This options is only
Domains visible if Domain elements have been configured.
5. Click the Search button to launch the search. The search results are displayed.
Using the Search Features 47

Using the DNS Search
You can use the DNS search to look for hosts by their DNS name. The Management Server must
have Zone Transfer rights to be able to make queries on the DNS server.
 To use the DNS search

3. Select DNS - search. The DNS Search view opens.
4. Enter the DNS IP Address and the DNS Domain.
5. Click the Search button to launch the search. The search results display a list of available
host names and their IP addresses.
• If a Host element that has a matching name already exists in the system, the Host
element is shown in the Network Element column.
What’s Next?
 If the search did not find an element, you can add it based on the search as explained
in Creating Host Elements Based on DNS Queries.
Creating Host Elements Based on DNS Queries

If the Network Element column in the DNS search results does not shown an existing Host
element for a host name, you can create a new Host element based on the host name and IP
address.
 To create Host element based on DSN query results

1. Right-click one or more IP addresses in the DNS Search view and select Create Network
Element. The Host Creation dialog opens.
• Ctrl-click or Shift-click to select multiple IP addresses if you want to create Host elements
for all of them.
2. (Optional) If you want to add the new Host element(s) into a Group, select Group and enter
the Group Name.
• If such a Group element does not yet exist in the system, a new Group is automatically
created.
3. Define a name for the new Host element(s):
• Full Name: the Host name is the full name retrieved from the DNS.
• Name without Domain: the Host name is created by removing the domain part from the
name retrieved from the DNS.
• Specify Name: Enter a name for the Host(s).
• Prefix + IP Address: Enter a Prefix that is added to IP address to form the Host name(s).
4. Click OK. The created Host(s) are displayed in the Network Element column.

Searching for Unused Elements
The unused element search helps you find elements that may be unnecessary. The search looks
for element references and lists elements that are not referenced by any other elements. You
must use your own judgement to determine which of the listed elements can safely be removed.
 To search for unused elements

3. Select Unused elements - search. The Unused Elements view opens.
4. Select the search criteria as described in the table below:
Table 3.5 Search Criteria Options
Option Explanation
Limit by Type Restrict the search to the type element that you select.

Changed by administrator from the list or select Other to select an administrator in the dialog
that opens.
Restrict the search to elements changed between certain dates. Enter the date
Changed
information or click the button next to the date fields to select the dates from a
Between
calendar.
Search Across Make the search across all configured administrative Domains. This options is only
Domains visible if Domain elements have been configured.
5. Click the Search button to launch the search. A list of elements that are not used in any
configuration or within any elements is displayed and the number of the elements found is
shown at the bottom of the Search panel.
Using Type-Ahead Search

Prerequisites: None
Type-Ahead Search allows you to quickly filter elements. You can use Type-Ahead Search in all
views in which element lists, tables, or trees are displayed.
When you start typing, the system immediately filters the display to the elements that include
what you typed in the element’s basic details, for example:
• Element name.
• IP address.
• Comment.
• TCP/UDP Port.
Using Type-Ahead Search 49

Illustration 3.11 Type-Ahead Search
Saving as PDF or HTML

Prerequisites: None
You can save lists of elements, logged data, reports, and statistics in PDF format or as HTML by
selecting FilePrint from the menu. Saving as PDF allows you to use a background template.
The specifics of PDF printing are described below.
PDF Output Settings

Logged data, reports, and statistics can be saved as a PDF file. The associated settings are
explained in the table below.
Table 3.6 Print to PDF Settings
Tab Section Settings Description

Print to PDF Opens the output file in the default PDF viewing
Printing Reader application on your computer.
Options
Print to File Allows you to save the output as a PDF file.
Defines the background for the generated PDF. See

Style Template
Adding Style Templates For PDF Output (page 51).
Defines the background paper size. The available sizes

Page Setup Paper Size
are A3, A4, A5, and Letter.
General
Select either a horizontal (landscape) or vertical
Orientation
(portrait) page.
Selected Prints only records that are currently selected in the Logs
Records Records view.
(Logs view Filtered
only) Records Prints all records that match the current Query.
from...

Table 3.6 Print to PDF Settings (Continued)
Tab Section Settings Description

Prints a table with one record per row. Enter the number
Table
of columns that are included.
Layout Prints a table in which each record occupies several

(Logs view Records rows in a column layout. Enter the number of columns
only) you want to include (counting from left to right).
Prints all relevant details according to your selection

Details
using one page per record.
Adding Style Templates For PDF Output

Background style templates can be used when saving as PDF. The templates can be used in the
Management Client and the Web Portal as permitted by account permissions and Domain
boundaries.
The style template is a standard PDF file you create with some or all of the following elements:
• One or more cover pages that are attached to the printed PDF before the content pages.
• A content page background with a header and/or footer. The height of the header and footer
can be adjusted. The same single page is used as the background for all content pages.
• One or more trailing pages that are attached to the printed PDF after the content pages.
• Your PDF template file can contain additional pages that you do not want to be used; these
are ignored.
• A one-page PDF file is used as a content page. Your PDF template file must contain at least
two pages if you want to add cover and trailing pages.
You can create the template, for example, by creating a suitable document in a word processor
and saving it as a PDF. For best results, design separate templates for the different page sizes
(A3, A4, A5, or Letter) and orientations (portrait or landscape) you anticipate using.
 To add a new Style Template

1. Create a PDF file that contains a template page for the content and optionally one or more
cover and trailing pages.
2. Open the Print to PDF dialog, for example, by right-clicking a log entry and selecting Print.
The Print to dialog opens.
3. Under Page Setup, select New from the Style Template list. The Style Template Properties
dialog opens.
4. Enter a unique Name for the new Style Template.
5. Click Browse and select the PDF file you want to use as a template.
6. Select how the pages are used:
• (Optional) The Front Pages from are inserted before the content pages without
modifications. Fill in just the first field for a single-sheet front page.
• The Content Page is used as the background for all pages that have system-generated
content.
• The Header Height and Footer Height define how much space is left (in millimeters)
between the top and bottom of the page and the first/last line of system-generated
Saving as PDF or HTML 51

content. This prevents the generated content from overlapping text/graphics on your
content page.
• (Optional) The Back Pages from are inserted after the content pages without
modifications. Fill in just the first field for a single-sheet trailing page.
Tip – You can use the same pages for different roles. For example, you can select the same page as
a content page and a back page to add an empty page at the end of the generated PDFs. The
PDF template file must have at least 2 pages to do this, even if you only use one of the pages.
7. Click OK.
Managing PDF Style Templates

 To manage Style Templates
1. Open the Print to dialog, for example, by right-clicking a log entry and selecting Print.
2. Under Page Setup, select Other from the Style Template list. The Select dialog opens.
3. Right-click a Style Template and select an action from the right-click menu. You can Delete
the selected Style Template or select Properties to adjust the template settings (see
Adding Style Templates For PDF Output (page 51) for information on the settings).
Sending Messages to Other Administrators

Prerequisites: None
The administrator messaging feature allows you to communicate with other administrators who
are currently logged in to the Management Client. For example, you can inform administrators
about service breaks before upgrading the Management Center. Administrator messaging is
enabled by default.
What’s Next?
 If you want to enable/disable administrator messaging, proceed to Enabling/Disabling
Administrator Messaging (page 52).
 To send messages to administrators, proceed to Sending Messages to Other
Administrators (page 53).
Enabling/Disabling Administrator Messaging

Only an administrator with unrestricted permissions can enable/disable administrator
messaging. If Domain elements have been configured, the setting is applied in all the Domains.
 To enable/disable administrator messaging

1. Select ConfigurationConfigurationAdministration from the menu. The Administration
Configuration view opens.
2. Expand the Access Rights branch in the Administration tree.
3. Right-click Administrators and select/deselect Administrator Messaging Enabled.

Sending Messages to Other Administrators
Administrators who are logged in can send messages to all other administrators. Only
administrators who have the “manage administrators” permission can send messages to
individual administrators. Each administrator must be logged in to a unique administrator
account for individual messages to be sent.
 To send a new message to other administrators

1. Click Send Message at the bottom of the Management Client window. The Administrator
Messaging dialog opens.
2. Select the Administrators who receive the message:
• (Administrators with the “manage administrators” permission) Click the Select icon (the
icon with the black arrow) to select individual Administrator(s).
• Click the Set All Administrators icon (the “list” icon) to send the message to all
administrators.
3. Type in your Message and click Send. The message is sent to all selected administrators.
The Administrator Messaging dialog automatically opens for each administrator so that they
can reply to your message.
Adding Custom Commands to Element Menus

Prerequisites: None
You can add commands (for example, tracert, SSH, or ping) to an element’s right-click menu with
Tools Profiles. The commands are added in the Tools submenu.
What’s Next?
 To define new commands, proceed to Creating a Tools Profile (page 53).
 To reuse an existing Tools Profile without modifications, proceed to Attaching a Tools
Profile to an Element (page 54).
Creating a Tools Profile

Tools Profiles add commands to the right-click menus of elements. You can include information
dynamically from the element definition in the command. Only one Tools Profile can be selected
for each element, but each Tools Profile can include several commands.
The commands are launched on the workstation that is running the Management Client.
Commands are operating-system-specific, so you must add a separate command for each
operating system in use. Administrators see commands according to their operating system (for
example, a Linux command is not shown if the Management Client is running in Windows).
 To create a Tools Profile

1. Select ConfigurationConfigurationAdministrationfrom the menu. The Administration
2. Right-click Tools Profileand select New Tools Profile. The Tools Profile Properties dialog
opens.
Adding Custom Commands to Element Menus 53

Illustration 3.12 Tools Profile Properties
3. Enter the Name for the new Tools Profile. This is added as an item under the Tools
submenu of elements that the Tools Profile is attached to.
4. Click Add and select the operating system. A row is added to the table.
5. Double-click the Name cell, and enter the item that you want to add.
6. (Optional) Select Run in Console if you want the command to be run in a console
application, such as the command prompt in Windows or terminal in Linux.
7. Double-click the Command cell and enter the command or the full path to the application.
8. (Optional) Double-click the Parameters cell and enter the parameters for the command. In
addition to static parameters, the following two variables can be used:
• ${IP}: the primary IP address of the element that is right-clicked.
• ${NAME}: the name of the element that is right-clicked.
9. Click OK.
What’s Next?
 Proceed to Attaching a Tools Profile to an Element.
Attaching a Tools Profile to an Element

You can attach a Tools Profile to Network Elements that have a single primary IP address.
 To attach a Tools Profile to an element

1. Right-click an element and select Properties. The element’s Properties dialog opens.
2. Click Select to open the Select Element dialog for searching the Tools Profile.
3. Click the Tools Profile to be attached and click Select.
4. Click OK. The commands defined in the Tools Profile are added to the right-click menu of
the element in the Tools submenu.

C H A P TE R 4
SETTING UP THE SYSTEM
The sections listed below provide an introduction to StoneGate and shortcuts to feature-
specific instructions.
Getting Started with the Management Center (page 56)

Getting Started with the Firewall (page 56)
Getting Started with the IPS (page 57)
55
Getting Started with the Management Center
Prerequisites: Management Center installation (covered in a separate Installation Guide)
This section is meant to help you get started after you have completed the Management Center
installation.
To familiarize yourself with the Management Client, see Overview to the Management Client
(page 36).
The basic administration tasks you must complete after installation include the following:
• Scheduling automatic backup tasks to keep safe the essential configuration information
stored on the Management Server as instructed in Backing up and Restoring System
Configurations (page 793).
• Setting up automated tasks to manage the gathered log data and prevent the Log Server
storage space from filling up with logs as instructed in Managing Log Data (page 799).
Additionally, we highly recommend that you set up the following features:
• Defining additional administrator accounts and delegating administrative tasks as instructed
in Administrator Accounts (page 213).
• Reviewing settings for automatic updates and making sure the feature works to ensure that
your system stays current. See Getting Started with Automatic Updates and Engine Upgrades
(page 210).
• Defining custom alerts and alert escalation policies as instructed in Alert Escalation
(page 229).
To efficiently manage the system, you must also familiarize yourself with the following basic
tasks:
• Monitoring the system operation as instructed in Monitoring the System (page 83) and
Browsing Logged Data (page 127).
Getting Started with the Firewall

Prerequisites: Management Center and Firewall installation (covered in separate Installation Guides)
This section is meant to help you get started after you have completed the installation, installed
a basic policy, and turned the firewalls online as instructed in the Installation Guide. If you have
also installed a new Management Center, first see Getting Started with the Management Center
(page 56).
Note – The configuration information is stored on the Management Server, and most
changes are transferred to the engines only when you install or refresh the firewall policy
after making the changes.
The basic administration tasks you must learn or complete next include the following:
• Reading and controlling the operating state of firewall engines as explained in Controlling
Engine Operation (page 189).
• Adjusting the automatic tester that monitors the operation of the firewall and the surrounding
network as explained in Configuring the Engine Tester (page 397).
• Developing your Firewall Policies further as instructed in Getting Started with Policies
(page 498).
56 Chapter 4 Setting up the System

The most typical customization steps include:
• Configuring multiple network connections for load-balanced, highly available networking as
explained in Getting Started with Outbound Traffic Management (page 460).
• Configuring traffic management for incoming connections to groups of servers as explained in
Getting Started with Inbound Traffic Management (page 468).
• Setting up bandwidth management and traffic prioritization policies as explained in Getting
Started with QoS (page 616).
• Configuring the firewall to utilize external content inspection servers as explained in Getting
Started with External Content Inspection (page 670).
• Configuring secure connectivity between different locations and for travelling users as
explained in Getting Started With IPsec VPNs (page 716).
Also consult the product-specific Reference Guides, which contain background information that
helps you better understand the system and its features.
Getting Started with the IPS

Prerequisites: Management Center and IPS installation (covered in separate Installation Guides)
This section is meant to help you get started after you have completed the installation, installed
a basic policy, and turned the IPS system online as instructed in the Installation Guide. If you
have also installed a new Management Center, first see Getting Started with the Management
Center (page 56).
Note – The configuration information is stored on the Management Server, and most
changes are transferred to the engines only when you install or refresh the IPS policy after
making the changes.
The basic administration tasks you must learn or complete next include the following:
• How to read and control the operating state of IPS engines as explained in Controlling Engine
Operation (page 189).
• Adjusting the automatic tester that monitors the operation of the IPS engines and the
surrounding network as explained in Configuring the Engine Tester (page 397).
After you have installed your first IPS policy, your next task is gathering information about the
events detected in your networks during a “tuning period” (see Browsing Logged Data
(page 127)). Once you have enough information on what kind of traffic—malicious and
harmless—can be seen in your network, you can modify your policies to improve the detection
accuracy and to get rid of false alarms. The most typical customization steps include:
• Creating your own policy or policy template as explained in Creating and Managing Policy
Elements (page 497).
• Modifying the Ethernet rules, Access rules, and Inspection rules as explained in Editing
Ethernet Rules (page 516), Editing Access Rules (page 518), and Editing Inspection Rules
(page 531).
• Creating your own custom Situations as explained in Defining Situations (page 595).
Also consult the product-specific Reference Guides, which contain background information that
helps you better understand the system and its features.
Getting Started with the IPS 57

58 Chapter 4 Setting up the System
C H A P TE R 5
CONFIGURING SYSTEM COMMUNICATIONS
This section provides an overview to system communications in StoneGate.
Getting Started with System Communications (page 60)

Defining Locations (page 61)
Defining Contact IP Addresses (page 62)
Selecting the Management Client Location (page 69)
Configuring Multi-Link System Communications (page 70)
59
Getting Started with System Communications
Prerequisites: None
System communications involve traffic between StoneGate components and between

StoneGate components and external components that are a part of the system configuration.
Firewalls do not automatically allow any system communications. The Default Firewall Policy
Template contains rules that allow most types of system communications between the firewall
itself and the components it interacts with. You must create additional rules to allow any other
communications through firewalls, such as the communications of some other system
component that pass through the firewall. A list of ports used in system communications is
presented in Default Communication Ports (page 933).
System Communications Through a NAT Device
If NAT is applied between two system components, you must define the translated IP address as
a contact address. A single component can have several contact addresses. Only IPv4
addresses are used in system communications.
Location elements define when a contact address is used and which of the defined contact
addresses is used. When NAT is applied between two communicating system components, you
must separate them into different Locations. Components that are in the same Location use the
primary IP address when communicating with each other and ignore all contact addresses.
When components contact a component that belongs to a different Location, they use the
defined contact address.
There is one system element related to contact addresses, the Location “Default”. If you do not
select a Location for an element that has the Location option, the element’s Location is set to
Default.
You can define a Default contact address for contacting a component (defined in the main
Properties dialog of the element). The element’s Default contact address is used in
communications when components that belong to another Location contact the element and the
element has no contact address defined for their Location.
Example of Using Contact Addresses and Locations
Illustration 5.1 Example Network With Locations

Headquarters Location Branch Office Location
Intranet
Remote
Firewall
Intranet Internet Intranet

Remote
Log/Management Central Firewall
Server Firewall
Intranet
Remote
Firewall
In the example scenario above, a Management Server and a Log Server manage StoneGate
components both at a company’s headquarters and in three branch offices.
60 Chapter 5 Configuring System Communications

• The SMC servers and the central firewall are placed in a “Headquarters” Location.
• The remote firewalls are all placed in a “Branch Office” Location.
In this scenario, contact addresses are typically needed as follows:
• The firewall at the headquarters or an external router may provide the SMC servers external
IP addresses on the Internet. The external addresses of the SMC servers must be defined as
contact addresses for the “Branch Office” location, so that the components at the branch
offices can contact the servers across the Internet.
• The branch office firewall or an external router may provide external addresses for the
StoneGate components at the branch office. The external IP addresses of the engines must
be defined as contact addresses for the “Headquarters” Location so that the Management
Server can contact the components.
• Alternatively, the external address of each component can be defined as a Default contact
address without adding a specific entry for “Headquarters” or “Branch Office”. The Default
contact address is used when a component does not have a specific contact address
definition for the contacting component’s Location. Note that the components must still be
divided into separate Locations for the contact address to be used.
If there are Management Clients used at any of the branch offices, each administrator must also
select “Branch Office” as their Location in the Management Client to be able to view logs from
the remote Log Server that is behind a NAT device.
What’s Next?
 Proceed to Defining Locations to start defining contact addresses.
 Proceed to Defining Contact IP Addresses (page 62) to add a new contact adress for an
existing Location.
Related Tasks
 Defining IP Addresses (page 561)
 Network Interface Configuration (page 341)
 Selecting the Management Client Location (page 69)
Defining Locations
Prerequisites: None
If NAT (network address translation) is applied between communicating system components, the
components must be assigned different Locations in the configuration. You create the Locations
and add elements to them based on how your network is set up.
Example If a system has several Locations, but each component still has the same external IP address
no matter where the contact is made from, each element only needs a single contact
address: the Default contact address. When new system elements are added, they have to be
assigned a specific Location, but they only need a Default contact address.
 To create a new Location

2. Expand the Other Elements branch in the Administration tree.
Defining Locations 61
3. Right-click Locations and select New Location from the menu. The Location Properties
dialog opens.
4. Enter a Name and an optional fee-form Comment.
5. Browse to the type of elements you want to add to the Location in the Resources panel on
the left.
6. Select the element(s) you want to add to the Location and click Add. The selected elements
are added to the Content panel on the right.
7. Click OK.
What’s Next?
 Continue by Defining Contact IP Addresses.
Defining Contact IP Addresses

Prerequisites: Defining Locations
You can define contact addresses for Firewall elements (excluding SOHO firewalls), IPS
elements, and most types of Server elements. The contact addresses are defined directly in the
element properties. The contact addresses are based on Location elements.
You can also define a Default contact address that is used whenever no contact address is
defined for a certain Location.
What’s Next?
 If you need to define a contact address for an engine, start by Defining Engine Location
(page 62).
 If you need to define contact addresses for a server, proceed to Defining Server Contact
Addresses (page 67).
 If you need to define a contact address for an external VPN gateway, see Defining a
Contact Address for External Security Gateway End-Point (page 68).
 If you need to define a contact address for an internal VPN gateway, see Defining End-
Points for Internal Security Gateways (page 722).
Defining Engine Location

You must define a Location and a contact address for an engine if NAT is applied to the
communications between the engine and some other component that needs to contact the
engine. If you use Multi-Link, remember to add contact addresses for each NetLink.
 To define a Location for an engine element

1. Right-click the engine element and select Properties from the menu. The Properties dialog
for the element opens.

Illustration 5.2 Firewall Properties
2. Select the Location for this element.

• The rest of the instructions in this section do not apply to SOHO firewalls. Continue
editing the SOHO firewall properties as necessary.
3. Switch to the Interfaces tab in the engine element’s properties.
Illustration 5.3 Interfaces Tab
4. In the tree view, expand the tree and double-click the Cluster Virtual IP Address (CVI), Node
Dedicated IP Address (NDI), or the IP address for which you want to define a contact
address. The IP Address Properties dialog opens.
• On clusters, the CVI contact address is used for VPNs and NDI contact addresses are
used for other system communications.
Proceed to one of the following depending on interface or engine type:
• Defining Contact Addresses for a Single Firewall or a Cluster Virtual IP Address (page 63)
• Defining Contact Addresses for Node Dedicated IP Addresses (page 65)
• Defining Contact Addresses for an IPS Engine (page 66)
Defining Contact Addresses for a Single Firewall or a Cluster

Virtual IP Address
 To define Contact Addresses for a single firewall or a Cluster Virtual IP Address
1. In the IP Address Properties dialog, define the Default contact address. The Default contact
address is used by default whenever a component that belongs to another Location
connects to this interface.
• If the interface has a static Default contact address, enter the Default contact address in
the Default field. If the interface has a dynamic IP address, disable Dynamic (next to the
IPv4 Address field) before entering the Default contact address.
• If the interface has a dynamic Default contact address, select Dynamic (next to the
Default field).
Defining Contact IP Addresses 63

Illustration 5.4 IP Address Properties - Single Firewall
2. If components from some Locations cannot use the Default contact address to connect to
the interface, click Exceptions to define Location-specific contact addresses. The
Exceptions dialog opens.
Illustration 5.5 Contact Addresses for Specific Locations - Single Firewall or Cluster Virtual IP Address
3. Click Add and select the Location. A new row is added to the table.
4. Click the Contact Address column and enter the IP address that the components belonging
to this Location must use when they contact the interface or select Dynamic if the interface
has a dynamic contact address.
Note – Elements that belong to the same Location element always use the primary IP
address (defined in the main Properties window of the element) when contacting each
other. All elements not specifically put in a certain Location are treated as if they belonged
to the same Location, the Default Location.

5. Click OK to close the Exceptions dialog.
What’s Next?
 If you want to define contact addresses for firewall cluster nodes, continue by Defining
Contact Addresses for Node Dedicated IP Addresses (page 65).
 Otherwise, click OK to close the IP Address Properties dialog.
Defining Contact Addresses for Node Dedicated IP Addresses

 To define Contact Addresses for Node Dedicated IP Addresses
1. In the IP Address Properties dialog, define the IP contact address for each node in the Node
Dedicated IP Address section by double-clicking the Contact Address cell for each node.
The Exceptions dialog opens.
Illustration 5.6 Contact Addresses for Specific Locations - Node Dedicated IP Address
2. Enter the Default contact address at the top of the dialog. The Default contact address is
used by default whenever a component that belongs to another Location connects to this
interface.
3. If components from some Locations cannot use the Default contact address, click Add to
define Location-specific contact addresses. A new row is added to the table.
to this Location must use when they contact the node.

6. One you have defined the contact address(es) for each node, click OK to close the IP
Address Properties dialog.
Defining Contact Addresses for an IPS Engine

 To add Contact Addresses for an IPS engine
1. In the IP Address Properties dialog, double-click the Contact Address cell. The Exceptions
dialog opens.
Illustration 5.7 Contact Addresses for Specific Locations - IPS Engine
2. Enter the Default contact address at the top of the dialog. The Default contact address is
interface.
3. If components from some Locations cannot use the Default contact address, click Add to
define Location-specific contact addresses. A new row is added to the table.
to this Location must use when they contact the interface.

6. Click OK to close the IP Address Properties dialog.

Defining Server Contact Addresses
In addition to situations where NAT is used between StoneGate elements, Server contact
addresses are also needed for external servers, such as LDAP and authentication servers, if
they provide services for StoneGate components.
You can configure multiple contact addresses for each Management Server and Log Server. If
you use Multi-Link, it is recommended that the Management Server and the Log Server have a
separate contact address for each NetLink so that if a NetLink goes down, the engines can still
be managed (in case of reverse monitoring between the Management Server and the engines)
and the engines can still send status and log data to the Log Server.
 To define Server contact addresses

1. In the Firewall Configuration or IPS Configuration view, browse to Network
ElementsServers.
2. Right-click the Server element for which you want to define a contact address and select
Properties from the menu. The Properties dialog for that Server opens.
Illustration 5.8 Server Properties
3. Select the Location of this Server.

4. Enter the Default contact address. If the server has multiple Default contact addresses,
separate the addresses with a comma.
5. (Optional) Click Exceptions to define further contact addresses for contacting the server
from specific Locations. The Exceptions dialog opens.
Illustration 5.9 Server Contact Addresses for Specific Locations
6. Click Add and select a Location. A new row is added to the table.

7. Click the Contact Address column and enter the IP address(es) that the components
belonging to this Location must use when they contact the Server.
• You can enter several contact addresses per Location for Management Servers and Log
Servers. Separate the contact addresses with a comma.
to the same Default Location.

9. Click OK to close the Server properties dialog.
Defining a Contact Address for External Security Gateway End-

Point
You must define a contact address for the end-point of an External Security Gateway if the IP
address for contacting the Gateway is different from the IP address the Gateway actually has on
its interface (for example, because of NAT).
 To define end-point contact address

1. In the External Gateway properties, switch to the End-Points tab.
2. Right-click an End-Point and select Properties. The End-Point Properties dialog opens.
Illustration 5.10 External End-Point Properties.
3. Enter the Default contact address or select Dynamic if the Default contact address is
dynamic.
• The Default contact address is used by default whenever a component that belongs to
another Location connects to this end-point.

4. (Optional) If components belonging to some Location cannot use the Default contact
address, click Exceptions to define contact addresses that components belonging to
specific Locations use to connect to this end-point. The Exceptions dialog opens.
Illustration 5.11 End-Point Contact Addresses for Specific Locations
5. Click Add and select a Location. A new row is added to the table.
to this Location must use when they contact the end-point or select Dynamic if the end-
point has a dynamic contact address.
8. Click OK to close the End-Point properties dialog.
Selecting the Management Client Location

Prerequisites: Defining Locations, Defining Server Contact Addresses
If NAT is performed between the Management Client and a Log Server, you may need to change
the Location of the Management Client to be able to view the logs. Which Location you have to
choose depends on the system configuration. The “Default” selection is appropriate if the Log
Server is assigned a specific Location and the Log Server’s Default contact address is correct
for your current network connection.
 To select the Management Client Location

 Click the location name in the status bar at the bottom right corner of the Management
Client window and select the Location from the list that opens.
Illustration 5.12 Management Client Window - Bottom Right Corner
If there are no suitable configurations available, you may need to add a new Location and define
a contact address for this specific Location in the Log Server’s properties.
Related Tasks
 Defining Locations (page 61)
 Defining Contact IP Addresses (page 62)
Selecting the Management Client Location 69

Configuring Multi-Link System Communications
Prerequisites: Defining a Multi-Link Route for a Firewall
If a remotely managed firewall has Multi-Link, we recommend that you add a primary and a
secondary management interface for different ISP connections to ensure connectivity if one of
the firewall’s local ISP connections fails. Make sure you configure these addresses consistently
for the actual interface address on the firewall, for the external contact addresses (if
applicable), and in the NAT rules of the firewall that is protecting the SMC servers (as
necessary).
If a Management Server or Log Server is located behind Multi-Link in relation to components
that contact them, define a contact address for each network connection and make sure your
NAT rules translate from each external address to the correct internal address of the SMC
server.
Related Tasks
 Setting Firewall Interface Options (page 361)

C H A P TE R 6
MANAGING ELEMENTS
There are certain tasks that are common to most elements. Some of these tasks are not
mandatory for defining an element, but are still helpful as you get your system up and
running.
Using Categories (page 72)

Importing, Exporting and Restoring Elements (page 75)
Restoring Elements from Policy Snapshots (page 78)
Locking and Unlocking Elements (page 79)
Deleting Elements (page 79)
71
Using Categories
Prerequisites: None
Categories allow you to filter only a subset of elements for viewing in the Management Center.
When you activate a Category filter, elements that do not belong to one of the selected
Categories are filtered out of your view.
Categories help you manage large networks by filtering the elements displayed to you. You can,
for example, create separate Categories for elements belonging to a firewall and to an IPS
configuration and select the correct category when you want to concentrate on configuring just
one of the products. You can freely select how to assign the Categories and quickly and flexibly
change which combinations of Categories are shown according to your tasks.
Configuration Overview
The general workflow for using Categories is as follows:
1. Create a new Category. See Creating New Categories (page 72).
2. Associate elements with the Category. See Selecting Categories for Elements (page 73).
3. Select the defined Category as the active Category Filter. See Activating Categories
(page 73).
4. Change the Category selection as needed in the toolbar list. See Activating Categories
(page 73).
Creating New Categories

You can create as many Categories as you need. You can base the categorization on any criteria
you want. One element can belong to several Categories.
By default, the Category filter includes also a Not Categorized item which you can select on its
own or in combination with a Category defined in your system.
 To define a new Category

2. Expand Other Elements branch of the Administration tree.
3. Right-click Categories and select NewCategory. The Category Properties dialog opens.
4. Give the new category a unique name.
5. (Optional) Enter a Comment for your own reference.
6. Click OK. The category is created and appears in the Other ElementsCategories branch
of the tree. Categories are stored as elements in the system and they are displayed to
other administrators as well.
What’s Next?
 Selecting Categories for Elements
Related Tasks
 Activating Categories (page 73)
72 Chapter 6 Managing Elements

Selecting Categories for Elements
You can select one or more Categories for all types of elements. If you have activated a
Category filter, all elements you create are by default added in the currently selected Categories,
but you can override this selection.
If you want to only view existing elements that are not categorized yet, select the Not
Categorized item in the Category Filter Toolbar. See Activating Categories (page 73) for more
information.
 To select categories for an element

1. Click Categories in the properties of a new or an existing element. The Category Selection
dialog for the element opens.
Illustration 6.1 Category Selection Dialog
2. Add or remove Categories as needed.

3. Click OK.
Tip – Alternatively, right-click an existing element and select Add Category or Remove
CategoryRemove to open a dialog for adding or removing Categories.
Activating Categories
In most views, you can select Categories to restrict which elements are displayed. You can also
display the elements that do not belong to any Category by selecting the Not Categorized filter.
You can also select more than one Category at a time (see Filtering With Several Categories
(page 74)).
Note – The selected Category is applied in all views until you select a different Category or
deselect the Use Category Filter button.
 To activate a Category
1. If the Category selection is not visible in the toolbar, select ViewLayoutCategory Filter
Toolbar from the menu. The Category selection appears in the toolbar.
Using Categories 73
Illustration 6.2 Category Filter Toolbar
Select a Category.
Combine Activate Category selection

Categories. to view only elements that
belong to the Category.
2. Select one of the existing Categories.

3. Click the Use Category Filter button to the right of the Category selection. Only the
elements that belong to the selected Category are displayed.
To display all the elements again, deselect the Use Category Filter button.
Filtering With Several Categories

You can select more than one Category at a time to display elements that are in any of the
selected Categories.
 To create combined filters

1. Click the Filter button in the Category Filter toolbar. The Category Filter dialog opens.
Illustration 6.3 Category Filter Selection
2. Select the Categories you want to add (shift-click or Ctrl-click to select multiple Categories)
and click Add. The selected Categories are added to the list of Selected Categories.
3. (Optional) If you want to view elements that do not have a Category (they belong to the Not
Categorized Category), select Show Not Categorized.
4. (Optional) If you want to view elements that are default elements in the system (they belong
to the System Category) select Show System Elements.

5. Click OK. The combined list of Categories is displayed as the current Category Filter in the
Category selection.
6. Click the Use Category Filter button in the toolbar. Only the elements assigned to the
selected categories are displayed.
Related Tasks
 Creating New Categories (page 72)
 Activating Categories (page 73)
Importing, Exporting and Restoring Elements

Prerequisites: None
You can import and export most kinds of elements. This allows you to use the same elements in
a different system without having to create the elements again.
You can also import old versions of elements or deleted elements, by restoring them from a
Policy Snapshot.
What’s Next?
 Exporting Elements (page 75)
 Importing Elements (page 76)
 Restoring Elements from Policy Snapshots (page 78)
Related Tasks
 Importing Users from an LDIF File (page 644)
 Exporting Users to an LDIF File (page 645)
Exporting Elements
This section explains how to export elements using the Management Client. For command line
exporting, see the command SgExport in Command Line Tools (page 917). For PDF or HTML
output, see Saving as PDF or HTML (page 50).
Note – The exported file is meant for importing elements into the database of a
Management Server. It is not meant to be viewed or edited in external applications.
 To export elements based on selection

1. Launch the element export:
• To export a selection of elements, select FileExportExport Elements. The Export
dialog opens.
• To export all elements from within the administrative Domain that you are currently logged
into, select FileSystem ToolsExport All Elements. When you select this option,
there will be a delay before the Export dialog opens with all elements pre-selected.
Importing, Exporting and Restoring Elements 75

Illustration 6.4 Export Dialog
Element type
2. Enter a file name for the export file, or click Browse to select the location where you want
to create the file.
3. Select the type of element(s) you want to export.
• You can export most but not all kinds of elements. The elements that you cannot export
are elements that contain particularly sensitive information (for example, administrator
accounts and certificates). To import an element that refers to an element that cannot be
exported, you must manually create before the import a corresponding element using the
same name as for the original referenced element. Otherwise, the import fails.
4. Add element(s) you want to export to the Content list on the right or remove elements you
do not want to export by selecting the elements and clicking Add or Remove.
5. When you have finished adding elements to the Content list, click Export. A new tab opens
to show the progress of the export.
Importing Elements
This section explains how to import elements using the Management Client. For command line
importing, see the command sgImport in Command Line Tools (page 917).
 To import elements
1. Select FileImportImport Elements. The Import File dialog opens.
2. Select the file(s) you want to import and click Import. StoneGate automatically checks if
any elements in the file to be imported already exist in the system. A new tab opens.

Illustration 6.5 Import Elements View - Example with Element Conflict
3. If the file to be imported contains elements that already exist in the system, resolve the
element Conflicts by selecting the Action:
• Do Not Import: the element is not imported.
• Import: the element that already exists in the system is overwritten with the element in
the import file.
• Rename: the element in the import file is imported as a new element in the system and
renamed.
4. If the file to be imported contains New Elements, which do not conflict with the existing
elements, select the Action:
• Do Not Import: the element is not imported.
• Import: the element that already exists in the system is overwritten with the element in
the import file.
5. For Identical Elements that conflict with existing elements, but do not cause changes, the
Do Not Import option is automatically selected.
6. If there are no similar elements in the system or when you have selected the Action for
conflicting elements, click Continue to start the import.
Importing, Exporting and Restoring Elements 77

Restoring Elements from Policy Snapshots
Prerequisites: None
This section explains how to restore elements from Policy Snapshots using the Management
Client. You can either restore all elements of a snapshot, or select the elements to be restored.
 To restore all elements of a Policy Snapshot

1. Select ConfigurationConfigurationFirewall or ConfigurationConfigurationIPS
from the main menu. The Firewall Policies or IPS Policies tab opens.
2. Browse to Other ElementsPolicy Snapshots. The list of Policy Snapshots opens.
3. Right-click the Policy Snapshot you want to restore and select Restore. The restoring of the
elements starts.
4. If there are conflicts during the restoring process, resolve them by selecting the Action:
• Do Not Import: The element is not imported.
• Overwrite: The element that already exists in the system is overwritten with the element
in the import file.
• Rename: The element in the import file is imported as a new element in the system and
renamed.
5. Click OK.
 To restore selected elements of a Policy Snapshot

from the main menu. The Firewall Policies or IPS Policies tab opens.
2. Browse to Other ElementsPolicy Snapshots. The list of policy snapshots opens.
3. Right-click the policy snapshot from which you want to restore elements, and select
Preview Policy Snapshot. A preview of the Policy Snapshot opens.
4. Select one or several snapshot elements to restore, right-click and select Restore. The
restoring of the element(s) starts.
5. If there are conflicts during the restoring process, resolve them by selecting the Action:
• Do Not Import: The element is not imported.
• Overwrite: The element that already exists in the system is overwritten with the element
in the import file.
• Rename: The element in the import file is imported as a new element in the system and
renamed.
6. Click OK.

Locking and Unlocking Elements
Prerequisites: None
An administrator who is allowed to edit an element can lock the element and add a comment to
it to explain the reason for locking it. Locked elements are displayed with a lock symbol. A
locked element must be unlocked before it can be modified or deleted. Any administrator who is
allowed to edit the locked element can remove the lock. All custom elements for which History
data is provided in the Info panel can be locked. You cannot lock default system elements.
 To lock an element
1. Right-click the element you want to lock in the Firewall, IPS, or Administration Configuration
view and select ToolsLock. The Lock Properties dialog opens.
2. Type a comment explaining the reason for locking the element in the Comment field.
3. Click OK. The element is now locked and a lock symbol is displayed on its icon.
 To unlock an element
1. Right-click the element you want to unlock in the Firewall, IPS, or Administration
Configuration view and select ToolsUnlock.
2. Click Yes in the dialog that opens to confirm the deletion of the lock.
Deleting Elements
Prerequisites: None
An element can only be deleted by administrators who have sufficient privileges, and if the
element is not used in any configuration, for example, in a policy.
Caution – Deletion is permanent. There is no undo. To recover a deleted element, you must
either recreate it, or restore it from a previously created backup or XML export file that
contains the element.
 To delete an element
1. Right-click the element and select Delete. A confirmation dialog opens.
• If the element you are trying to delete is currently used in any configuration, the
confirmation dialog also shows a list of all references to the element. Click Open
References to open a list of the elements in the Search view. To remove the references,
edit each element by right-clicking the element and selecting Edit.
• If you are deleting the account of an administrator who has modified elements in the
Management Center, you get a warning message. If you delete the administrator account,
all the history information on the changes the administrator has made is lost. If you do
not want to lose the history information, click Disable to disable the account.
2. Click Yes. The element is permanently deleted from the system.
Related Tasks
 Searching for Element References (page 46)
 Deleting Administrator Accounts (page 227)
 Deleting Domains (page 250)
Locking and Unlocking Elements 79

M ONITORING
In this section:
Monitoring the System - 83
Monitoring Third-Party Devices - 111
Browsing Logged Data - 127
Reports - 145
Filtering Data - 159
Diagrams - 167
Incident Cases - 177
81
82
C H A P TE R 7
MONITORING THE SYSTEM
All StoneGate system components can be monitored through the StoneGate Management
Client.
Getting Started with System Monitoring (page 84)

Monitoring the System Status (page 84)
Creating Overviews (page 92)
Monitoring Open Connections and Blacklists (page 97)
Monitoring Connections on a Map (page 103)
Monitoring Configurations and Policies (page 105)
Monitoring Administrator Actions (page 105)
Monitoring Task Execution (page 106)
Checking Maintenance Contract Information (page 107)
Checking When Internal Certificates or Internal CAs Expire (page 108)
83
Getting Started with System Monitoring
Prerequisites: None
There are several ways to monitor the system in the Management Client. You can:
• Monitor the status of individual components and view a summary of the system status. See
Monitoring the System Status (page 84).
• Create customizable charts of the system. See Creating Overviews (page 92).
• Monitor open connections and blacklisted connections. See Monitoring Open Connections
and Blacklists (page 97).
• View connection information on a map. See Monitoring Connections on a Map (page 103).
• Check which configurations and policies are currently applied in the system. See Monitoring
Configurations and Policies (page 105).
• Check which actions administrators take. See Monitoring Administrator Actions (page 105).
• Check the status of Tasks (for example, upgrade tasks). See Monitoring Task Execution
(page 106).
• Monitor the status of the StoneGate maintenance contract. Checking Maintenance Contract
Information (page 107).
• Monitor the status of internal certificates and internal certificate authorities. See Checking
When Internal Certificates or Internal CAs Expire (page 108).
Related Tasks
 Getting Started with Reports (page 146)
Monitoring the System Status

Prerequisites: None
The Management Server automatically keeps track of the operation of the StoneGate
components that belong to the system. You can check the status of the system and the
individual components in the System Status view.
You can also monitor the status of third party devices in the Management Client. See Creating a
Probing Profile (page 121) for more information.
There are several ways to open the System Status view. For example:
• Select MonitoringSystem Status from the menu or click the corresponding toolbar icon.
• Right-click an element that is monitored (a Firewall/VPN or IPS engine element, a Geolocation
element, a Multi-Link element, Server element, or an SSL VPN Gateway element), and select
System Status from the menu that opens.
What’s Next?
 For an overview of the System Status View, start in Default Arrangement of System
Status View.
84 Chapter 7 Monitoring the System

Default Arrangement of System Status View
When you open the System Status view, you can see the monitored elements in the Status tree
with icons indicating their status. The System Summary gives more detailed status information.
The statuses are constantly updated, so you can quickly check which components in your
system may need your attention at any given time. Additionally, whenever a cluster becomes
inoperative, an alert is sent.
For information on the different statuses, see Reading Component Statuses (page 88).
Illustration 7.1 System Status View - Default Arrangement
System
Summary
Status tree for

elements that
can be monitored
Info Panel (empty

if no element is
selected in Status
Location for
tree)
monitoring
the system
To check the status of a component in the Status tree, expand the tree and place the mouse
pointer over any element shown to see its IP address and status as text in a tooltip.
Monitoring the System Status 85

System Summary
The System Summary provides an overview to the operating status of monitored components
and displays if alerts are active in the system. You can view it in the System Status view or
insert it as a tile in your own custom monitoring views (Overviews). Double-click the status
information to see further details.
Illustration 7.2 System Summary in the System Status View
Viewing System Status for a Selected Element

When you select an element in the Status tree, the System Status view automatically shows the
status of the element as a Connectivity Diagram (this is controlled by option ViewDraw
Diagram on Selection in the main menu). The Info Panel also shows detailed information on the
selected element.
When the ViewFilter Diagram Content option is selected (default value), you see the
selected elements and their related connections in the automatically generated diagram.
Otherwise, all system elements and connections are shown.
Illustration 7.3 System Status Information for Selected Element
Element status as a
connectivity diagram
Detailed
information for
selected element

Info Panel
The Info panel shows detailed information on the component that you select. For example, the
Interfaces tab shows information on the network ports of the selected engine (such as speed/
duplex). The Appliance Status tab shows the hardware status information of the selected
device. The Info Panel display is controlled through ViewInfo in the main menu.
Illustration 7.4 Node Status in the Info Panel
Commands for Monitoring Components

Actions for monitoring a selected component are available in the Monitoring submenu that
opens when you right-click an element that represents a monitored component. The available
actions depend on the component type.
Illustration 7.5 Monitoring Menu for Components - Firewall/VPN Engine

View component status.
View log data for component.
View currently open connections
(firewalls only).
Create/view detailed Overview
or Third Party Overview.
Select Overview Template.

Monitoring Tools in the Main Menu
All the main actions for monitoring the system are available in the Monitoring menu.
Illustration 7.6 Monitoring Menu
Browse logs and alerts.

View the status of system
Select the Overview to be components.
shown/new Overview.
View the currently active
Create and/or view Reports. connections.
View the currently active View the summarized status
blacklist entries. of all Domains that you are
allowed to view.
Related Tasks
 Reading Component Statuses (page 88)
 Creating Overviews (page 92)
 Getting Started with Reports (page 146)
 Monitoring Open Connections and Blacklists (page 97)
 Using the Domain Overview (page 252)
Reading Component Statuses

The operating status of the system components and monitored third-party components is
indicated by colors in most views where the elements are displayed. Also the status of various
system communications is shown in colors in monitoring diagrams and in the Info panel.
Hardware malfunction is indicated with special icons (with exclamation mark) in the System
Status tree. If there are any problems indicated, always check the logs and alerts created by the
system to get a thorough view on what may be causing the problems.
The status colors are explained in the tables below:
• Engine Hardware Malfunction Icons (page 89)
• Replication Malfunction Icon (page 89)
• Element Status Colors (page 89)
• Node Status Colors (page 90)
• NetLink Status Colors (page 90)
• VPN Status Colors (page 91)
• Connectivity Status Colors (page 91)

Engine Hardware Malfunction Icons
Engine hardware malfunction is indicated with a special icon on top of the affected engine’s icon
in the Status tree and on all the parent branches in the Status tree. For more information on the
hardware malfunction, select the engine in the Status tree and switch to the Appliance Status
tab in the Info Panel.
Table 7.1 Hardware Malfunction Icons
Hardware
Icon Status Description
Exclamation mark A pre-defined Warning level has been reached in hardware

on a yellow triangle Warning monitoring (for example, the remaining file system capacity is
less than 15%). The system also generates a log entry.
Exclamation mark
A pre-defined Alert level has been reached in hardware monitoring
on a red circle Alert (for example, the remaining file system capacity is less than 5%).
The system also generates an alert entry.
Replication Malfunction Icon

If the replication of configuration data from the primary Management Server to a secondary
Management Server has failed, an icon that shows an exclamation mark on a yellow triangle is
displayed on top of the secondary Management Server’s icon in the Status tree.
Element Status Colors

The element-level status gives an overview to the status of all engine nodes that are
represented by the element (note that this is shown also for single-node components).
Table 7.2 Element-Level Status
Element
Color Status Description
Green All OK All nodes have a normal status (online or standby).
Some of the nodes have an abnormal status or have been commanded

Yellow Warning offline by administrator command, but are still sending status updates
normally.
All of the nodes have an abnormal status, there is one or more nodes that
Red Alert have not sent expected status updates, or all nodes have been
commanded offline.
Unknown
Grey No policy has been installed on any of the nodes in the cluster.
status
Not
White An administrator has set all nodes not to be monitored.
monitored

Node Status Colors
The node status gives more detailed information on individual engines.
Table 7.3 Node-Level Status
Color Node Status Description

Green Node or server online The node or server is online and processing traffic.
The node is locked online to prevent automatic status

Green
Locked online transitions. The node will not change state unless commanded
(with slot)
by an administrator.
Used with clustered engines when the cluster is in Standby

mode. The node is in standby mode. One of the standby nodes
Cyan Standby mode
goes online when the previous online node goes to a state in
which it does not process traffic.
Blue Node offline The node is offline and does not process traffic.
The node is locked offline to prevent automatic status

Blue
Locked offline transitions. The node will not change state unless commanded
(with slot)
by an administrator.
Timeout or unknown
Grey The Management Server does not know the status of the node.
status
White Not monitored An administrator has set the node not to be monitored.
NetLink Status Colors

NetLink status shows the status of the network links in a Multi-Link configuration.
Note – The status is probed and displayed only if Probing Settings are configured in the
NetLink elements and if the Outbound Multi-Link element is included in the engine’s
configuration (outbound balancing NAT rule is included in the policy).
Table 7.4 NetLink Status Icons
Color NetLink Status Description

Green OK The NetLink is up.
The Management Server does not know the status of the

Grey Unknown status
NetLink.
White Not monitored An administrator has set the NetLink not to be monitored.

VPN Status Colors
The VPN status shows the health of the VPN tunnels.
Table 7.5 VPN Status
Color Cluster Status Description

All tunnels have a normal status (online or standby) and there is
Green Tunnels up
traffic.
Some error has been detected, at least for some traffic, but the
Yellow Warning tunnels are usable in principle, and some other traffic may be
getting through.
Red Error Some or all tunnels are down.
The tunnels are valid, but there has not been traffic going through
Blue Idle
them in a while.
The VPN has no valid tunnels, because the VPN configuration is not
White Not configured
complete or does not allow any valid tunnels.
Connectivity Status Colors

Element diagrams and the Connectivity tab in the Info panel shows the current status of the
connectivity between system elements. See the tooltip for the status color for more details.
Table 7.6 Connectivity Status
Color Status Explanation

The connection is active (there have been communications within the last 2
Green OK
minutes) and no problems have been reported.
The Management Server has received a report that connection attempts

Red Error
have failed.
Connection between components is still open, but there is a pause in

Cyan Idle
communications.
There are problems with heartbeat or state synchronization between nodes

in a firewall cluster. Only one of the interfaces used for heartbeat or state
Yellow Warning
synchronization is functioning properly. This does not affect how the cluster
functions.
Blue Closed The connection was closed by one of the components.
Timeout, The Management Server does not know the status of the connection. The
Grey
Unknown connection may or may not be working.

Creating Overviews
Prerequisites: None
Customizable Overviews can contain information on the system’s status, shortcuts to views you
use often (such as logs filtered with specific criteria) and statistical charts on the system’s
operation (such as engine load), and the traffic flow.
You can create new Overviews on an empty template or start your customization based on one
of the default Overview templates in the system.
Illustration 7.7 Example Overview with System Summary and Statistics
Overviews icon
View-specific toolbar
Note that you can set your favorite overview to open whenever you log in by setting it as your
startup view (see Changing the Startup View (page 44)).
What’s Next?
 Creating a New Overview (page 93)
Related Tasks
 Adding a New System Summary Section to an Overview (page 93)
 Adding a New Statistics Section to an Overview (page 93)

Creating a New Overview
 To create an Overview
1. Select MonitoringOverviews from the menu.
2. Right-click Overview and select New Overview. The Overview Properties dialog opens.
3. Select your preferred Overview template:
• If you want to add your own Overview sections to an empty grid, select Empty Overview
and click OK.
• To use one of the predefined Overview templates, select the template from the list and
click OK. The selected Overview template opens.
What’s Next?
 To add a summary of the system status to the Overview, see Adding a New System
Summary Section to an Overview (page 93).
 To add statistics to the Overview, see Adding a New Statistics Section to an Overview
(page 93).
Adding a New System Summary Section to an Overview

The system summary is shown in the default start view (see System Summary (page 86)), but
you can also add it to your own Overviews.
 To create a new System Summary Section

1. Open the Overview to which you want to add a new System Summary Section.
2. Click the New icon in the view-specific toolbar and select System Summary Section. A new
System Summary Section is added to the Overview.
3. (Optional) Adjust the placement and size of the new section by dragging and dropping the
section or its edges. Note that resizing is based on preset grid positions and you must drag
the edge until it snaps to the next position on screen for the resize to work.
It is possible to add more than one system summary into the same overview, but the
information displayed is always the same.
What’s Next?
 If you want to add statistics to the overview, see Adding a New Statistics Section to an
Overview (page 93).
 If you have finished working on your Overview, click the Save icon or select FileSave
as to save the modified Overview under a different name.
Adding a New Statistics Section to an Overview

 To create a new Statistics Section
1. Open the Overview to which you want to add a new Statistics Section.
2. Click the New icon in the view-specific toolbar and select Statistics Section.
3. The No Item window (with text ‘Select item for section’) is added to the Overview. The
Section Properties panel opens to the right.
Creating Overviews 93
4. Define the basic Section properties as explained in the table below:
Option Explanation
Comment
A comment for your own reference.
(Optional)
Produces a chart and/or a table that shows the progress of items as

Progress
time passes.
Produces a chart and/or a table highlighting the values with the

Statistics Type Top Rate
highest number of occurrences.
Summary
Produces a table with all the values from items included in the report.
Table
Select the Diagram Type by clicking the appropriate diagram icon (Bar,
Pie, Curve, or Map).
The available diagram types depend on the type of statistics you
Diagram Type
selected.
The Summary Table type statistics are always displayed as a table, so
this option is disabled for that Diagram Type.
Top Limit
(Only if Statistics Type is Defines the (maximum) number of sources shown in the chart.
Progress or Top Rate)
Period Defines the time scale for the display of information.
If selected, a separate graph is shown for each separate sender.

Graph per Sender
Otherwise, the graph shows a single combined graph with the average
(Optional)
data from all the senders.
Allows you to define a limit for automatic tracking of monitored items.

Alert Threshold
See Setting Thresholds for Monitored Items (page 96).
5. Click Add to add an Item to the Overview. The Select Element dialog opens.
6. Select the items. See Selecting Statistical Items (page 95) for detailed information.
7. (Optional) Switch to the Senders tab and select which elements are shown in the Overview.
8. (Optional) Adjust the placement and size of the new section by dragging and dropping the
section or its edges. Note that resizing is based on preset grid positions and you must drag
the edge until it snaps to the next position on screen for the resize to work.
You can add further statistics sections in the same way.
What’s Next?

Selecting Statistical Items
Statistics process and visualize data. They help you to focus on the most relevant information
on the system (for example, notable quantities and trends in network traffic) and also to find
changes and anomalies in network traffic. You can use statistics in Overviews and Reports, and
also when you browse Logs or Connections. Filters are available to help you find information.
Statistical items count log entries (referred to as records in the item names), summaries of
some log field included in those entries (like traffic volumes in log data that contains accounting
information), or specifically gathered statistical data (counter items). The items are organized
based on the component types, since the log data they produce is different.
Table 7.7 Statistical Item Selection
Option Explanation
Log Data Items that use log data.
Information
Items that use pre-counted statistical data. Data older than an
Source (Not Counter Statistics
hour is consolidated to an accuracy of one hour.
available in
Overviews) System Current
Items that collect information on the system’s operating state.
State
Available if Log Data is the Information Source. Items that filter

Log Data Types
by different type(s) of log data and components that send data.
Any Items that belong to any Context.
Recommended The most common statistical items.
Access Items related to log data generated by Firewall Access rules.
Items related to log data generated by Inspection rules. The

Inspection more limited inspection protocols on the firewall mean that
many items can never find data in the firewall log data.
Items that count traffic volumes. These items do not have any
Traffic Volumes data to process unless your Access rules are set to include
Context accounting information in the log entries generated
VPN Items related to VPNs.
Audit (Not
available in Items related to audit log data.
Overviews)
Available if System Current State is selected as Information

Source. Items that collect information about the StoneGate
Other
system (run the default System report to see the information
these items produce in log data).
Ranking The basis for ordering the items in the summary.
The value that is counted for a specific period in a curve chart

Count or per sector in a pie chart (for example, the number of
connections or bytes).
Creating Overviews 95
Table 7.7 Statistical Item Selection (Continued)
Option Explanation
Allows you to look for a specific item. Enter the name of the
Search item or a part of it to limit the selection of displayed items. You
can use wildcards (for example, *).
Item Available items that match the settings that you have selected.
Setting Thresholds for Monitored Items

Thresholds activate automatic tracking of monitored items in Overviews. The values of the
monitored items are checked once an hour.
For Progress items, the total of the values is compared to the threshold limit. The threshold is
considered exceeded if the average level of the curve is above the threshold limit during the
tracking period.
For Top Rate and Top Rate Curve items, the highest value is compared to the threshold limit.
The threshold is considered exceeded if the highest value is above the threshold limit during the
tracking period. If the threshold limit is exceeded, an alert is sent.
 To set a threshold for a monitored item

1. Select the Overview section for which you want to set a threshold. The Section Properties of
the selected section are displayed.
Threshold line
2. Select Enable alert threshold.

3. Specify the threshold limit in one of the following ways:
• Drag and drop the threshold line in the overview section.
• Enter the Limit as a number in the Section Properties panel.
4. (Optional) Select the tracking period during which monitored items are compared to the
threshold limit from the For list. By default, 1 hour is selected.

5. (Optional) Select the Severity of the alert that is sent when the threshold limit is exceeded.
By default, Low is selected.
What’s Next?
Monitoring Open Connections and Blacklists

Prerequisites: None
Firewalls keep track of allowed connections. You can monitor the open connections in the
Monitoring view. The firewalls and sensors also keep track of combinations of IP addresses,
ports, and protocols that are currently included on the blacklist of the firewall and sensor
engines. You can monitor the blacklisted connections in the Blacklist view.
You can monitor connections and blacklists in the following ways:
• You can view the currently open connections and the enforced blacklist entries. See Checking
Open Connections and Blacklists (page 97).
• You can save snapshots of currently open connections and blacklists. See Saving Blacklist
and Connections Snapshots (page 99).
• You can compare two connections or blacklist snapshots or the current status of connections
or blacklist entries with a connections or blacklist snapshot. See Comparing Blacklist and
Connections Snapshots (page 101).
Checking Open Connections and Blacklists

The Connections view and the Blacklist view show you the currently active connections and the
current blacklist entries. The list of connections and blacklist entries are automatically updated
in the Current Events mode. The blacklist entries are added and removed according to their
lifetime.
The Blacklist view does not show whether connections matching the entries are actually blocked
by the firewall or the sensor, nor can you see any history of entries that have already expired.
Use the Logs view to see information on actual connections that are allowed and denied, as well
as logs on past blacklist entry creation (depending on logging options selected in the policy. See
Getting Started with the Logs View (page 128).
 To check open connections or blacklists

1. Select MonitoringConnections or MonitoringBlacklist from the menu. The Select
Element dialog opens.
2. Select the firewall engine for which you want to view the connections or the firewall or
sensor for which you want to view the blacklist, and click Select. The Connections view or
the Blacklist view opens.
Monitoring Open Connections and Blacklists 97

Illustration 7.8 Toolbar and Query Panel in Connections View and Blacklist View
View currently open or blacklisted Filter data or open/compare

connections, pause view updates, snapshots
save a snapshot, or view statistics
There are many ways to browse the data:

• You can adjust the view and the displayed data in a similar way as in the Logs view. See
Browsing Log Data (page 133).
• To combine entries based on entries that have the same value for a given column type, right-
click the heading of the corresponding column and select Aggregate by <column name>.
Repeat the action if you want to aggregate entries according to other column types.
• To view data as charts, click the Statistics button in the toolbar, and select one of the pre-
defined statistical items, or select Custom to select the item(s) from a longer list of available
items. See Selecting Statistical Items (page 95).
• Select one or more entries in the table (Shift-select or Ctrl-select for more than one item) and
right-click for a menu of actions you can take. For example:
• To view more information on related log events, right-click and select Show Referenced
Events.
• To blacklist connection(s) manually, right-click and select New BlacklistEntry or New
Entry. See Blacklisting Connections Manually (page 198).
• To terminate a connection in the Connections view, right-click and select Terminate.
• To remove a blacklist entry in the Blacklist view, right-click and select Remove.
Related Tasks
 Saving Blacklist and Connections Snapshots (page 99)
 Comparing Blacklist and Connections Snapshots (page 101)
 Getting Started with Blacklisting (page 678)

Saving Blacklist and Connections Snapshots
You can save snapshots of open connections in the Connections view and snapshots of
blacklist entries in the Blacklist view. The saved snapshots are listed in the following branches
in the Monitoring view:
• Other ElementsBlacklist SnapshotsLog Server
• Other ElementsConnections SnapshotsLog Server
• Other ElementsConnections SnapshotsManagement Server (snapshots saved for
firewall engine version 5.1 or earlier).
The blacklist snapshots are stored in the <installation directory>/data/storage/
snapshots/blacklist directory on the Log Server. The connections snapshots are stored in
the <installation directory>/data/storage/snapshots/connections directory either on
the Log Server (firewall engines 5.2 or higher) or on the Management Server (all earlier firewall
engine versions).
 To save a blacklist or connections snapshot

1. Select MonitoringConnections or MonitoringBlacklist from the menu. The
Connections view or the Blacklist view opens.
2. Click the Pause icon in the toolbar to select the entries for the snapshot.
• When you click Pause, the system automatically creates a temporary snapshot of the
currently displayed entries. The name of the temporary snapshot is displayed on the
Snapshots tab in the Query panel. The temporary snapshot is automatically deleted a few
hours later.
3. Click the Save icon in the toolbar to store the snapshot for later use. The Snapshot
Properties dialog opens.
4. Enter a Name for the snapshot and click OK. The name of the snapshot is displayed on the
Snapshots tab in the Query panel.
Related Tasks
 Exporting Blacklist and Connections Snapshots (page 100)
 Opening Blacklist and Connections Snapshots (page 100)

Exporting Blacklist and Connections Snapshots
You can use the Export action in the Monitoring view to save stored snapshots elsewhere (for
example, on a local machine). The saved snapshots are listed in the following branches in the
Monitoring view:
 To export snapshots
1. Select ConfigurationConfigurationMonitoring from the menu. The Monitoring view
opens.
2. Browse to the correct branch in the Monitoring tree.
3. Right-click a snapshot and select Export from the menu that opens.
4. Select the location for saving the snapshot and click Select.
Related Tasks
Opening Blacklist and Connections Snapshots

The blacklist snapshots and the connections snapshots that you have saved on the Log Server
or on the Management Server are listed in the following branches in the Monitoring view:
 To open a snapshot stored on the Log Server or the Management Server

opens.
2. Browse to the correct branch in the Monitoring tree.
3. Right-click a snapshot and select Open. The snapshot opens for viewing.
 To open a snapshot from your own workstation

opens.
2. Expand the Other Elements tree.
3. Right-click Blacklist Snapshots or Connections Snapshots, and select Open Local
Snapshot. The Select Snapshot File dialog opens.
4. Select the snapshot and click Open. The snapshot opens for viewing.
Related Tasks

Comparing Blacklist and Connections Snapshots
You can compare a blacklist or connections snapshot with another snapshot of the same type.
You can also compare a snapshot with the current blacklist or connections entries.
The saved snapshots are listed in the following branches in the Monitoring view:
• Other ElementsConnections SnapshotsManagement Server (if the snapshot was
saved for firewall engine version 5.1 or earlier).
 To compare snapshots
1. Open the Blacklist view or the Connections view as explained in Monitoring Open
Connections and Blacklists (page 97).
2. Switch to the Snapshots tab in the Query panel.
Illustration 7.9 Snapshots Tab in Query Panel
3
4 Snapshot 1
5
Snapshot 2
3. Select the first snapshot for comparison:

• If you want to compare the current entries with a snapshot, make sure that the view is in
the Current Events mode and that Current is displayed in the first snapshot selection
field.
• If you want to compare a temporary snapshot of the current entries with a saved
snapshot, click Pause in the toolbar to create a temporary snapshot. The name of the
temporary snapshot is displayed in the first snapshot selection field.
• Otherwise, click Select next to the upper snapshot selection field and browse to the
correct branch to choose the first snapshot for comparison.
4. Select Compare with to enable comparing snapshots.
5. Click Select next to the lower snapshot selection field and browse to the correct branch to
choose the second snapshot for comparison.
• You can use drag and drop to change the order of the snapshots in the comparison.
6. Click Apply to start the comparison. The results of the comparison are highlighted in the
list of entries.

Illustration 7.10 Snapshot Comparison Results between Snapshot 1 and 2
Entry only exists in

snapshot 2
Entry is included in both

snapshots
Entry only exists in

snapshot 1
Illustration 7.11 Example of Snapshot Comparison with Aggregated Entries - Aggregated by Service
Entries that match the Aggregation

Aggregate by <column Criterion
name> selection are
included in both
snapshots but the entries
are otherwise different.
(No icon) There are more than 100 entries that match the Aggregate by <column name>
selection in the snapshots. No further comparison can be done.
You can alternatively open a snapshot for comparison directly in the Monitoring view by right-
clicking the selected snapshot(s) and selecting Compare to Current or Compare from the menu
that opens. The more recent of the selected snapshots is used as the starting point for the
comparison.
Related Tasks
 Browsing Log Data (page 133)

Monitoring Connections on a Map
Prerequisites: None
With Geolocations you can see on the world map where Hosts (for example, attackers) are
located and see how much traffic they create.
The location information for public IP addresses is displayed based on the internal Geolocation
database on the Management Server. The database is updated when the Management Server is
updated.
Geolocation maps are available in Reports, Statistics, Overviews, and in the System Status view
for monitoring the status of the Geolocation elements. In the System Status view Geolocations
are listed on the Status tree (System StatusGeolocations). A Geolocation is shown in the
Status tree only if the Geolocation has been set for any element.
With the Show in Google Maps option, it is possible to see the actual location from the map in
more detail in Google Maps. The Show in Google Maps option can be used in the Fields pane
of the Logs View, in Geolocation maps, and in the Whois result window.
Illustration 7.12 Geolocations
You can also define Geolocations for your private networks. The internal IP addresses have to be
configured manually, because the public IP database does not know them. For instructions on
how to define a new Geolocation, see Defining a New Geolocation (page 104).
Monitoring Connections on a Map 103

Defining a New Geolocation
 To define a new Geolocation
2. Expand Other Elements.
3. Right-click Geolocations and select New Geolocation. The Geolocation Properties dialog
opens.
Illustration 7.13 Geolocation Properties - General
4. Enter the Name and Address information for the Geolocation.

5. Define the Coordinates in one of the following ways:
• Click Resolve from Address to automatically resolve the Geolocation coordinates.
• Enter the Latitude and Longitude in Decimal Degrees format (for example, latitude
49.5000° and longitude -123.5000°).
6. Switch to the Content tab to define which elements belong to the Geolocation.
Illustration 7.14 Geolocation Properties - Content
7. Select Elements from the Resources list and click Add.

8. Click OK to save the Geolocation.

Setting a Geolocation for an Element in the System Status View
 To set a Geolocation for an element in System Status view
1. Open the System Status view and select the element for which you want to set a
Geolocation.
2. Right-click the element and select ToolsSet Geolocation. The Select Geolocation dialog
opens.
3. If the Geolocation has not been defined yet, define it as described in Defining a New
Geolocation (page 104).
4. Select the Geolocation and click Select.
Related Tasks
 Getting Started with System Monitoring (page 84)
Monitoring Configurations and Policies

Prerequisites: None
The engines receive their configuration in a policy installation. You can monitor the policies and
configurations installed on the engines in the following ways:
• You can check which policy is currently being enforced and when it was last installed as
explained in Checking the Currently Installed Policy (page 504).
• You can quickly view the most recent version of the installed policy as explained in Previewing
the Currently Installed Policy (page 504).
• You can view the configurations that were transferred in each past policy installation and
compare them to each other or the current policy stored on the Management Server, as
explained in Checking and Comparing Policy Versions (page 504).
• You can quickly check if there are changes in the configurations on the Management Server
that have not been transferred yet as explained in Checking for Untransferred Configuration
Changes (page 506).
Related Tasks
 Creating and Managing Policy Elements (page 497).
Monitoring Administrator Actions

Prerequisites: None
A record of administrator actions is maintained in the system. The records can only be viewed by
administrators who are allowed to view Audit logs. They can be browsed like any other logs in
the Logs view. Audit logs are not available for SOHO firewalls.
 To view audit records

1. Select FileSystem ToolsAudit from the main menu. The log browser opens with the
Audit logs selected for viewing.
2. Browse and filter the logs as explained in section Browsing Logged Data (page 127).
Monitoring Configurations and Policies 105

Monitoring Task Execution
Prerequisites: Creating New Task Definitions, Scheduling Tasks, Starting Tasks Manually
You can check the status of running tasks and executed tasks (for example, upgrade tasks and
system tasks) in the Tasks branch in the Administration view.
 To check Task status

2. Browse to TasksRunning Tasks or TasksExecuted Tasks. The list of tasks opens.
3. Check the details of the Task in the right panel. The following columns may be of the most
interest:
• The Progress column shows the progress of a running Task.
• The Info column shows additional details about the execution of a Task.
• The State column shows the status of the Task. The table below explains the different
Task states.
Table 7.8 Task States
Task State Explanation
Running Created The Task process was created, but has not started running yet.
Task Started The Task has started running.
Aborted The Task was commanded to stop and stopped correctly.
Failed An error caused the Task to stop.
Finished The Task was completed successfully.

Executed
Task Part of the Task was completed successfully, but other parts had errors.
Partial This can occur, for example, when a Task has many sub-tasks and some of
the sub-tasks fail.
The Task stopped because it did not complete before the end of the time
Timeout
limit.
Related Tasks
 Stopping Task Execution (page 822)

Checking Maintenance Contract Information
Prerequisites: None
You can view maintenance contract and support level information for your licenses in the
Management Client by allowing your Management Server to contact Stonesoft servers. This
information is available for each license under the Licenses folder if the Management Server is
able to contact the Stonesoft servers. See:
• Enabling Automatic Maintenance Contract Checking (page 107)
• Viewing Maintenance Contract Information (page 107)
• Viewing Maintenance Contract Information for SOHO Firewalls (page 108)
• Fetching Maintenance Contract Information (page 108)
Enabling Automatic Maintenance Contract Checking

To enable viewing maintenance contract and support level information permanently for your
licenses, you need to allow the Management Server to connect to the Stonesoft servers in the
Automatic Updates and Upgrades dialog. See Getting Started with Automatic Updates and
Engine Upgrades (page 210).
Viewing Maintenance Contract Information

When contract checking is enabled, you can view information on your support contract in the
License table in the Management Client.
 To view maintenance contract information

1. Select ConfigurationConfigurationAdministration from the menu.
2. Expand the Licenses tree.
3. Select the license whose information you want to view under the Licenses folder. If the
information is not available in the Maintenance Contract Expires and Support Level
columns:
• Proceed to Fetching Maintenance Contract Information (page 108) to check the
information.
• Or if you want the information to be available permanently, proceed to Enabling Automatic
Maintenance Contract Checking (page 107).
Related Tasks
 Getting Started with Automatic Updates and Engine Upgrades (page 210)
 Viewing Maintenance Contract Information for SOHO Firewalls (page 108)
Checking Maintenance Contract Information 107

Viewing Maintenance Contract Information for SOHO Firewalls
When contract checking is enabled, you can view information on your SOHO firewall support
contract in the Management Client as follows.
 To view maintenance contract information for SOHO firewalls

1. Select ConfigurationConfigurationFirewall from the menu.
2. Select SOHO Firewalls.
3. See the information of the Maintenance Contract in the Maintenance Contract Expires
column of the SOHO firewall to be checked.
Fetching Maintenance Contract Information

If the contacting of Stonesoft’s servers is allowed, the SMC checks the maintenance contract
information for licenses automatically. See Getting Started with Automatic Updates and Engine
Upgrades (page 210). Otherwise, you can fetch the information manually.
 To manually fetch maintenance contract information for licenses

2. Click Licenses.
3. Right-click one of the folders under the Licenses folder and select Check Maintenance
Contract.
4. Click Yes in the confirmation dialog to permit connections from the Management Server to
the Stonesoft servers.
If the Management Server is able to connect to the Stonesoft servers, the Management Client
displays the maintenance contract and support level information for the licenses. The
information is available in the Management Client until the Management Server is restarted.
Checking When Internal Certificates or Internal CAs Expire

Prerequisites: None
You can check the status of internal certificates used in system communications and the status
of StoneGate’s Internal Certificate Authority that automatically signs the internal certificates.
The Internal Certificate Authority is valid for ten years. It is renewed automatically. StoneGate
does not accept certificates signed by an expired Internal Certificate Authority. All components
must receive new certificates signed by the new Internal Certificate Authority before the old
Internal Certificate Authority expires. By default, internal certificates are renewed automatically
for engines and internal gateways. For all other components, you must generate the certificates
manually. See Replacing Expired/Missing Certificates (page 870).
 To check when internal certificates or Internal Certificate Authorities expire

1. Select ConfigurationConfigurationAdministration from the menu to switch to the
Administration Configuration view.
2. Expand the Other ElementsInternal Certificates or the Other ElementsInternal
Certificate Authorities branch in the element tree. The existing internal certificates or
Internal Certificate Authorities are displayed in the other panel.

3. See the Expiration Date column for information on the certificate’s or the Internal
Certificate Authority’s expiration.
4. To view detailed information, right-click a certificate or Internal Certificate Authority and
select Properties. The Properties dialog for the certificate or the Internal Certificate
Authority opens.
The Properties dialog of an Internal Certificate Authority shows, among other information, the
Status of the Internal Certificate Authority:
• Active: All system components use certificates signed by this Internal Certificate Authority.
• Renewal Started: This is a new Internal Certificate Authority that the system has created
automatically. The process of renewing internal certificates for the system components has
begun.
• Expires Soon: A new Internal Certificate Authority has been created but some components
may still use certificates signed by this Internal Certificate Authority.
• Inactive: This Internal Certificate Authority has expired or no system component uses a
certificate signed by this Internal Certificate Authority.
Related Tasks
 Troubleshooting Certificates (page 867)
 Checking When Gateway Certificates Expire (page 765)
 Checking When an Internal VPN CA Expires (page 766)
Checking When Internal Certificates or Internal CAs Expire 109

C H A P TE R 8
MONITORING THIRD-PARTY DEVICES
The StoneGate Management Center can be configured to log and monitor other
manufacturers’ devices in much the same way as StoneGate system components are
monitored.
Getting Started with Third-Party Device Monitoring (page 112)

Receiving Logs From External Devices (page 113)
Monitoring the Status of Third-Party Devices (page 119)
Activating Monitoring of a Third-Party Device (page 123)
Configuring a Third-Party Device for Monitoring (page 124)
Changing the Ports for Third-Party Device Monitoring (page 124)
Activating/Deactivating Third-Party Status Monitoring Alerts (page 125)
111
Getting Started with Third-Party Device Monitoring
Prerequisites: None
What the Third-Party Device Monitoring Feature Does

You can configure Log Servers for a full range of monitoring features for third-party devices:
• Log Servers can receive a syslog stream and store the information in StoneGate format. The
stored logs can then be processed just like StoneGate-generated logs, for example, the data
can be included in reports you generate.
• Log Servers can receive SNMP statistics information from third-party devices. You can view
this information as part of your StoneGate Overviews.
• Log Servers can probe devices through several alternative methods. You can monitor the
device status in the Management Client in the same way as for the StoneGate components.
Limitations
Each Log Server can monitor a maximum of 200 third-party devices. This limit is enforced
automatically.
Statistics for third-party devices are limited to amount of free and used memory, CPU load, and
interface statistics.
Your Management Server license may limit the number of managed components. Each
monitored third-party device is counted as a fifth of a managed unit.
1. (Optional) Define syslog reception settings for each particular type of third-party device.
See Receiving Logs From External Devices (page 113).
2. (Optional) Define the status and statistics monitoring settings for each type of third-party
device. See Monitoring the Status of Third-Party Devices (page 119).
3. Activate monitoring by adding the monitoring settings in the properties of Host and Router
elements. See Activating Monitoring of a Third-Party Device (page 123).
4. Depending on features used, configure the third-party device for monitoring. See
Configuring a Third-Party Device for Monitoring (page 124).
Related Tasks
 Changing the Ports for Third-Party Device Monitoring (page 124)
 Activating/Deactivating Third-Party Status Monitoring Alerts (page 125)
112 Chapter 8 Monitoring Third-Party Devices

Receiving Logs From External Devices
Prerequisites: None
You can set up most external devices to send their logs to other devices in the syslog format.
The Log Server can convert these incoming syslog entries to StoneGate log entries. To make the
You must define how the values are picked up from the syslog data and how those values are
inserted in a StoneGate log entry. This is done in a Logging Profile element. A Logging Profile
consists of one or more logging patterns which each parse and encode fields of one third-party
device log entry and map the values to log fields in one StoneGate log entry.
You can define the logging patterns in two alternative ways:
• As ordered fields, so that each received syslog entry is read and matched in sequence. If
incoming logs vary in structure, you must define a different patterns for each type of
structure. You can define several of these patterns in each Logging Profile.
• As key-value pairs, so that each received syslog entry is parsed by picking values based on
keywords you enter. You can define the keywords in any order, so with this method, a single
definition is enough even when logs vary in structure.
The key-value pairs are easier to configure, so it is the best option to use if the third-party device
formats the original syslog data (in relevant parts) as key-value pairs. The ordered fields method
can be used on all syslog data.
A basic match simply transfers a value the syslog entry to one StoneGate log field. This is
appropriate for most data, but in some cases more advanced operations may be necessary. You
can define Field Resolvers for the complex operations.
What’s Next?
 Creating a Logging Profile Element (page 114).
Related Tasks
 Defining Field Resolvers (page 117).
 Changing the Ports for Third-Party Device Monitoring (page 124)
 Some Logging Profile samples are available at http://stoneblog.stonesoft.com/stoneblog-
community/. You can import these as elements (FileImportImport Elements).
Receiving Logs From External Devices 113

Creating a Logging Profile Element
Syslog messages have the following format: <PRI> HEADER MSG. These sections are used as
explained in the table below.
Table 8.1 Syslog Data Sections
Section Description
Facility and priority information.
<PRI> Log Server automatically extracts the Facility value from the <PRI> section and encodes it in
the Syslog Facility field in StoneGate logs. You do not define this section.
A timestamp and the hostname or the IP address of the device. You can map this section
HEADER separately from the main part of the actual syslog message.
This section is optional in syslog messages, so all devices do not send this data.
MSG The syslog message. This is the data you map in the main part of the Logging Profile dialog.
 To create a Logging Profile element

1. Select ConfigurationConfigurationMonitoringfrom the menu.
2. Right-click Third Party Devices and select NewLogging Profile. The Logging Profile
Illustration 8.1 Logging Profile Properties - General Tab
3. Give the Logging Profile a unique Name.

4. (Optional) Add fields to Header. The header fields are used by all logging patterns you
define in this Logging Profile. This is defined using the ordered fields entry method.
• Type or copy-paste the characters that appear around the values you want to pick up from
the incoming syslog entries. Spaces appear as black dots as shown in the illustration.
• In place of the values, insert the StoneGate log fields in which you want to store each
value when the syslog entry is converted to a StoneGate log entry or the Ignore field,
which discards the matching data.
Example In the example illustration above, the header in the syslog entry is <Source IP
address><space><Destination IP address><space>, so the header contains data such as
“192.168.1.101 192.168.1.102“ (without the quotes).
5. Select the Patterns mode based on the type of data this Logging Profile handles:
• Ordered Fields: select if the syslog data does not contain key-value pairs for the
information you want to match.
• Key-Value Pairs: select if the syslog data defines the values you want to match as key-
value pairs.
What’s Next?
 Defining Ordered Field Logging Patterns (page 115).
 Defining Key-Value Pair Logging Patterns (page 116).
Defining Ordered Field Logging Patterns

Each received syslog entry is parsed and encoded in order from beginning to end. Basic
matching copies the matched value as-is to a StoneGate log field, but you can also create Field
Resolvers that map specific values in the source data to a specific value in StoneGate logs.
The whole pattern must exactly match the incoming syslog entry. If incoming logs vary in
structure, you may need to define a different pattern for each type of entry. If several patterns
are exact matches, the longest matching pattern is selected. If an arriving entry does not match
any of the defined patterns, you can add the data into a single StoneGate log field or discard it.
 To define logging patterns as ordered fields

1. Define a pattern matching data in exactly the same order as it appears in the entry as
explained below. The pattern you define must be an exact match.
Illustration 8.2 Logging Profile Properties - Defining Ordered Fields
• Type or copy-paste any number of static characters that appear before and after the
values you want to pick up from the incoming syslog entries. Spaces are shown as black

dots as in the illustration above. Variable data that you do not want included in the
StoneGate logs is handled using the Ignore field (explained below).
• You can add the Ignore field (Ctrl+i) to discard a portion of the data.
• To insert values into StoneGate log fields, drag and drop fields from the Fields tab, or
press Ctrl+spacebar to activate a type-ahead search at the current cursor position.
• For more advanced operations, define a Field Resolver and add it to the pattern instead of
a log field. For more information, see Defining Field Resolvers (page 117).
• You can comment out a pattern (useful when testing different patterns) through the
toolbar toggle button or by typing two slashes at the beginning of the pattern (//).
2. (Optional) If some incoming entries are formatted differently, press Enter and define a new
pattern on the new line that is added.
3. Select from the Unmatched Log Event list how the data in the <MSG> section is handled if
it does not match any logging pattern.
• Stored in 'Syslog message' field: a stored-type log entry is created and all data is placed
in the Syslog Message log field.
• Displayed in 'Syslog message' field: a stored-type log entry is created and all data is
placed in the Syslog Message log field.
• Ignored: the data is discarded.
What’s Next?
 To test the Logging Profile, proceed to Validating a Logging Profile (page 118).
 To activate the Logging Profile, see Activating Monitoring of a Third-Party Device
(page 123).
Defining Key-Value Pair Logging Patterns

Using this method, the Log Server parses each received syslog entry by picking values based on
keywords you enter. The third-party device must format the original syslog data (in relevant
parts) as key-value pairs. If you want to parse data that is not formatted as key-value pairs, see
Defining Ordered Field Logging Patterns (page 115).
If an arriving entry does not match any of the defined patterns, you can add the data into a
single StoneGate log field or discard it.
 To define logging patterns as key-value pairs

1. Add a StoneGate log field that you want to fill with some value.
• Drag and drop fields from the Fields tab to the empty area to add a row.
• Drag and drop fields from the Fields tab onto a selected field to replace the field.
• For more advanced operations, define a Field Resolver and add it to the pattern instead of
a log field. For more information, see Defining Field Resolvers (page 117).
• You can add the Ignore field by clicking Add below the main panel. The Ignore field
discards the matching data.
2. Double-click the key cell for the log field you added and type the key, for example “time”
(without the quotes).
3. Add other keys in the same way. The order of the keys on the list and in the syslog entries
does not matter. The match is made key by key based on the key alone.

4. Select from the Unmatched Log Event list how the data in the <MSG> section is handled if
it does not match any logging pattern.
• Stored in 'Syslog message' field: a stored-type log entry is created and all data is placed
in the Syslog Message log field.
• Displayed in 'Syslog message' field: a stored-type log entry is created and all data is
placed in the Syslog Message log field.
• Ignored: the data is discarded.
What’s Next?
 To test the Logging Profile, proceed to Validating a Logging Profile (page 118).
(page 123).
Defining Field Resolvers

Field Resolvers convert values in incoming log fields to different values in StoneGate. This is
useful in three kinds of cases:
• Convert timestamps: Different external devices use different date and time formats. A Field
Resolver for each different incoming format can map the times and dates correctly to the
StoneGate format. The date and time syntax in Field Resolvers follows the Java standard.
• Map product-specific values: Some concepts in the log data have a pre-set range of values on
the external devices and in StoneGate, but the possible values are different. A Field Resolver
can convert this data, for example, you can map a range of alert severities in the original data
to their nearest comparable alert severities in StoneGate logs (Info/Low/High/Critical).
• Map one value to several log fields: In some cases, a single value may have several
corresponding log fields in StoneGate. A Field Resolver can create multiple StoneGate log
fields from a single value. For example, StoneGate components set an Action, a Situation,
and an Event for traffic filtering decisions. If the external component notifies a “permit”
action, the Field Resolver can set the corresponding StoneGate values for all three log fields.
 To define a Field Resolver

1. Switch to the Field Resolvers tab.
2. Right-click the Field Resolvers panel and select New Field Resolver. The Field Resolver
3. Name the new Field Resolver.
4. Select the Field Type to map the new Field Resolver.
• Select Multi-valued to define keywords for several types of fields.
• Select Date to convert a log field timestamp to the StoneGate format.
What’s Next?
 Defining a Field Resolver for Multiple Values (page 118).
 Defining a Field Resolver for Date and Time (page 118).

Defining a Field Resolver for Multiple Values
 To define a multi-valued field resolver
1. In Fields, add the StoneGate log field(s) into which the incoming syslog data is inserted
through the Add button at the right of the selection panel.
2. Click Add (under Value) to add a new row in the Values panel.
Illustration 8.3 Defining Field Resolver Properties - Multi-valued
3 4
3. Enter the name of the value on the third-party device in the Value cell.
4. Depending on the log field, enter or select the value you want to use for each of the
StoneGate log field(s) in your selection.
5. Define more keywords (more rows) as necessary.
6. When you are done, click OK. You can now insert the Field Resolver in your custom Logging
Profile.
Defining a Field Resolver for Date and Time

 To define a date resolver
1. Click Select for Time Field and select the log field whose timestamp you want to define.
2. Enter the Time Format to specify the format that the third-party device uses for the
timestamp. Type the format according to Java standards. For syntax, see
http://java.sun.com/j2se/1.5.0/docs/api/java/text/SimpleDateFormat.html.
Example The log timestamp Jan 30 13:23:12 is entered as MMM dd HH:mm:ss.
3. Click OK. You can now insert the Field Resolver in your custom Logging Profile.
Validating a Logging Profile

You can test a Logging Profile you create against actual syslog data to verify your patterns.
 To validate a Logging Profile

1. Switch to the Validation tab.
2. Click Browse to find and open a file of third-party device source logs for validation.

Illustration 8.4 Logging Profile Properties - Validation Tab
2
Imported
data
Conversion
results
3. Click Validate. The Validation Results panel shows you the results. The first column in the
results shows which logging pattern matched each imported syslog entry.
4. When you have finished defining your Logging Profile Properties, click OK.
What’s Next?
 To create a new Probing Profile, see Creating a Probing Profile (page 121).
(page 123).
Monitoring the Status of Third-Party Devices

Prerequisites: None
The Log Server can actively probe the status of third-party components using one of several
alternative methods:
• SNMPv1.
• SNMPv2c.
• SNMPv3.
• Pings.
• TCP connection probes.
When one of the SNMP status probing methods is used, you can also set up statistics reception
for the device. Statistics reception relies on SNMPv1 traps sent by the third-party device.
StoneGate supports statistical monitoring of the following details:
• Amount of free and used memory.
• CPU load.
• Interface statistics.
Monitoring the Status of Third-Party Devices 119

What’s Next?
 If you want to receive statistics from a new type of device, proceed to Importing MIBs
(page 120).
 To set up status monitoring without statistics for a new type of device, proceed to
Creating a Probing Profile (page 121).
 To activate status and statistics monitoring for a previously configured type of device,
proceed to Activating Monitoring of a Third-Party Device (page 123).
Related Tasks
 Changing the Ports for Third-Party Device Monitoring (page 124).
Importing MIBs
You can import third-party MIBs (management information bases) to support third-party SNMP
monitoring. The OIDs (object identifiers) allows resolving the SNMP traps when they appear in
log entries. If the OIDs are not resolved, they appear in the logs using a more difficult to read
dotted notation. Only SNMPv1 Trap Reception is supported.
 To import a MIB
1. Select ConfigurationConfigurationMonitoring from the menu. The Monitoring
2. Expand the Third Party Devices branch.
3. Right-click MIBs and select Import MIB. The Import MIB Files window opens.
4. Browse for the MIB file to import and click Import. A new view opens showing the progress
of the import.
5. (Optional) Click Close when the import is finished.
6. Browse to MIBsAll MIBs or MIBsBy Vendor in the Monitoring view to see the MIB you
imported.
7. To view the contents of the MIB, right-click it and select Properties. The MIB Browser
opens.
• The General tab shows the content of a MIB file “as is”.
• Switch to the OID Tree tab to view the objects that the MIB file defines: the object
identifiers, their OIDs in dot notation, and possibly a description of the object.

Illustration 8.5 OID Tree Tab
8. If the MIB is correct, click OK.
What’s Next?
 Creating a Probing Profile (page 121)
Creating a Probing Profile

Probing Profile defines the monitoring of third-party device status (using SNMPv1/SNMPv2c/
SNMPv3/Ping/TCP) and receiving statistics information from them (using SNMPv1).
 To create a Probing Profile

1. Select ConfigurationConfigurationMonitoring from the menu. The Monitoring
2. Right-click Third Party Devices and select NewProbing Profile. The Probing Profile
Illustration 8.6 Probing Profile Properties - General Tab
Monitoring the Status of Third-Party Devices 121

3. Define the general probing profile settings on the General tab:
Setting Explanation
Name The name of the probing profile.
Probing Interval Defines how often the probing is done.
Defines how many times probing is attempted if the connection is not

Retry Count
established.
Timeout Defines how long the third-party device is probed.
4. Define the probing profile status settings on the Status tab
Setting Explanation
Probing Method Defines the probing method to be used.
Defines the port to be probed (only visible when SNMP (default port 161) or TCP
Port
(default port 80) has been defined as the probing method).
SNMP Community Defines the SNMP community (only with SNMP and SNMPv2c probing methods.
5. Additionally, if SNMPv3 is selected as the probing method, the following additional SNMPv3-
specific security settings must be made:
Setting Explanation
Security Name Defines the default security name used for SNMPv3 requests.
Context Name Defines the default context name used for SNMPv3 requests.
Defines the authentication protocol and privacy protocol to be used.

NoAuthNoPriv: No authentication protocol and no privacy protocol are used.
Security Level
AuthNoPriv: Authentication protocol is used but no privacy protocol is used.
AuthPriv: Both authentication protocol and privacy protocol are used.
Authentication Defines whether the authentication protocol used is MD5 or SHA. Enter the
Protocol password to be used to the Password field.
Defines the privacy protocol to be used (DES, AES, AES192, AES256, 3DES).
Privacy Protocol
Enter the password to be used in the Password field.
6. (Optional, together with SNMP/SNMPv2c/SNMPv3 probing only) Switch to the Statistics tab
and define the settings for statistics reception using SNMPv1 traps:
Setting Explanation
Activates statistics for the amount of used memory. Enter the OID of the third-
Memory Used
party device or click Select to pick the OID from a list of imported MIBs.

Setting Explanation
Activates statistics for the amount of free memory. Enter the OID of the third-party
Memory Free
device or click Select to pick the OID from a list of imported MIBs.
Activates statistics for the processor load. Enter the OID of the third-party device
CPU Usage
or click Select to pick the OID from a list of imported MIBs.
Interface
Activates interface statistics reception.
Statistics
Enter the IP address of the third-party device. Click Test to launch an SNMP query
and display the result in the panel below. Note that the actual statistics reception
IP Address
requires that the third-party device actively sends SNMP traps; the Log Server
does not automatically query the device for statistics.
7. Click OK to save the Probing Profile.
What’s Next?
 Activating Monitoring of a Third-Party Device (page 123)
Activating Monitoring of a Third-Party Device

Prerequisites: Receiving Logs From External Devices, Creating a Probing Profile
 To activate status monitoring and/or log reception for a third-party device

1. Open the Properties dialog for the element that represents the third-party device (Router or
Host element).
• For more information on creating these elements, see Getting Started with Defining IP
2. Switch to the Monitoring tab.
Illustration 8.7 Host Properties - Monitoring Tab
3. Select the Log Server to which the logs from third-party device are sent.
4. (Optional) To receive status information, select the Status Monitoring option and select the
Probing Profile. See Creating a Probing Profile (page 121).
5. (Optional) To receive logging information, select the Logs Reception option and select the
Logging Profile. See Receiving Logs From External Devices (page 113).
6. (Optional) Select SNMP Trap Reception if you want to receive SNMP traps from third-party
devices.
Activating Monitoring of a Third-Party Device 123

7. Click OK.
What’s Next?
 Configuring a Third-Party Device for Monitoring (page 124).
Related Tasks
 Monitoring the System (page 83)
 Browsing Logged Data (page 127)
Configuring a Third-Party Device for Monitoring

Prerequisites: Activating Monitoring of a Third-Party Device
For any type of monitoring, make sure that the connections between the third-party component
and the Log Server are allowed through any possible traffic filtering in your network.
Ping and TCP status monitoring do not usually require additional configuration on the target
device.
SNMP-based polling usually requires that the target device is specifically configured to respond
to the Log Server’s SNMP queries.
Statistics sending (as SNMPv1 traps) must always be specifically configured on the third-party
device. For instructions on these tasks, consult the documentation of the third-party device.
If necessary, you can change the ports that the Log Server uses to listen for syslog and SNMP
transmissions as explained in Changing the Ports for Third-Party Device Monitoring (page 124).
Changing the Ports for Third-Party Device Monitoring

Prerequisites: None
The default listening ports are:

• On Windows, the Log Server listens to syslog on port 514 and SNMP traps on port 162
• On Linux, the Log Server listens to syslog on port 5514 and SNMP traps on port 5162.
If necessary, you can change the ports, but the port number on Linux must always be higher
than 1024 as explained in Changing Log Server Configuration Parameters (page 279).
If it is not possible to reconfigure the third-party device to send data to the correct port, you
can either redirect traffic to a different port using an intermediate network device or on the
Log Server, for example, using iptables in Linux:
iptables -t nat -A PREROUTING -p udp -m udp --dport 514 -j REDIRECT --to-ports
5514.

Activating/Deactivating Third-Party Status Monitoring Alerts
Prerequisites: Activating Monitoring of a Third-Party Device
You can optionally activate the status surveillance feature, which generates an alert if a
monitored component’s status remains unknown for 15 minutes.
 To enable/disable third-party device status surveillance

1. Select MonitoringSystem Status from the menu.
2. Expand the Third Party Devices branch.
3. Right-click an element and select/deselect OptionsStatus Surveillance.
Activating/Deactivating Third-Party Status Monitoring Alerts 125

C H A P TE R 9
BROWSING LOGGED DATA
You can view log, alert, and audit entries through the same unified tool. You can view data
from Management Center servers, all types of StoneGate engines, and from third-party
components that are configured to send data to the StoneGate Management Center.
Getting Started with the Logs View (page 128)

Browsing Log Data (page 133)
Changing How Data Entries Are Displayed (page 139)
Exporting Data from the Logs View (page 141)
Creating Rules From Logs (page 143)
127
Getting Started with the Logs View
Prerequisites: None
The Logs view displays all log, alert, and audit entries for the entire system. You can view any
types of entries from any number of components together or individually.
Overview
For an overview, start by Opening the Logs View as explained below and proceed in order
through introductions to the different arrangements. These include:
1. Default (Records) Arrangement, Panels, and Tools (page 128)
2. Details Arrangement (page 131)
3. Statistics Arrangement (page 132)
Opening the Logs View

There are several ways to access the Logs view, for example:
• Select MonitoringLogs from the menu or click the corresponding toolbar icon.
• Right-click an element that produces logs and select a log-related item in the Monitoring
submenu (to view logs sent by that component).
• Click the alert indicator in the bottom right corner (to view active alerts).
• Different bookmarks can be created to open the Logs view with different filtering criteria.
Default (Records) Arrangement, Panels, and Tools

The default Records arrangement is optimized for efficient browsing of many entries.
Illustration 9.1 Logs View in the Records Arrangement
Query
panel
Toolbars
Log Fields
entry panel
table
Timeline Options
for
browsing
128 Chapter 9 Browsing Logged Data

Illustration 9.2 Toolbar in the Records Arrangement
Go to the first/last Tools Switch to Statistics arrangement.
record in Query. menu
Current Events Switch to Details

mode arrangement (for
selected record).
Stop ongoing operation
Change text size
Stop escalation for selected/all alerts
Illustration 9.3 Status Bar Options for Log Browsing
Connectivity status. Also Change time zone Location (defines Log

see the Storage tab in the for browsing. Server contact address if
Query panel. NAT is applied in between).
Note – If NAT is applied between your Management Client and a Log Server, you must
select the correct Location for your Management Client to be able to see the logs. See
Configuring System Communications (page 59) for more information.
Logs View Panels

You can select and deselect panels through ViewPanels in the main menu.
The following panels are available in both the Records and Details arrangements:
• Query panel: The most important tool in the logs view. The Query allows you to filter the log
entries so that you can find the information you need.
• Fields panel: Provides quick access to categorized log entry details.
• Event Visualization panel: A graphic showing the main information about the event.
• Hex panel: Displays traffic recordings generated by the Excerpt logging option of an
Inspection rule (other recordings are viewed using an external viewer).
• Summary panel: Textual explanation of the event that generated the record.
• Alert Events panel: Details on alert reception and escalation.
Additionally, a Task status panel is only available in the Records view. It displays the status of
log-related tasks, such as a log export that you launch from the Logs view.
Timeline (Available in All Arrangements)
The Timeline is a visual navigation tool to the log data. It also provides you a reference point to
how the current view relates to the overall Query you are currently browsing and allows you to
quickly move within the time range.
In the default Records and Details views, the chart in the timeline is hidden. You can view it by
expanding the panel upwards. See Browsing Log Entries on a Timeline (page 137) for more
information.
Getting Started with the Logs View 129

Illustration 9.4 Timeline Expanded
The lower part Drag the

shows browsing border up to
progress. reveal chart.
Log Entry Table (Records Arrangement)

The log entry table in the default Records arrangement is the primary view to the logs. You can
freely select which details are shown and the order of the columns. Different types of entries
contain different types of information, so none of the entries use all columns.
When you right-click a cell in a log entry, the menu that opens allows you to take various actions
related to the log entry. The actions vary slightly depending on the information that the cell
contains. For example, right-clicking an element adds general element-specific actions (such as
Properties). The actions include, but are not limited to, the following:
• Copy: Copy the entry details to the clipboard.
• View Rule: View the rule that generated the log entry (if applicable).
• Create Rule: Create a new rule based on the entry. See Creating Rules From Logs
(page 143).
• Whois: Look up the selected IP address in the online WHOIS database. See Checking WHOIS
Records for IP Addresses in Logs (page 138).
• Export: Export records or attach records to an Incident case. See Exporting Extracts of Log
Data (page 141), Exporting IPS Traffic Recordings (page 142), or Attaching Logs to Incident
Cases (page 143).
• Filter Connections: Add basic details from the current selection to the Query panel. See
Filtering Logs in the Logs View (page 134).
• Show Connection: Add basic details from the selected connection to the Query panel.
• Search Related Events: Some special events are parts of a larger chain of events. This
option shows other events related to the selected log entry.
• New Blacklist Entry: Blacklist connections that match the entry’s details. See Getting
Started with Blacklisting (page 678) for more information about blacklisting.
• Add Filter: Add the selected detail to the filter in the Query panel. See Specifying Filters for a
Query (page 134).
• New Filter: Create a new filter based on the selected detail. See Specifying Filters for a
Query (page 134).

Details Arrangement
The Details Logs view arrangement provides an overview to an individual event. It is particularly
useful for alerts and records generated by Inspection rule matches.
Illustration 9.5 Logs View in the Details Arrangement
References panel
Summary
panel
Event
Visualization Tasks
panel panel
Hex panel
Illustration 9.6 Toolbar in the Details Arrangement

Previous Next Record-specific menu (like right-clicking
record record the record in the Records arrangement).
Switch to Records
arrangement
Stop ongoing operation Panel selection (also in View menu)
The Details view has the following additional panels in addition to the panels available in both
the Records and Details views.
• The References panel (shown by default): Displays a list of StoneGate elements that
correspond to the details in the record and possibly additional information on related records
for some special records that are part of a larger event.
• Tasks panel: Shortcuts to configuration tasks that you can launch based on the displayed
entry (as in the Records arrangement in the right-click menu for entries).
Getting Started with the Logs View 131

Statistics Arrangement
The Statistics arrangement in the Logs view draws charts from multiple events interactively. You
can create a quick report of the logs that match the active Query and then further refine the
Query by viewing logs that correspond to a chart segment.
Illustration 9.7 Logs View in the Statistics Arrangement
Query
Chart area panel
Right-click
chart sections
for a menu.
Timeline
The Query panel contains more tabs in the Statistics arrangement. The additional tabs allow you
to control the statistical display. The data can also be filtered in the same way as in the other
Logs view arrangements.
You can also add statistical items to the Statistics view. To do this, click the Add button in the
Query tab, and select the new items in the Select Element dialog. Click Apply to update the view.
Illustration 9.8 Toolbar in the Statistics Arrangement

Switch to Records Shortcuts to some
Refresh arrangement statistics items. More
items are available in
Stop ongoing the Query panel.
operation Generate a new chart
with a wider time range.
Save the current chart
as a Report Design.
Shortcuts to show/
hide panels.
The chart area in the Statistics arrangement can contain a pie chart, a bar chart, a line chart, or
a map chart (based on an internal geolocation database). The available options depend on the
chart type that is selected:

• Top rate charts can be displayed as a pie chart, bar chart, or a map. A top rate chart shows
the total numbers of records that match the query.
• Progress charts can be displayed as a line chart or a bar chart. A progress chart illustrates
you the numbers of records plotted over time (similar to the timeline, but in more detail).
When a chart is generated, you can right-click for a menu of actions related to the section and
possibly the element that the section corresponds to. The section-specific items are:
• Show Records, which opens the Records arrangement filtered to show the entries that
comprise the chart section you right-clicked.
• Statistics item shortcuts, which drill down to create a new chart from data that matches the
previous chart section.
You can also select new items for display through the Add button in the Query Panel. See
Selecting Statistical Items (page 95) for more information.
What’s Next?
 This concludes the overview tour. For more instructions on how to use the Logs
view, see Browsing Log Data. To see how you can customize the Logs view, see
Changing How Data Entries Are Displayed.
Browsing Log Data

Prerequisites: None
This section explains the basics of finding and browsing through data in the Logs view.
Viewing Log Entry Details in the Side Panel

The Fields panel provides several alternative views to the log entry that is currently selected.
The Fields panel is most useful in the Records arrangement. It shows a subset of fields and the
information contained in the selected field, so that you can quickly browse the logs table for the
exact details you are looking for without scrolling sideways or rearranging the columns.
If the Fields panel is not visible in your Logs View, select ViewPanelsFields.
Illustration 9.9 Fields View

Select the types of
fields you want to
view.
If the selected entry
contains information in the
fields included, the details
are shown.
Right-click a field for a
menu of actions. When you select a field, it
is shown below as text,
allowing you to copy-paste
portions of the information.
The Watchlist item allows you to create a customized list of fields for your own use. The
Watchlist is specific to each Management Client installation.
Browsing Log Data 133

 To edit your personal Watchlist of log fields
1. In the Fields panel, select Watchlist in the drop-down list at the top of the panel.
2. Change the selection to your desired fields:
• To remove fields, right-click the field and select Remove (to remove one field) or Clear (to
remove all fields).
• To add additional fields, drag and drop cells from the log entry table into the Fields panel
(the value of the field is irrelevant in this case).
• To add a field to the Watchlist from other views in the Fields panel, right-click a field in the
Fields panel and select Add to Watchlist.
Filtering Logs in the Logs View

Efficient use of the logs requires that you filter the records displayed in the Logs view. This is
done using the Query panel, which contains the following tabs for filtering data:
• Filter tab allows you filter entries based on any information in the entries.
• Senders tab allows you to filter entries according to the component that created the entry.
Filtering by sender speeds up log browsing when there are many log sending components, but
you are only interested in a limited set.
• Storage allows you to filter entries according to the servers on which the entries are stored.
Illustration 9.10 Query Panel in the Logs View
General type for data Options on the three tabs

included. allow setting additional
filtering criteria.
Specifying Filters for a Query

The Filter tab in the Query Properties panel of the Logs view allows you to:
• create quick temporary filters by dragging and dropping details from existing entries (from the
logs table, Fields panel, or sections of a statistical chart)
• filter the logs according to time
• apply filtering criteria stored in Filter elements.
If the Query panel is not visible, select ViewPanelsQuery.

Illustration 9.11 Query Panel with Different Types of Filtering Criteria Selected
Icons from left to right: Drag and drop details
1) Save the contents as a from data for quick filters.
permanent Filter element. Drop in empty space to
2) Add a Filter element. add a row. Edit as needed.
3) Add a filtering criterion
that you type in. Rows with several details
4) Add a new empty row. can match any one detail
(or) or only when all
Negate the row to filter out
details are found in the
matching entries.
same entry (and). Click
Time range to retrieve log the and/or cell to toggle.
entries: select a specific time
Start browsing from the
range, or no fixed time range.
beginning/end of the
Click Apply after you make selected time range.
changes. Select the date from a
calendar.
Note – The time selection refers to the entries’ creation timestamp (not the reception time
at the Log Server, which is also included in many entries). Internally, the system always
uses universal time (UTC). The times are displayed according to the time zone selected in
your Management Client’s status bar.
You can drag and drop any field from the log entries to the Filters tab to create a Filter, select
existing Filter elements, or add a new filtering criterion using the toolbar icon and typing in the
detail. You can then further modify and utilize the Filters you have created:
• Double-click a detail (such as IP address) to open the Filter Properties dialog, in which you
can change the detail manually by typing in a new value.
• Right-click a field in the log entry table or in the Fields panel and select Add Filter: <field
name> to add the item and its value as a new filter row.
• Right-click an item in the log entry table or in the Fields panel and select New Filter: <item
name> to define a value for the item and add it as a new filter row.
• You can add a new empty row by right-clicking a filter row or in the empty space and selecting
Add Row in addition to using the Add Row icon in the Query Panel’s toolbar.
• To use a Search Filter, i.e. to make a free word search, right-click the Query panel, select
NewNew Search Filter, and type your search string to the Filter Properties dialog.
• To remove a detail, right-click and select Remove <detail description>.
• To remove a whole row, right-click something other than a detail on the row you want to
remove and select Remove.
• Temporarily disable a filter row by right-clicking it and selecting Disable from the menu.
• You can save the current filtering criteria as a permanent Filter element by clicking the Save
button at the top of the Filter tab in the Query panel (see Illustration 9.11 above).
Remember to click Apply after you make any changes to re-filter the logs.
Related Tasks
 For information on creating Filter elements, see Filtering Data (page 159).

Viewing Logs From Specific Components
You can filter the logs based on the component(s) that created the entries. If the Senders tab is
empty, data from all components is displayed in the Logs view. The Senders tab allows you to
maintain the sender filtering independent of changes on the Filter tab. Restricting the included
senders makes log browsing faster when there are many components in the system.
 To specify senders
1. Select the Senders tab in the Query panel.
2. Click the Select button (arrow) at the top of the Senders tab. The Select Element dialog
opens.
3. Select the element(s) you want to use as the sender(s) and click Select.
4. Click Apply. The log data is refreshed, and only logs from the selected sender(s) are
displayed.
Viewing Logs From Specific Servers and Archive Folders

By default, the Logs view fetches data from the active log storage folder of all data storage
servers, except those Log Servers that are excluded from log browsing through an option in their
properties. You view logs from the active storage folder on specific Log and Management
Servers. You can also view logs from archives stored on Logs Servers or archives stored locally
on the computer where you are using the Management Client. The Management Servers store
audit data only. Log Servers store all logs and alerts in addition to audit data regarding their own
operation.
 To specify storage
1. Select the Storage tab in the Query panel.
2. In the server list, select the Log Servers and storage folders that you want to include.
3. Click Apply. The log data is refreshed and filtered according to the selected servers and
folders.
Related Tasks
 Changing Log Server Configuration Parameters (page 279)
 Archiving Log Data (page 802)

Browsing Log Entries on a Timeline
You can navigate logs in time using the Timeline. In the Records and Details view arrangements,
part of the Timeline is hidden by default. You can view the full timeline by dragging its upper
edge. Depending on your selection, the timeline either allows you to browse freely (the
Automatic option) or stops you when the first or last entry within the specified time range is
reached.
Illustration 9.12 Timeline Minimized
When you are browsing within a set time range, you Drag the arrowhead to browse. The
cannot accidentally browse out of the time range set arrow also indicates the selected
in the Query panel. Square brackets are shown at start position (from the beginning
each end to mark this. or the end of the time range).
Illustration 9.13 Timeline Expanded

Chart plots the number of
matching entries over time.
Viewing Temporary Log Entries

The Logs view has two operating modes. In the normal mode, you can browse entries freely from
any time period. When you activate the Current Events mode by clicking the “play” icon in the
toolbar, the log entries update automatically to show the stream of log entries as they arrive at
the Log Server(s). Usually, you must filter out some entries to keep the pace of the Current
Events mode slow enough that you can keep up with the entries.
The Current Events mode also displays temporary entries that are not stored on the Log Server
(Transient log entries and log entries that are pruned out before permanent storing) so you may
see more logs than in the normal mode. Temporary entries only exist within the current view and
are permanently lost when the view is refreshed or closed. The updates in the Current Events
mode are automatically deactivated when you select an entry or start browsing manually.
Note – Under some operating conditions, a small portion of log entries may arrive in mixed
order. Because the Current events view attempts to maintain a logical flow of events, out-
of-sequence entries are not shown. You may see a notification message pop up if this
happens.

Sorting Log Entries
By default, log entries are sorted according to their creation time. You can alternatively sort log
entries according to any other column heading. Because large numbers of logs may require
significant resources to be sorted, the Logs view may shorten your selected time range if your
current Query matches too many records to be efficiently sorted.
 To sort log entries according to the column heading

 Click the column heading according to which you want to sort the log entries. The log
entry table is refreshed with the logs sorted according to the column heading you
selected. This may take a while.
Note – The Current events view is always sorted according to entry creation time. Sorting
can only use stored data, so any temporary data visible in the Current events view is
permanently lost if you change sorting.
Checking WHOIS Records for IP Addresses in Logs

To get more information about the source of the traffic that triggered a log entry, you can look up
the WHOIS record of IP addresses in log entries. The WHOIS record contains registration
information and related contact details provided at the time of domain registration. The contents
of the WHOIS record vary depending on the information provided by the owner of the domain or
network segment. In the case of IP addresses used by customers of an ISP, the information
shown in the WHOIS record is usually the ISP’s information.
The WHOIS information is queried from the relevant Regional Internet Registry (RIR). These
include, but are not limited to, the ARIN (American Registry for Internet Numbers), the RIPE NCC
(Réseaux IP Européens Network Coordination Centre), and the APNIC (Asia Pacific Network
Information Centre). More information about the main RIRs can be found from the following
external links:
• ARIN at a Glance: https://www.arin.net/about_us/overview.html.
• RIPE Database: http://www.ripe.net/db/index.html.
• About APNIC: http://www.apnic.net/about-APNIC/organization.
 To check the WHOIS record for an IP address in a log entry

 Right-click an IP address and select Whois. The WHOIS record for the IP address is
displayed.

Changing How Data Entries Are Displayed
Prerequisites: None
Increasing and Decreasing Text Size in Data Entries

You can increase, decrease, and reset (“set normal”) the text size in the log entry table from the
ViewText Size menu
Changing the Time Zone for Log Browsing

The system always uses universal time (UTC) internally. The times in the Logs view are
converted to your selected time zone as they are displayed. By default, this is the local time
zone of the computer you are using. Changing the time zone does not affect the actual time
stamps of the log entries.
If the times in the log entries seem incorrect, make sure both the time and time zone are set
correctly in your operating system, on the Management Server, and on all Log Servers.
Illustration 9.14 Time Zone Selection in the Logs View
Change time zone for browsing.
Changing Data Columns in the Log Entry Table

You can customize the columns shown in the Logs view according to your needs. You can add
and remove columns and change the order in which the columns are displayed. Note that the
Fields panel also allows viewing subsets of log columns, see Viewing Log Entry Details in the
Side Panel (page 133).
In addition to selecting which columns are displayed, you can arrange the columns in the
following ways:
• Drag the column header to a different location to change the order of the columns.
• Double-click the column header to expand the column to the width of its contents.
• Right-click a column header for a menu of actions for adjusting the column widths.
 To select columns that are shown in the log record table

1. Open the Logs view.
2. Select ViewColumn Selection from the menu. The Column Selection dialog opens.
Changing How Data Entries Are Displayed 139

Illustration 9.15 Column Selection
3. Use the Add and Remove buttons to include and exclude selected fields. The Columns to
Display list on the right shows your selections. See Log Entry Fields (page 976) for short
descriptions of all log fields.
4. Use the Up and Down buttons to organize selected fields on the Columns to Display list.
Fields at the top are shown at the left of the log record table.
5. Click OK.
Resolving Log Details to DNS Names or StoneGate Elements

To make logs easier to read, you can view the IP addresses, protocols, and ports as DNS names
or StoneGate elements. Resolving is for display only and does not affect stored log data.
Note – IP address and port resolving works by comparing the information in the logs to
internal and external information sources. If the information available is incorrect or
ambiguous, the result may not reflect the actual hosts and services involved in the
communications. For example, if a detail matches two StoneGate elements, the first
match is used for display even if the other element was used in the corresponding rule.
 To enable/disable Sender resolving

 Select OptionsResolve Senders from the menu. When enabled, the IP addresses of
engines and SMC servers are resolved using the element definitions.
 To enable/disable IP address resolving

 Select OptionsResolve Addresses from the menu. When enabled, the IP addresses
are resolved using DNS (if available) and the StoneGate element definitions.
 To enable/disable port resolving

 Select OptionsResolve Ports from the menu. When enabled, the ports are resolved
using Service element definitions.

 To enable/disable the display of icons
 Select OptionsShow Icons from the menu. When enabled, the data is displayed with
the icons of the elements involved, where applicable.
Deactivating/Activating Log Entry Highlighting

Different types of logs can be highlighted with different colors. There is a default color scheme
in place, but the log color filters can be customized for all administrators or even individually in
each Administrator elements’ properties.
 To turn the log entry colors on/off

 Select/deselect OptionsUse Color Filters in the main menu. See Customizing Log
Colors (page 222) for information on how the colors are changed.
Exporting Data from the Logs View

Prerequisites: None
Exporting Extracts of Log Data

Log, alert, and audit data can be exported directly from the Logs view, but note the following:
• You can alternatively use the Log Data Tasks tool to export logs, allowing you to schedule
export tasks that are executed automatically. See Getting Started with Log Data Management
(page 800).
• If you want a human-readable output and there is no need for further processing of exported
data, we recommend you save the entries as PDF or HTML instead. See Saving as PDF or
HTML (page 50).
• If you want to export traffic recordings, see Exporting IPS Traffic Recordings (page 142).
For a limited number of entries, a simple copy-paste is the quickest export method.
 To copy a limited number of logs in CSV format

 Select data entries and copy-paste them to the other application, for example a
spreadsheet application. The entries are copied with the column titles in the CSV
(comma-separated values) format.
For large numbers of entries and other export formats, use the export command instead.
 To export data entries from the Logs view

1. (Optional) To export only some of the entries that match your current Query, select some
data entries in the Records arrangement. Ctrl- or Shift-click to select several entries.
2. Right-click one of the entries and select ExportExport Log Events. The Export Logs
dialog opens.
3. Select the File Export Format that matches your needs.
• XML logs are suitable for conversion to different formats, such as HTML, using external
XML conversion tools (you must develop your own conversions that produce the desired
results).
• CSV logs are suitable for reading and further processing in spreadsheets and other
similar use.
• Archive ZIP and Archive save the logs in the system’s internal format for possible later
use in this or some other StoneGate Mangement Center.
Exporting Data from the Logs View 141

4. In Export, select if you only want to export the selected entries or all of the entries that
match the filter criteria currently specified in the Query panel.
5. Select the Destination File:
• For Archive, you can select archive directories defined in the Log Server’s configuration
file (see Changing Log Server Configuration Parameters (page 279)).
• For all other formats, you must specify a file name and select whether to export to the
Server “export” Directory (<installation directory>/data/export/ on the Log or
Management Server) or to a location of your choice on your computer (Local
Workstation).
6. For formats other than Archive, specify what is done if the specified file already exists.
• (CSV only) Select Append to add the new logs to the end of the existing file.
• Select Overwrite to replace the existing file with the new one.
• Select Use Number in File Name to add a number to the file name to distinguish it from
the existing file name.
• Select Fail Task to abort the export if the file already exists).
7. (Local Workstation exports only) Select the Open File After Export option to view the
exported file in the operating system’s default application for the file type.
8. Click OK. The Task Status panel opens showing the progress of the export.
Related Tasks
 Getting Started with Log Data Management (page 800)
Exporting IPS Traffic Recordings

You can set IPS Inspection rules to record network traffic as a logging option in both the
Exceptions and the Rules tree as explained in Editing Inspection Rules (page 531). These
recordings are stored on the Log Servers. Recordings generated by the “Excerpt” option are
shown directly in the Logs view (in the Hex panel available through ViewPanels). Longer
recordings, however, are meant to be viewed in an external application and are therefore not
directly viewable.
To view the recording, you can retrieve the recording through the log entry as explained below or
define a Task for exporting recordings, for example, from a specific time range as explained in
Exporting IPS Traffic Recordings (page 142).
 To retrieve traffic recordings for selected log entries

1. Select log entries that are associated with recordings.
• To browse for more entries that have a recording, change the selection in the Fields panel
to Full Capture (available when an entry that has an associated recording is selected).
The Record ID field is displayed with an identification number for entries that are
associated with a recording.
2. Right-click a selected entry and select ExportExport IPS Recordings. The Export
Selected IPS Recordings dialog opens.
3. Select the File Export Format that matches your needs (PCAP or SNOOP).
4. Select the Destination File:
• Select the Server “export” Directory to export to a file on the Log Server
(<installation directory>/data/export/)
• Select Local Workstation to save on your computer.
• You must specify the file name in both cases.

5. Specify what is done if the specified file already exists (Append option is not supported for
traffic recordings).
• Select Overwrite to replace the existing file with the new one.
• Select Use Number in File Name to add a number to the file name to distinguish it from
the existing file name.
• Select Fail Task to abort the export if the file already exists).
6. Click OK. The Task Status panel opens showing the progress of the export.
Attaching Logs to Incident Cases

You can attach logs, alert entries, and audit entries to incident cases directly from the Logs
view. You can attach single logs, a group of logs, or all logs that match your filtering criteria. You
can attach logs to an existing Incident Case, or you can create a new Incident Case and attach
logs to it. See Attaching Logs and Audit Entries to Incident Cases (page 180) for more
information about attaching logs to Incident Cases. For more information about creating new
Incident Cases, see Creating a New Incident Case (page 179).
Creating Rules From Logs

Prerequisites: None
You can use log entry details to generate new rules. To convert a log entry to a rule, the log entry
must be generated based on a rule (the entry contains a rule tag). Creating a rule this way
allows you to make quick exceptions to the current policy.
You can generate the following types of rules:
• A rule that allows a connection from an entry that logs stopped traffic.
• A rule that stops a connection from an entry that logs allowed traffic.
• A rule that changes the log level or stops the logging of matching connections.
 To create a rule based on one or more log entries

1. Select the log entries you want to include in the operation. You can select multiple log
entries to create several rules in the same operation. Do not include incompatible entries
in the selection:
• If you select multiple log entries, the Sender of all entries must be the same component.
• All selected entries must have a value in the Rule Tag field (entries must be created by
rules in a policy).
2. Right-click a (selected) log entry and select one of the options under Create Rule in the
menu that opens. The selection determines how the handling of matching connections is
changed. The New Rule Properties dialog opens.
3. (Optional) Click Select and change the policy to which the new rule is added (for example,
to insert the rule in a Sub-Policy instead of the main policy).
4. (Optional) Edit the Comment (this is added to the rule’s Comment cell).
5. Select the Action. All actions create the displayed rules at the beginning of the first insert
point in the selected policy. You can also optionally install the policy with the new rule or
open the policy for editing (with the new rule highlighted for you).
Note – You cannot edit the rule in this dialog. Select the Add Rules and Edit the Policy
option to edit the rule.
Creating Rules From Logs 143

6. Click OK.
What’s Next?
 If you selected to refresh the policy, the policy installation dialog opens, see
Installing Policies (page 501) for more instructions.
 If you selected to edit the policy, the policy opens for editing, see Using the
Policy Editing View (page 511) for more instructions.

C HAPT ER 10
REPORTS
You can process data from your StoneGate logs and engine statistics into easily digestible
diagrams, charts, and tables. The reports you generate are always based on a Report Design,
which can be one of the predefined designs, a modified version of it, or a custom design you
put together yourself.
Getting Started with Reports (page 146)

Creating and Editing Report Designs (page 148)
Generating and Viewing Reports (page 151)
Exporting Reports (page 156)
Creating a System Audit Report (page 157)
145
Getting Started with Reports
Prerequisites: None
Reports allow you to gather together and visualize the data that interests you the most in an
easy-to-read format to provide an overview of what is happening in the network. Reports are
generated in the Monitoring view.
What You Can Do with Reports
You can use logs and statistical data in the active storage to generate graphs, charts, tables,
and geolocation maps. You can view the reports in the Management Client and in the Web
Portal.
To export your reports, you can:
• print the generated reports into PDF documents for convenient sharing and printing.
• save reports as tab-delimited text for further processing in a spreadsheet program or some
other tool.
You can also generate special System reports from data about system configuration and events
to help you provide auditing information in compliance with regulatory standards.
You can generate reports based on predefined Report Designs or Report Designs that you have
created yourself. You can use your own Style Template for the PDF creation to give the reports a
unified corporate look.
In addition to generating reports in the Reports Designer view, you can also create simple
reports in the Logs view (see Browsing Logged Data (page 127)).
Limitations
Only the data in the active storage of the Log Servers can be included in the reports. Archived
data cannot be used in reports.
If you want to generate a report based on an existing Report Design, proceed to Generating
and Viewing Reports (page 151).
146 Chapter 10 Reports

Report
Report Design
Report Section Report Section
Report Item Report Item Report Item Report Item
This overview describes the configuration of new Report Designs.

1. Create a new Report Design. See Creating and Editing Report Designs (page 148).
2. Select report sections and items. They represent values (for example, the number of
allowed connections) in log data and statistical monitoring information. See Adding
Sections to a Report Design (page 150).
3. Generate a report. See Generating and Viewing Reports (page 151).
What’s Next?
 If you want to create a new Report Design, proceed to Creating and Editing
Report Designs (page 148).
Getting Started with Reports 147

Creating and Editing Report Designs
Prerequisites: None
Report Designs determine how you want to process the data and how the results are displayed.
They can also determine which template is used for PDF exports and which charts appear on
them. You create a new Report Design in two steps: first you create a Report Design, and then
you add items to it.
Tip – Ready-made Report Designs serve as a useful guide for constructing your own Report Designs.
To see how the ready-made Report Designs are constructed, explore them in the Report
Designer.
Illustration 10.1 Report Designer
Selected
Items
Report
Summary
Report
Section
Report/
Section/Item
Properties
What’s Next?
 Creating a New Report Design
Creating a New Report Design

 To create a new Report Design
1. Select ConfigurationConfigurationMonitoring from the menu. The Monitoring
2. Expand Reports.
3. Right-click Report Designs and select New Report Design. The Report Design Properties
dialog opens.
4. Select a template for the new Report Design and click OK. The Report Designer opens.
5. Type in a Name for the new Report Design and an optional Comment.

6. (Optional) Select a Filter.
• You can also create a new filter by clicking the New Filter icon in the filter selection dialog.
For instructions on how to create a new filter, see Filtering Data (page 159).
Note – The data is filtered from top down: first, the filter defined in the properties of the
Report Design is applied, then the filter defined for the report sections, and finally, the
filter defined for individual report items. When you start a report task, you have the option
to select a task-specific filter, which is applied before any of the other filters.
7. Adjust the other properties as needed.
Option Explanation
Defines the default time frame for this report. This affects the dates offered by
default when creating a report using this design. The longer period you choose,
the more data is included in the report. The level of detail in the charts may have
Period
to be reduced in order to keep them legible by adjusting the time resolution. This
is done automatically, but you can also change it by hand. All report items are not
compatible with the shortest period length.
With these fields, you can include data from a previous period of the same length
Compare With
in your reports to make comparison easier.
The level of detail in the progress charts and tables. A small time resolution
increases the level of detail, but having too much detail may make the produced
Time Resolution
charts difficult to read. The time resolution and the available choices are
automatically adjusted when you change the Period.
Activates IP address resolving in the reports, using Network Elements and/or

IP Resolving
DNS queries.
Defines the number of days after which the reports generated by this Report
Design expire (are automatically deleted). If you select Never Expire, you must
Expiration
manually delete all the reports generated using this Report Design when you no
longer need them.
Allows you to filter the data included in log-based report items by the type of log
Log Type
(alert, audit log, firewall log, IPS log, SSL VPN log, third-party device log).
Style Template Select the Style Template to be used with the PDF printing of the new Report.
What’s Next?
 Adding Sections to a Report Design (page 150)
Creating and Editing Report Designs 149

Adding Sections to a Report Design
After you have created a new Report Design, you must add sections and items to it.
 To add sections to a Report Design

1. Right-click the Report Design and select New Section. An empty new section is added to
the Report Design and the background of the new section is highlighted. The Section
Properties panel opens.
Illustration 10.2 Section Properties Panel
2. Define a Name and a Comment to be shown in the created report.

3. (Optional) Select the Filter to be used.
4. Select the Diagram Settings:
• Progress produces a chart and/or a table that shows the progress of items as time
passes.
• Top Rate produces a chart and/or a table highlighting the values with the highest number
of occurrences.
• Drill-down Top Rate preprocesses the data and then produces a chart and/or table from
it.
• Summary Table produces a table with all the values from items included in the report.
• System Information produces a table with information about current system state.
5. Select the Preferred Chart Type using the buttons. You can change this selection when you
launch the report task manually. The options available depend on the Diagram Settings you
chose in the previous step.
• If you selected Top Rate as Section Type, enter the number of items to be included in the
Top Limit field.
6. Define the types of logs that are included in Log Type.
7. Define the format in which the data is exported in Export.
8. Define the Traffic Unit for the data in charts and tables.

9. To add new Sections, repeat as necessary.
10.Change the order of the Sections in the Report Design by dragging and dropping them on
top of each other.
Note – Avoid placing IP address-based top rate items under sections of the Progress
section type. Generating reports with such designs may produce “out of memory” and/or
“too many counters” error messages. If this happens, change the section type to Drill-down
Top Rate, or otherwise reduce the amount of data in the report.
What’s Next?
 Adding Items to a Report Section
Adding Items to a Report Section

After you have created a new Report Section, you must add items to it.
 To add Items to a Report Section

1. Open the Report Design to which you want to add Items.
2. Select the Report Section to which you want to add Items.
3. Click the Add Item link. The Select Item dialog opens.
4. Use one or more of the options in the dialog to narrow down the search for the item. See
Selecting Statistical Items (page 95).
5. Select the item that you want to add and click Select. Alternatively, you can also double-
click the Item.
6. To add new Items, repeat from Step 3 as necessary.
7. Change the order of the added Items by dragging and dropping them on top of each other.
What’s Next?
 To save the Report Design, select Save or Save as from the menu.
Generating and Viewing Reports

Prerequisites: Creating a New Report Design
Reports are generated from the Report Designs that are displayed in the Reports tree of the
Monitoring Configuration view. There are several predefined Report Designs available.
What’s Next?
 Generating a Report (page 152)
Related Tasks
 Creating and Editing Report Designs (page 148)
Generating and Viewing Reports 151

Generating a Report
 To generate a report
2. Browse to ReportsReport Designs. The list of Report Designs opens.
Illustration 10.3 Starting a Report Task
3. Right-click a design and select Start. The Report Operation Properties dialog opens.
Illustration 10.4 Report Operation Properties - General Tab
4. Select the Period Beginning and Period End for the report. Enter the date as indicated,
and enter the time using the 24-hour clock in the time of the workstation you are using to
run the Management Client.
• The 1 Day Period option (default) defines the previous day as the reporting period,
beginning at 00:00:00 that day and ending exactly 24 hours later.
5. (Optional) Enter the delay in minutes after the end date and time in the Start Earliest field.
• Report generation begins after the specified delay has passed. The delay is to ensure
that the system has all relevant data available.
• If the Period End date and time are in the future, the report is generated on the specified
date at the specified time once the Start Earliest delay had passed.
6. (Optional) If you want to restrict the data included in the report, select a filter.
7. (Shown only when logged into the Shared Domain) If you want to make a report containing
the information concerning all Domains, select Report over All Domains.

8. (Optional) Select Notify when ready to receive a notification in the Management Client
when the report generation is complete.
What’s Next?
 If you want to select how often you want to repeat the report generation,
proceed to Defining the Report Task (page 153).
Related Tasks
 Selecting Data Sources (page 154)
Defining the Report Task

 To define the Report Task
1. (Optional) Select how often you want to Repeat the report generation (the Report Design
determines the available choices).
Illustration 10.5 Report Operation Properties - Task Tab
2. Select one or more outputs to be produced directly, or leave only Store Report selected to
view the report before deciding if you want to process it further:
• Text Export: The report is stored as a text file on the Management Server, in the
StoneGate home directory in folder <installation directory>/data/reports/
files/[Report Design name]/. The report is named according to the time range
chosen.
• PDF Export/HTML Export: The report is stored as a PDF file/HTML file on the
Management Server (same directory as above).
• Post Process: The report is generated according to options chosen and then a script is
launched, by default SgPostProcessReport.bat located on the Management Server in
the StoneGate home directory in folder <installation directory>/data/reports/
bin. See the Reference Guide for more information.

3. (Optional) Enter the Mail Address to which the completed report is sent directly out as e-
mail. To add several addresses, separate the addresses with a comma.
Note – The mail server (SMTP) for sending reports must be defined in the Management
Server’s properties. See Modifying a Management Server Element (page 302). This is a
separate setting from the one used for e-mailing alerts.
4. (For PDF exports only) Define the Page Setup settings by selecting a Style Template, Paper
Size and Orientation) when exporting the report to PDF format. For information on how to
create new Style Templates, see Adding Style Templates For PDF Output (page 51).
What’s Next?
 If you want to select the Management and Log Servers from which data is used
to generate the report, proceed to Selecting Data Sources (page 154).
 Otherwise, click OK to start generating the report. While the report is being
generated, the report task appears under the Stored Reports selection Today
in the right panel.
Selecting Data Sources

By default, the Management Server and the primary Log Server are selected as data sources.
 To select data sources

1. To select data sources, switch to the Storage tab.
Illustration 10.6 Report Operation Properties - Storage Tab
2. Select the Management Server(s) and Log Server(s) from which you want to include data in
the report.
• You can exclude a server from reporting by default, by selecting the Exclude from Log
Browsing, Statistics and Reporting option in the General tab of the server properties
dialog.
What’s Next?
 Click OK to start generating the report. While the report is being generated,
the report task appears under the Stored Reports selection Today in the right
panel.

Cancelling Ongoing Report Tasks
If the report you are generating includes large amounts of data, generating the report may take
a long time (this may be the case when, for example, the time frame is very wide and the data
filter in use does not restrict the data sources).
 To cancel an ongoing report task

2. Expand Reports and select Stored Reports.
3. Click Today to see the list of reports that are running, but have not yet finished.
4. Right-click the task you want to cancel and select Abort or Delete.
• Aborted tasks can be edited and restarted by double-clicking them.
• Deleted tasks are permanently removed.
Viewing Reports
After you have generated a report, it is available for viewing in the Stored Reports tree. A report
may be automatically deleted after a certain number of days, according to the expiry setting
defined in the originating Report Design. If you want to keep a generated report permanently, we
recommend exporting the report, as instructed in Exporting Reports (page 156).
 To view a report
2. Select ReportsStored Reports. The created reports are placed under the branches by
their creation time (Today, Yesterday, Week, Month), and in one branch that lists all created
reports.
Illustration 10.7 The Reports Tree
Tools
icon
3. (Optional) To display the reports created using a particular design, click the Tools icon and
select By Design.
4. Double-click the report you want to view. The contents of the report are shown.
5. (Optional) If you want to see the data of the report section in table format, right-click the
section and select Show Table. The table is added to the section.

Exporting Reports
Prerequisites: Generating a Report
After you have generated a report, you may want to share it or process the data further. There
are two ways to export a report: as a plain text (.txt) file, or as a PDF file. System Templates can
only be used when exporting to a PDF file.
What’s Next?
 To export a previously generated report for further processing, proceed to
Exporting a Report as Tab-delimited Text File (page 156).
 To export a previously generated report to a PDF file for viewing or printing,
proceed to Exporting a Report as a PDF File (page 156).
 To send a report directly as e-mail, proceed to E-Mailing Reports (page 157).
Exporting a Report as Tab-delimited Text File

Generated reports can be exported as tab-delimited text (.txt) files that can be imported into
other applications and processed further. If you want to use a template or the report also
contains graphics, see Exporting a Report as a PDF File (page 156).
 To export a report as tab-delimited text file

3. Right-click the title of the report you want to export and select Properties. The Properties
dialog opens.
4. Select Export from the Properties dialog. The Export File Name dialog opens.
5. Select the folder where you want to save the file.
6. Type in a File Name.
7. Select Plain text as the File type.
8. Click Save. The report is exported as a tab-delimited text file.
Exporting a Report as a PDF File

When you export a report file to PDF, a default template is automatically used as the
background for the report (if the default template is available). Optionally, a Style Template can
be selected as the background.
What’s Next?
 If you want to use the default template, proceed to Printing a Generated Report
to PDF (page 156).
Printing a Generated Report to PDF

If you want to use a Style Template for the report you are about to export (instead of the default
template), you must have the template ready on the computer you are using.

 To print a report to a PDF file
3. Double-click to open the report you want to print to PDF.
4. (Optional) To print the whole report to PDF, select FilePrint. The printing dialog opens.
5. (Optional) To print a section of the report to PDF, right-click the section you want to print and
select Print. The printing dialog opens.
6. Select the printing option:
• Select Print to PDF Reader to send the generated PDF directly to your default PDF reader.
• Select Print to File and browse to the location where you want to save the generated PDF.
7. (Optional) Select the Page Setup options for the PDF (Style Template, Paper Size and
Paper Orientation). For more information on the use of Style Templates, see Adding Style
Templates For PDF Output (page 51).
8. Click OK. The PDF is generated.
Check the output. You may have to adjust the headers and footers in your template, if the report
text or charts are placed on top of your template background (see Adding Style Templates For
PDF Output (page 51) for directions on setting the header and footer values).
E-Mailing Reports
Reports can be e-mailed directly as they are generated. You must define the mail server (SMTP)
in the Management Server’s properties before you can e-mail reports. See Modifying a
Management Server Element (page 302).
After defining the SMTP settings, simply enter the e-mail address in the report task to send the
selected output (such as PDF) out as an e-mail. To add several addresses, separate the
addresses with a comma.
Creating a System Audit Report

Prerequisites: None
The System Report contains information about the StoneGate system itself. It includes details
of Administrator and Web Client user activity and access settings, system configuration,
changes to the Firewall and IPS engines, and the configuration of the Management Server. The
System Report is intended to help you provide the required data for auditing in compliance with
regulations, such as the Payment Card Industry (PCI) Data Security Standard. The System
Report is generated, exported, and edited in the same way as other types of reports: the only
difference is the content of the report.
What’s Next?
 To generate System reports, proceed to Generating and Viewing Reports
(page 151).
Creating a System Audit Report 157

C HAPT ER 11
FILTERING DATA
Filters allow you to select data entries based on values they contain. Most frequently, you will
need filters when viewing logs, but filters can be also used for other tasks, such as exporting
logs and selecting data for reports.
Getting Started with Filtering Data (page 160)

Defining Filter Elements (page 160)
Organizing Filter Elements (page 164)
Applying Filters (page 165)
159
Getting Started with Filtering Data
Prerequisites: None
What Filters Do
Filters can be used to select data entries for operations such as filtering log entries to view in
the Logs view or include in a particular statistical report. Filters allow you to efficiently manage
the large amounts of data that the system generates. Filters select entries by comparing values
defined in the Filter to each data entry included in the filtering operation. The operation can use
the filter to either include or exclude matching data.
How Filters Are Created
You can create filters in three basic ways:
• Based on criteria you define: you can create a new filter and define any combination of
filtering criteria in the Filter properties, constructing the filter completely yourself.
• Based on other Filters: you can duplicate a Filter or copy-paste parts of Filter element
contents to other Filter elements to create a variation of previously defined filtering criteria.
• Based on existing log entries: you can create temporary filters in the Logs view and save
them as permanent Filter elements. See Filtering Logs in the Logs View (page 134).
Parts of a Filter
Filters are constructed from the following parts (see Basics of Constructing Data Filters
(page 161) for more detailed information):
• The fields that you want to match in the data (for example, there are separate fields for
source IP address and port in logs). You can filter data according to any field.
• The values in those fields that you want to match (for example, the exact port number or IP
address you are interested in).
• Operations define the way in which the fields and values are matched to data entries
(especially if there are several fields included as the filtering criteria).
Related Tasks
 Organizing Filter Elements (page 164)
 Applying Filters (page 165)
Defining Filter Elements

Prerequisites: None
Filters are stored as elements in the system and you can create and edit them in a similar way
as other elements. However, you can also create new Filters quickly in the Logs view by defining
log filtering criteria in the Filter tab of the Query Properties panel and saving the defined Query
as a Filter element. There are also some predefined Filters in the system.
160 Chapter 11 Filtering Data

Basics of Constructing Data Filters
Filters are constructed with fields, which define the type for a detail that you want to match in
the data, for example, that you want to filter with IP addresses. The fields usually have a specific
value to match (such as a particular IP address). An operation defines how the fields and values
in the filter are matched to fields and values in data.
Each field in a Filter is attached to a Comparison operation (for example, equal to, greater than,
smaller than).
Example A Filter that matches a single source IP address:
Src Addr equal to 192.168.1.101
Where “Src Addr” is a field, “equal to” is the operation and the IP address is a value. As in
these examples, operations are displayed in boldface in Filters.
You can also match several values at a time, as shown in the examples below.
Example A Filter that matches any non-empty value for destination port:
Dst Port is defined
Example A Filter that matches all destination ports between 1024 and 49152:
Dst Port between 1024 and 49152
Example A Filter that matches any of three alternative destination ports:
Dst Port in 51111, 52222, 53333
To create more complex filters, you can add logical operations NOT, AND, and OR. The NOT
operation negates the criteria you set.
Example A filter that matches all destination ports except ports between 1024 and 49152:
NOT
Dst Port between 1024 and 49152
When you add more than one field to a filter, you must define how the fields are used in relation
to each other with either AND (all field values must be present in the same entry) or OR (a data
entry matches the filter if any one field value is found).
Example A Filter that matches if the destination port is lower than 1024 and the destination is a
particular IP address:
AND
Src Addr equal to 192.168.1.101
Dst Port smaller than 1024
Example A filter that matches either of two destination ports:
OR
Dst Port equal to 80
Dst Port equal to 8080
You can apply the AND and OR operations to other AND and OR statements to create more
complex statements. You can also negate whole AND and OR sections with NOT.
What’s Next?
 To create a filter from logs, see Filtering Logs in the Logs View (page 134).
 To create a new Filter without using existing data as a basis, proceed to
Creating a Filter Element (page 162).
Defining Filter Elements 161

Creating a Filter Element
The Filter Properties dialog allows you to create detailed Filters that can match any detail in any
type of data filtering.
 To define a Filter
2. Expand the Other Elements branch.
3. Right-click Filters in the element tree and select NewFilter from the menu. The Filter
Properties window opens.
Illustration 11.1 Filter Properties
Shortcuts.
Fields lists all
possible fields
in data entries Filter
in several editing
alternative panel.
ways.
4. Enter a Name for the new Filter and an optional Comment for your reference.
5. (Optional) Select the setting for Undefined Value Policy. This setting defines how data
entries are matched when a field is included in the Filter, but is not present in the entry (for
example, if a Filter defines a range of destination ports, but the operation encounters a log
entry of traffic over a protocol that does not use ports, such as ICMP).
• False by comparison (default): If a field used in the Filter is missing from log data, the
comparison is false. The log data may still match the Filter, depending on the Filter’s
structure.
• False by filter: If the outermost operation in the Filter is undefined because of a field
missing from log data, the log data does not match the Filter.
• True by filter: If the outermost operation in the Filter is undefined because of a field
missing from log data, the log data matches the Filter.
• Undefined: If the outermost operation is undefined because of a field missing from log
data, the undefined result is passed to the software component that uses the Filter.
Whether the log data matches or not depends on the component that uses the Filter.
What’s Next?
 Define the filtering criteria as explained in Adding and Modifying Filtering
Criteria in Filters.

Adding and Modifying Filtering Criteria in Filters
The steps below explain the general workflow for constructing filters. You can also modify
existing criteria using the tools explained in this workflow. Often, you can utilize existing
definitions in new filters, for example, if you copy-paste criteria from other existing filters or save
a Logs view Query as a Filter element.
 To add criteria to a Filter

1. If there is no comparison operation (AND or OR) at the correct level, add one using the
shortcut buttons above the editing panel. You cannot add a criterion without a comparison
that defines the relationship between the criteria you add.
• You can nest comparisons to create more complex filters, for example, you can create two
AND sections under an OR condition to match either of two sets of criteria.
2. Drag and drop a log field from the Fields tab in the left panel to the expression. The Field
also adds the default operation and value for that field.
• The filters are organized in different categories. For example, Access Control contains
fields relevant to Access rules and Inspection contains fields relevant to Inspection
rules. Each field is included in several categories.
• You must drop the field on the comparison operation (the word AND or OR) in which you
want to include the field, unless the expression is empty (reads <Add expression>).
• See Log Entry Fields (page 976) for a table that describes the log fields.
3. (Optional) To change the field-specific operation, right-click the field that was added and
select the operation from the Change to submenu.
• If the field contains one or more values (such as a specific IP address), you may first have
to delete or remove the value(s) to be able to change the operation.
• The selection available depends on the selected field and whether the field already
contains one or more values. The most common of these are (see the Management
Center Reference Guide for more information):
• Equal to allows you to match a single value (for example, an IP address).
• Between allows you to match a range (for example, a range of TCP/UDP ports).
• Is Defined allows you to match any non-empty value in the field.
• In allows you to match any of several alternative values (for example, a whole
network or both an IPv4 address and an IPv6 address).
4. To change the type of the included value or add additional values (for fields and operations
that can accept changes/additions), right-click the criterion you are defining and selecting a
type of value from the Add submenu.
• This allows you, for example, to make a source IP address field accept a whole network
instead of the default single IP address, and to insert additional values into an In
operation.
5. Depending on the operation and type of field, define the value or values you want the filter
to match by typing the information, selecting an option from a list (such as a rule action) or
dragging and dropping an element into the field.
• The Is Defined operation does not include a specific value.
6. Continue adding fields in the same way until your desired criteria is defined. If you make a
mistake, you can use the Undo shortcut above the editing panel or remove items as
explained in Removing Filtering Criteria from Filters (page 164).
7. Click OK. The Filter you created is now available for use.
Defining Filter Elements 163

Removing Filtering Criteria from Filters
The steps below explain the steps and options for removing values or whole rows in Filter
elements. Note that if you want to replace a field value with a different value of the same type
(for example, replace one IPv4 address with a different IPv4 address), you can simply edit the
existing value without removing the old value.
 To remove filtering criteria from a Filter

1. Right-click the exact field/value/section you want to remove and select Remove.
• If you right-click a field that has no specific value defined, the field is removed without
further prompting.
• If you right-click a specific value (or placeholder for a value), the value and its placeholder
is removed without further prompting.
• If you right-click a field that contains a specific value or that contains several values (or
several empty placeholders for values), the Remove dialog opens.
2. If the Remove dialog opens, select which part of the criteria definition you want to remove
and click OK.
• Remove whole sub-expression deletes the whole section (the row you right-clicked and
all its subordinate rows).
• Remove one value deletes the value you select in the list (including the placeholder). The
list includes all values from the row you right-clicked (including empty placeholders).
• Remove all values deletes all values (including the placeholders) on the row that you
right-clicked.
• Remove selected expression only deletes the criteria (entire row) but leaves any
subordinate rows intact. If any of the subordinate rows are not valid to be moved up a
level, the operation will fail.
If you accidentally remove more criteria than intended, click the Undo button above the editing
panel to restore the deleted definitions.
Organizing Filter Elements

Prerequisites: Creating a Filter Element
Filters can be organized using Filter Tags. The Filter Tags you create are added as sub-branches
to the By Filter Tag branch of the filter listing. Adding Filter Tags to Filter elements you create
makes it easier to find Filters when you want to apply them to some operation. You can select
several Filter Tags for each Filter that you create as well as for any of the default filters that are
already in the system.
Creating New Filter Tags

 To create a Filter Tag
2. Expand Other Elements in the tree.
3. Right-click Filters in the tree and select NewFilter Tag. The Filter Tag Properties dialog
opens.
4. Type a Name for the Filter Tag.
5. (Optional) Enter a Comment for your own reference.

6. Click OK.
What’s Next?
 Tag Filter elements with this Filter Tag. See Changing the Tag of a Filter
(page 165).
Changing the Tag of a Filter

Filters are arranged according to Filter Tag in the By Filter Tag branch. You can select any number
of Filter Tags for Filters that you have created to organize the tree.
 To add or remove Filter Tags for Filters

2. Expand Other ElementsFilters in the tree and select one or more Filter element(s) that
you want to categorize differently.
Tip – If you are removing the Filter Tag references in Filters so that you can delete a Filter Tag, select
all filters in the All Filters branch. The selection is allowed to include filters that do not refer to
the Filter Tag you want to remove.
3. Right-click a selected Filter for a menu and do one of the following:
• Select Add TagFilter Tag and select the Filter Tag you want to add in the dialog that
opens. We recommend that you do not assign the default System Filter Tag to any Filter
element yourself.
• Select the Filter Tag you want to remove from the Remove Tag submenu. Note that you
cannot remove the System or Correlations Filter Tags from default system elements.
Alternatively, you can edit the Filter Tags of Filter elements created in your system on the Tags
tab in each Filter element’s Properties dialog.
Applying Filters
Prerequisites: None
Filters can be used for selecting data in the following tasks:

• Browsing logs, alerts, and audit data, see Browsing Logged Data (page 127).
• Browsing currently open connections on the firewall, see Monitoring Open Connections and
Blacklists (page 97).
• Creating reports, see Reports (page 145).
• Selecting which logs administrators with restricted accounts or Web Portal User accounts are
allowed to view, see Administrator Accounts (page 213).
• Defining how logs are highlighted in the Logs view, see Customizing Log Colors (page 222).
• Exporting logs to an external Syslog server, see Exporting Log Data to Syslog (page 282).
• Browsing which IP addresses, ports, and protocol are on the firewalls’ blacklists, see
Checking Open Connections and Blacklists (page 97).
• Pruning log data, see Pruning Log Data (page 807).
• Exporting and deleting log data and alerts, see Exporting Log Data (page 809) and Deleting
Log Data (page 805).
Applying Filters 165

C HAPT ER 12
DIAGRAMS
Diagrams allow you to visualize your network security environments.
Getting Started with Diagrams (page 168)

Creating Diagrams (page 169)
Defining the Diagram Background (page 169)
Adding Elements to Diagrams (page 170)
Arranging Elements in Diagrams (page 172)
Connecting Elements in Diagrams (page 173)
Creating Links Between Diagrams (page 174)
Viewing Diagrams (page 175)
Printing Diagrams (page 176)
Exporting Diagrams as Images (page 176)
167
Getting Started with Diagrams
Prerequisites: None
Diagrams allow you to generate a model of the elements you have already configured, or design
a model of your network and configure the StoneGate elements at the same time. You can also
use diagrams to view and monitor the status of the elements in your system.
What You Can Do with Diagrams
Diagrams allow you to:
• Maintain and understand the network structure.
• Monitor the status of your network graphically.
• Illustrate your network topology.
• Configure StoneGate and other network devices while designing your network.
• Store and print network topologies.
What Should I Know before I Begin
• There are three types of diagrams in StoneGate: Connectivity Diagrams that show the status
of the connections between elements that belong to the same configuration, VPN Diagrams
that show the status of VPN connections, and IP Diagrams that are diagrams of an IP
network.
• In addition to creating diagrams manually, you can create diagrams automatically from
elements that are monitored in the System Status view. The System Status view also
automatically displays a Connectivity Diagram or VPN Diagram to show the connectivity status
of an engine you select.
1. Create a new diagram (see Creating Diagrams (page 169)).
2. Define the diagram background color and image (see Defining the Diagram Background
(page 169)).
3. Insert elements to the diagrams either manually or automatically (see Adding Elements to
Diagrams (page 170)).
4. Customize the diagram layout (see Arranging Elements in Diagrams (page 172)).
5. Make manual or automatic connections between the elements in the diagram (see
Connecting Elements in Diagrams (page 173)).
6. Create relationships between diagrams (see Creating Links Between Diagrams
(page 174)).
Related Tasks
 Viewing Diagrams (page 175).
 Printing Diagrams (page 176).
 Exporting Diagrams as Images (page 176).
168 Chapter 12 Diagrams

Creating Diagrams
Prerequisites: None
Diagrams are created and modified in the Diagram Editor.

There are two methods for creating diagrams. You can create a diagram from previously
configured elements or add new elements to the Management Center and draw the diagram
simultaneously. When you create network elements as you draw the diagram, the elements are
added to the system configuration with all the other elements. If you make changes to the
configured elements (such as an IP address change), the changes are automatically updated in
your diagram. This reduces the need to update your documentation.
Illustration 12.1 Diagram Editing Toolbar in Diagram Editor

Collapse selected elements together
Zoom Arrange selected elements
Connect Add text

elements Create new elements
 To create a new diagram

1. Select ConfigurationConfigurationMonitoring from the menu.
2. Right-click Diagrams and select NewConnectivity Diagram, NewVPN Diagram, or
NewIP Diagram according to which diagram type you want to create. A blank diagram
opens.
What’s Next?
 To define Background properties, proceed to Defining the Diagram Background.
Defining the Diagram Background

Background images and colors enhance the appearance of your diagrams and make layout
easier. For example, you can use a map as the background image and arrange the elements in
the diagram according to their geographical location.
 To define the diagram background

1. Right-click the diagram and select Edit. The diagram opens for editing.
2. Right-click the diagram’s background and select Properties. The Diagram Background
Creating Diagrams 169

3. Define the background properties as explained in the table below:
Option Explanation
Color
The color of the background.
(Optional)
Select whether to use an image, a map, or an empty background.

Background
Click Select to select the image.
Watermark Select this option if you want the elements in the diagram to better stand out
(Optional) from the background image.
Keep Aspect Ratio

If this option is selected the height and width ratio of the original image is
(Only with Image
retained in the background image.
background)
Width
(Only with Image The width of the background image as pixels/inch.
background)
Height
(Only with Image The height the background image as pixels/inch.
background)
4. Click OK.
What’s Next?
 To continue defining a new diagram, proceed to Adding Elements to Diagrams
(page 170).
Adding Elements to Diagrams

Prerequisites: Creating Diagrams
This section instructs you on how to add new elements to diagrams both manually and
automatically.
What’s Next?
 If you want to insert new elements to Diagrams manually, proceed to Inserting New
Elements Manually (page 171).
 If you want to create Diagrams from Configured Elements manually or automatically,
proceed to Creating Diagrams from Configured Elements (page 171).
Related Tasks
 Adding Text Comments to a Diagram (page 172).

Inserting New Elements Manually
 To insert a new element to a diagram manually
1. Select the type of element you want to create in the toolbar and click the diagram in the
place where you want to add the element. The new element appears greyed-out because it
has not been configured yet.
2. Double-click the new element. The Properties dialog for that element opens.
3. Define the element’s properties. For more information, see Defining IP Addresses
(page 561).
4. Click OK. The newly configured element is no longer greyed-out, and it is added to the
appropriate category in the All Elements list.
What’s Next?
 To change the diagram layout, see Arranging Elements in Diagrams (page 172).
Creating Diagrams from Configured Elements

In addition to creating IP Diagrams, VPN Diagrams, and Connectivity Diagrams manually from
configured elements, you can also generate all types of diagrams automatically from the
elements that are monitored in StoneGate. The monitored elements are displayed in the System
Status view.
Automatically generated IP Diagrams and VPN Diagrams are based on routing information, so
they show elements that belong to the same routing configuration. Automatically generated
Connectivity Diagrams contain elements that belong to the same configuration as defined in
server, firewall engine, and IPS engine properties.
 To create a diagram from configured elements

1. Right-click Diagrams and select NewConnectivity Diagram, NewVPN Diagram, or
NewIP Diagram. A blank diagram opens.
2. Browse to the type of element you want to add to the diagram.
3. (In automatic diagram creation) Select an element that is monitored from the list in the
Resources panel and drag and drop it in the diagram.
4. Add the elements to the diagram.
• (In automatic diagram creation) Right-click the element’s icon and select Auto
GenerateAdd from Configuration or Auto GenerateAdd from Routing. The elements
that belong to the same configuration or routing configuration are added to the diagram.
The links between the elements are also added automatically.
• (In manual diagram creation) Drag the existing elements from the list in the Resources
panel and drop them in the diagram.
5. Click the Save button. The Network Diagram Properties dialog opens.
6. Name the diagram and add a free-form comment for your own reference (optional).
7. (Optional) Select a parent diagram for the new diagram.
8. Click OK.
Adding Elements to Diagrams 171

You can edit the automatically generated diagram in the same way as any diagram. For example,
you can add more elements to the diagram by dragging and dropping configured elements from
the list in the Resources panel. This may be useful for documenting your system although the
elements may not belong to the same configuration.
What’s Next?
Adding Text Comments to a Diagram

 To add text comments to a diagram
1. Click the Text Tool button in the toolbar.
2. Click the diagram in the place where you want to add the comment. The Text Properties
dialog opens.
3. Select the desired font properties and type in the comment.
4. Click OK. The comment appears in the diagram.
5. If necessary, select the comment and drag it in the diagram to change its position.
What’s Next?
Arranging Elements in Diagrams

To move the elements, click the Hand Tool button in the toolbar and drag and drop the
elements to their places. In addition to moving individual elements by dragging and dropping,
you can also use the Hand Tool to move all the elements in a diagram.
Alternatively, you can change the layout of your diagram by selecting one of the automatic layout
options.
 To change the layout automatically

1. Click the Select Components tool (arrow button) in the toolbar.
2. Select the elements you want to arrange.
3. Select ToolsLayout and one of the options. The selected elements in the diagram are
arranged in the layout you chose.

Connecting Elements in Diagrams
After you add elements to a diagram, you can connect the elements automatically or manually.
The automatic connections are based on the IP addresses of the elements or on the Routing
configuration.
To help you maintain the clarity of your diagrams, you can also use turning points. Turning points
are useful, for example, in complex diagrams where connections would otherwise cross each
other.
A turning point is created by clicking the Add Turning Point button in the toolbar, clicking in the
middle of the connection between the two elements and dragging the turning point to the
direction of your choice to create an angle.
Connecting Elements Automatically

 To connect elements automatically in an IP Diagram
1. Click the Select Components button in the toolbar.
2. Select the elements you want to connect.
3. Select ToolsAuto Connect by Routing or ToolsAuto Connect by Addresses from the
menu. The connections between the elements appear.
Related Tasks
 Creating Links Between Diagrams (page 174).
Connecting Elements Manually

 To connect elements manually
1. Click the Connection Tool button in the toolbar.
2. Click the first element to be linked.
3. Drag the pointer to the second element, and release the left mouse button. The elements
are connected unless the connection is not allowed. You may have to insert a Network
element in between two elements before you can connect them.
If the connection has a red, crossed-out circle on it, the connection is not valid. This can
happen, for example, if you connect an element to a network with an address range that does
not include that element’s IP address. Such connections are allowed so that you can plan a
configuration change without actually editing the elements until you are finished.
Related Tasks
 Creating Links Between Diagrams (page 174)
Connecting Elements in Diagrams 173

Creating Links Between Diagrams
You can specify a parent diagram to organize the diagrams into a hierarchy. You can also create
links between diagrams that share the same parent diagram.
What’s Next?
 To select a parent diagram, see Specifying a Parent Diagram.
 To create links between diagrams, see Creating Links from One Diagram to Another
(page 174).
Specifying a Parent Diagram

Parent diagrams allow you to organize diagrams in a hierarchy. For each diagram, you can
specify another diagram as its parent diagram. All diagrams that have the same parent diagram
are shown as branches below the parent diagram in the tree.
 To specify a parent diagram

1. Right-click the diagram for which you want to specify a parent diagram and select
Properties. The Properties dialog opens.
2. Click Select. The Select Element dialog opens.
3. Select a parent diagram from the diagram list and click Select.
4. Click OK.
Your diagram is now displayed as a branch under the selected parent diagram in the tree.
What’s Next?
 Creating Links from One Diagram to Another (page 174)
Creating Links from One Diagram to Another

You can attach links to any of the elements in the diagram. When you double-click a link, another
diagram opens. When you have a large network, linking allows you to use just a network icon to
represent individual network segments in a top-level diagram, and then create links from them
to more detailed diagrams.
Before you can add a link, you must have at least two diagrams under the same parent diagram.
Note – You cannot create links between two diagrams that have different parent diagrams.
 To add a diagram link to an element

1. Right-click the element you want to function as a link, and select Link To. The Select Link
Target dialog opens.
2. Select the diagram to link to and click Select.
3. Click the Save button in the toolbar to save the diagram.

Viewing Diagrams
 To open a diagram for viewing

 Right-click the diagram you want to open and select Preview Connectivity Diagram,
Preview VPN Diagram or Preview IP Diagram from the menu. The selected diagram
opens for viewing.
Adjusting the Element Details in Diagrams

The details of the elements (name, IP address, type, etc.) can be shown as text below the
elements in the diagram and as tooltips that only show when you place the mouse pointer over
an element in a diagram.
 To select details shown below the elements

1. Select ViewDiagram Attribute Level from the menu.
2. Select one of the items to adjust which details (No Labels, Names Only, Main Details, All
Details) are shown below each element in the diagram.
 To select details shown as tooltips

1. Select ViewTooltip Attribute Level from the menu.
2. Select one of the items to adjust which details (No Tooltips, Names Only, Main Details, All
Details) are shown as tooltips for each element when you place the mouse pointer on them
in the diagram.
Collapsing and Expanding Groups of Elements in Diagrams

You can collapse and expand clustered elements (for example a firewall or sensor cluster) or
groups of elements (any group of elements you select) to hide the individual nodes or elements.
This can make a complicated diagram much simpler, as the individual items can be viewed only
when needed. This can be done while viewing as well as editing diagrams.
 To collapse elements
1. Click the Select Components button (arrow button) and select two or more elements, or at
least one of the nodes belonging to an expanded cluster.
2. Click the Collapse Selected Component(s) button in the toolbar. If several elements were
selected, they are now shown as a single cloud with the tooltip Collapsed Area. Clustered
elements are collapsed into an appropriate cluster icon.
 To expand elements
1. Select a clustered element or a group of collapsed elements by clicking its icon.
2. Click the Expand Selected Component(s) button in the toolbar. The individual nodes or
elements are displayed. The nodes are shown with a yellow sign containing a minus sign to
illustrate their association to an expanded cluster.
Viewing Diagrams 175

Zooming and Navigating Diagrams
In addition to the various tools for zooming the diagram (Zoom In, Zoom Out, etc.), you can also
use the Diagram Navigation tool which offers you a quick way to zoom into selected parts of the
diagram.
 To use the Diagram Navigation tool

1. If the Diagram Navigation panel is not displayed, select View Diagram Navigation to
activate the Diagram Navigation tool.
2. Click and drag in the area outside the black rectangle to zoom in and out.
3. Click inside the black rectangle to adjust which part of the diagram is shown.
4. Select ViewZoomDefault Zoom to see the default zoom view again.
Printing Diagrams
You can directly print the diagrams with your printer.
 To print a diagram
1. Open the diagram you want to print (see Viewing Diagrams (page 175)).
2. (Optional) Select FilePrint Preview. A preview opens.
3. (Optional) Select the print area by dragging the white box to the part of the diagram you
want to print.
4. (Optional) Adjust the print area size by dragging the border of the white box.
5. Click the Print button in the toolbar.
Exporting Diagrams as Images

You can export the diagrams that you have created. You can save diagrams in various graphics
file formats or as a PDF document.
 To export a diagram
1. Open the diagram you want to export (see Viewing Diagrams (page 175)).
2. Select FileExport. The Export dialog opens.
Note – To export the diagram as an image, select the Export item at the main level of the
File menu. Exporting through the Export sub-menu creates an XML export file.
3. Select the folder into which you want to save the diagram.
4. Enter a File name.
5. Select the format from the Files of Type list.
6. Click Export. The diagram is saved with the file name and format you specified.

C HAPT ER 13
INCIDENT CASES
When suspicious activity is detected, it is important to collect all the information about the
incident and act quickly. The Incident Cases element is a tool for investigating incidents of
suspicious activity.
Getting Started with Incident Cases (page 178)

Creating a New Incident Case (page 179)
Setting an Incident Context (page 179)
Attaching Data to Incident Cases (page 180)
Adding Players to Incident Cases (page 183)
Adding Journal Entries to Incident Cases (page 183)
Working With Existing Incident Cases (page 184)
177
Getting Started with Incident Cases
Prerequisites: None
What Incident Cases Do

The Incident Cases element allows you to gather together all the data, actions, system
configuration information, and files related to a specific incident. This information is useful for
effective incident investigation, and also helps to provide evidence in the case of legal action.
Limitations of Incident Cases
When you write a Memo in an incident case, text does not automatically wrap in the Incident
Memo Properties dialog. You must press Enter at the end of each line if you want your text to
break to a new line.
Memos are permanently deleted when you remove them from an incident case. Other types of
attachments can be added again if you remove them by mistake. See Attaching Data to
Incident Cases (page 180).
Illustration 13.1 Elements in the Configuration of Incident Cases
Data Collection Tab Player List Tab
1. Create an incident case. See Creating a New Incident Case (page 179).
2. Attach relevant Logs, Policy Snapshots, Memos and files to the incident case. See
Attaching Data to Incident Cases (page 180).
3. Add the network elements involved in the incident to the incident case. See Adding Players
to Incident Cases (page 183).
4. Add journal entries to the incident case. See Adding Journal Entries to Incident Cases
(page 183).
What’s Next?
 To begin the configuration, proceed to Creating a New Incident Case (page 179).
178 Chapter 13 Incident Cases

Creating a New Incident Case
Prerequisites: None
 To create a new incident case

2. Right-click Incident Cases and select New Incident Case. The Incident Case Properties
dialog opens.
Illustration 13.2 Incident Case Properties
3. Enter a unique Name, (optional) Comment, and (optional) Priority.

• Priority information is for your own reference, and is not used by the system.
• The State cannot be changed during the creation of the new incident case. To change the
state, see Changing the State of an Incident Case (page 185).
4. Click OK. The new incident case opens for editing.
Setting an Incident Context

 To set the Incident Context
1. Select ViewLayout from the menu, and select Incident Context Toolbar. The Incident
Context selection appears in the toolbar.
2. Select the Incident Case to which you want to add information. The status bar switches to
orange when an Incident Case is selected.
What’s Next?
 Attach Logs, Policy Snapshots, Memos, and files to the Incident Case as instructed in
Attaching Data to Incident Cases (page 180).
 Add Players to the Incident Case as instructed in Adding Players to Incident Cases
(page 183).
 Write Journal entries as instructed in Adding Journal Entries to Incident Cases
(page 183).
Creating a New Incident Case 179

Attaching Data to Incident Cases
Prerequisites: Creating a New Incident Case, Opening an Incident Case for Editing
You can use the Data Collection tab to attach information that is needed to provide context for
investigating the incident.
The types of data that can be attached to an incident case are Logs, Policy Snapshots, Memos,
and Files.
What’s Next?
 To attach Logs, see Attaching Logs and Audit Entries to Incident Cases (page 180).
 To attach Policy Snapshots, see Attaching Policy Snapshots to Incident Cases
(page 181).
 To write and attach Memos, see Attaching Memos to Incident Cases (page 182).
 To attach other types of files, see Attaching Files to Incident Cases (page 182).
Attaching Logs and Audit Entries to Incident Cases

You can attach selected single logs or audit entries, selected groups of logs or audit entries, or
all logs or audit entries that match your query criteria to an incident case. It is also possible to
attach log and audit data to incident cases directly from the Logs view.
 To attach logs or audit entries

1. Select FileAttachLogs in the Data Collection tab of the incident case. The Logs view
opens.
2. (Optional) To restrict the data that is displayed, specify your search criteria in the Query
panel. See Filtering Logs in the Logs View (page 134) for details.
3. To attach a single log or a selected group of logs, select the log(s) you want to attach, right-
click the selection and select ExportAttach Log Events to Incident. To attach all logs
that match your filtering criteria, right-click any log entry and select ExportAttach Log
Events to Incident. The Attach Logs to Incident Case dialog opens.
Illustration 13.3 Attach Logs to Incident Case

4. Enter a unique Description for the log(s). This is used as the name of the data item in the
Incident Case.
5. Select Other from the Incident Case Target pull-down list. The Select dialog opens.
6. Select the Incident Case that you want to attach the logs to and click Select.
7. Specify which logs you want to Attach:
• Select Selected logs to add only the specific log entries you selected.
• Select Filtered logs from to add all the log entries that match your query criteria.
8. (Optional) Select Create Link Only if you want to create a reference to the logs without
duplicating the log files.
9. (Optional) Select Create also Players based on the following log fields and select the
fields if you want to automatically fetch the player information related to these logs.
10.(Optional) Select Time out to automatically stop the export if it takes too long.
11.Click OK. The selected log(s) are attached to the incident case and appear in the Data
Collection tab.
What’s Next?
 To attach Policy Snapshots, see Attaching Policy Snapshots to Incident Cases
(page 181).
 To write and attach Memos, see Attaching Memos to Incident Cases
(page 182).
 To attach other types of files, see Attaching Files to Incident Cases
(page 182).
 If you are finished working with data attachments, add players as instructed in
Adding Players to Incident Cases (page 183) or add journal entries as
instructed in Adding Journal Entries to Incident Cases (page 183).
Attaching Policy Snapshots to Incident Cases

Policy Snapshots help to establish which policies were in place at the time of the incident.
 To attach a policy snapshot

1. Select FileAttachPolicy Snapshot in the Data Collection tab. The Select Policy
Snapshot dialog opens.
2. Select the policy snapshot you want to attach and click Select. The policy snapshot is
attached to the incident case and appears in the Data Collection tab.
What’s Next?
 To write and attach Memos, see Attaching Memos to Incident Cases
(page 182).
(page 182).
 Otherwise, if you are finished working with data attachments, add players as
instructed in Adding Players to Incident Cases (page 183) or add journal
entries as instructed in Adding Journal Entries to Incident Cases (page 183).
Attaching Data to Incident Cases 181

Attaching Memos to Incident Cases
Memos allow you to take notes about the incident. You can copy and paste from the clipboard
into a memo. Memos can be edited and deleted after they are added to the incident case. If you
want to add permanent, read-only comments and notes about the incident, see Adding Journal
Entries to Incident Cases (page 183).
 To attach a memo
1. Select FileAttachMemo in the Data Collection tab. The Incident Memo Properties
dialog opens.
2. Give the memo a descriptive Name. This is used as the name of the data item in the
incident case.
3. Type or paste the text of the memo in the Text field.
4. Click OK. The memo is added to the Data Collection list.
What’s Next?
(page 182).
 Otherwise, if you are finished working with data attachments, add players as
instructed in Adding Players to Incident Cases (page 183) or add journal
entries as instructed in Adding Journal Entries to Incident Cases (page 183).
Attaching Files to Incident Cases

You can attach any type of files, such as saved reports, text files, saved e-mail messages,
packet capture files, or screen captures to incident cases. If you want to attach a newer version
of a file, you must first remove the existing attachment from the incident case.
 To attach a file
1. Select FileAttachFile in the Data Collection tab. The Open dialog opens.
2. Browse to the file you want to attach. Select the file and click Open. The file is added to the
Data Collection list.
What’s Next?
 If you are finished working with data attachments, add players as instructed in
Adding Players to Incident Cases (page 183) or add journal entries as

Adding Players to Incident Cases
Prerequisites: Creating a New Incident Case
A player is any element that was involved in the incident. The related players can be fetched
automatically when attaching logs or audit entries (see Attaching Logs and Audit Entries to
Incident Cases (page 180)), or you can add players manually. Alternatively, you can copy and
paste elements into the Player List tab of an incident case.
 To add a player
1. Select FileNew Player in the Player List tab. The Player Properties dialog opens.
2. Give the player a unique Name. This name is used in the Player List.
3. Enter the IPv4 Address of the player or enter the DNS Name of the player and click
Resolve to resolve the DNS name to an IP address. Elements shows a list of player
elements.
4. (Optional) Add a Comment.
5. Click OK. The player is added to the Player list.
What’s Next?
 If you are finished working with the player list, attach data as instructed in
Attaching Data to Incident Cases (page 180) or add journal entries as
Adding Journal Entries to Incident Cases

The journal allows you to record your observations and comments about administrator actions
during the incident investigation. This is especially useful when more than one administrator is
investigating the same incident simultaneously. Journal entries are automatically marked with a
timestamp, and once a journal entry is added, it cannot be removed.
 To add a journal entry

 Type the journal entry in the Additional Comment field and click Commit. The journal
entry is added to the list.
Adding Players to Incident Cases 183

Working With Existing Incident Cases
After you have created an incident case, you can edit the contents and properties of the incident
case as needed.
What’s Next?
 To open an existing incident case, see Opening an Incident Case for Editing
(page 184).
 To change the priority of the incident case, see Changing the Priority of an Incident
Case (page 184).
 To change the state of the incident case, see Changing the State of an Incident Case
(page 185).
 To check the incident history, see Checking Incident History (page 185).
Opening an Incident Case for Editing

 To open an incident case for editing
2. Select Incident Cases in the tree view.
3. Right-click the incident case you want to open and select Edit Incident Case. The Incident
Case view opens for editing.
4. Edit the Incident Case as needed:
• Attach data (see Attaching Data to Incident Cases (page 180)).
• Add players (see Adding Players to Incident Cases (page 183)).
• Write journal entries (see Adding Journal Entries to Incident Cases (page 183)).
Changing the Priority of an Incident Case

The default Priority of an incident case is Low when an incident case is created. The Priority
information is only for your own reference, and it is not used by the system. As the investigation
of the incident case progresses, you can change its priority as necessary.
 To change the priority of an Incident Case

1. Right-click the Incident Case you want to change the priority for and select Properties. The
2. Select the new Priority and click OK.
What’s Next?
 To change the state of the incident case, see Changing the State of an
Incident Case (page 185).

Changing the State of an Incident Case
The default State of an incident case is Open when an incident case is created. The State
information is only for your own reference, and it is not used by the system. As the investigation
of the incident case progresses, you can change its state accordingly.
 To change the state of an Incident Case

1. Right-click the Incident Case you want to change the state for and select Properties. The
2. Select the new State:
• Open: The incident case has been created, but investigation has not begun.
• Under Investigation: The incident case is actively being investigated.
• False Positive: Legitimate activity was incorrectly interpreted as suspicious. There is
actually no incident.
• Closed: The investigation is finished.
3. Click OK. The state of the incident case is changed.
What’s Next?
Checking Incident History

The Incident History tab shows all the logs and audit entries that track actions performed in this
Incident Case view.
 To check the incident history

 Select ViewIncident History. The Incident History tab opens.
Working With Existing Incident Cases 185

C ONTROLLING E NGINES
In this section:
Controlling Engine Operation - 189
Stopping Traffic Manually - 197
Working on the Engine Command Line - 201
187
188
C HAPT ER 14
CONTROLLING ENGINE OPERATION
This section explains the commands and options available for firewall and IPS engines, as
well as some common tasks related to changing their configuration.
Commanding Engines Remotely (page 190)

Commanding Engines Locally (page 192)
Setting Engine Options (page 192)
Changing NetLink State Manually (page 195)
Disabling/Enabling Cluster Nodes (page 195)
Editing Engine Configurations (page 196)
189
Commanding Engines Remotely
Prerequisites: The engines must have a valid working configuration
You can control all engines remotely through the Management Client through the corresponding
element’s right-click menu. The commands available depend on the type of component. In a
cluster, the commands that affect the operating state of the engines can only be given to the
individual nodes one by one, not to the whole cluster.
You can also give commands and set options for more than one engine at a time by Shift- or Ctrl-
selecting the elements.
This subject is covered in the following topics:
• Turning Engines Online (page 190)
• Turning Engines Offline (page 191)
• Setting Nodes to Standby (page 191)
• Rebooting Nodes (page 191)
• Refreshing the Currently Installed Policy (page 192)
Turning Engines Online

Engines in the offline state (status icon is blue and status text reads offline) can be turned
online through the right-click menu if there are no configuration issues that would prevent the
node/cluster from operating normally. Typical issues that may prevent a node from going online
include an incorrect working configuration (policy), automatic tests failing, or heartbeat
connection problems between nodes in clusters (see Node Does not Go or Stay Online
(page 876) for more information).
Note – You may also be able to give commands to nodes in the unknown state (grey icon),
but you will not see a change of status. Since the actual operating status is not available,
the node may already be online, in which case you will receive an error if you try to
command the node online.
 To command a firewall or sensor engine to go Online

2. Expand the tree until you see the individual engine nodes.
3. Right-click the offline engine node and select either of the following:
• CommandsGo Online: the selected node goes to the online state and starts
processing traffic according to the installed policy.
• CommandsLock Online: The node goes online and stays online even if a process tries
to change its state. Serious error conditions can still force the node to go offline.
4. Click OK to confirm your command. The status is updated shortly.
Note – If the cluster is set to standby mode, only one node at a time can be online.
Commanding a standby node online switches the online node to standby. See Adjusting
Firewall Clustering Options (page 419).
190 Chapter 14 Controlling Engine Operation

Turning Engines Offline
In the offline state, engines stop processing traffic, but remain otherwise operational and ready
to be turned online again either automatically or by an administrator’s command, depending on
the selected configuration.
Caution – When you turn a node offline, it stops processing traffic. On firewalls, traffic is
stopped unless there are other cluster nodes that can take over.
 To command a firewall or sensor engine to go offline

3. Right-click the online or standby node and select either of the following:
• CommandsGo Offline: the selected node goes offline and stops processing traffic.
• CommandsLock Offline: the node goes offline and stays offline even if a process tries
to change its state.
Setting Nodes to Standby

When a cluster runs in standby mode, only one node at a time is processing traffic; the other
running nodes are on standby. Standby nodes keep track of the traffic so that they can take over
if the active node fails. Only one node at a time is in the online state, and the rest are either in
the standby or offline state.
When you command an online node to standby, a standby node in the cluster (if there is one)
automatically goes online to take over the traffic.
 To command a firewall or sensor engine to Standby

3. Right-click an Offline or Online node and select CommandsStandby from the menu
opens. A confirmation dialog is displayed.
Rebooting Nodes
Caution – If you are rebooting a cluster, reboot the nodes one by one to avoid cuts in
service. If you command all nodes to reboot, the nodes will reboot all at once.
 To reboot a node
3. Right-click the node and select CommandsReboot. A confirmation dialog is displayed.
4. Click OK to confirm your command. You can monitor the rebooting process by following the
changes in the status of the element.
Commanding Engines Remotely 191

Refreshing the Currently Installed Policy
You can reinstall the currently installed policy of one or more components to transfer any
configuration changes you have made in the system or in the policy itself since the last policy
installation. The IPS policy is installed only on Sensors. The Analyzer automatically receives its
policy when the IPS policy is refreshed on the Sensor.
Note – In clusters, all nodes must be either operational or explicitly disabled for the policy
installation to succeed (see Disabling Nodes of a Cluster Temporarily (page 195)).
 Refreshing the currently installed policy

2. Expand the tree until you see the top-level engine elements.
3. Right-click the engine and select Current PolicyRefresh. The Task properties dialog
opens.
• Click the top-level cluster icon, not the individual node(s) under the main icon.
• SOHO Firewalls do not have policies. Select ConfigurationApply Configuration instead
for a SOHO firewall.
4. Click OK.
Related Tasks
 Creating and Managing Policy Elements (page 497).
Commanding Engines Locally

Prerequisites: None
Under normal circumstances, you should control the engines remotely through the Management
Client. For abnormal situations, there are limited tools for giving some basic commands (such
as go online/offline) through the engine’s command line interface:
• The available tools are listed in Engine Commands (page 926).
• For information on how to access the engine command line, see Getting Started with the
Engine Command Line (page 202).
Setting Engine Options

Prerequisites: None
Enabling/Disabling Engine Status Monitoring

By default, monitoring is automatically activated for all engines, but can be turned off as
necessary.
 To disable/re-enable Firewall or Sensor monitoring

3. Right-click an engine element and browse to Options in the menu that opens.

4. Deselect/select Monitored. Shortly, the status changes to Not Monitored and the icons
associated with the element turn white.
Enabling/Disabling Firewall/VPN Diagnostics

Diagnostics mode provides more detailed log data for troubleshooting purposes. Diagnostics
are only available for firewalls, excluding SOHO Firewalls.
Note – Disable the diagnostics after troubleshooting to avoid overloading the Log Server
with log data.
 To enable/disable diagnostics
3. Right-click the Firewall/Firewall Cluster element on which you want to apply diagnostics and
select OptionsDiagnostics. The Diagnostics dialog opens.
4. Select/deselect the Diagnostic option at the top.
5. Select the diagnostic modes you want to apply to the selected Firewall/Firewall Cluster
when diagnostics are enabled.
6. Click OK. The changes are applied immediately.
Disabling/Enabling User Database Replication

Firewall engines have a local replica of the Management Server’s internal LDAP database, which
can store accounts for end-users for authentication purposes. By default, all changes are
immediately replicated from the Management Server’s database to the local replicas on firewall
engines, but you have the option to disable the replication.
 To disable/re-enable firewall user database replication

3. Right-click a Firewall element and browse to Options in the menu that opens.
4. Deselect/select User DB Replication.
Enabling/Disabling Status Surveillance

By default, there is no warning to administrators if the status of the engines changes to an
unknown state. You can optionally activate the status surveillance feature, which generates an
alert if a single engine or none of the engines in a cluster send a status update for 15 minutes.
 To enable/disable engine status surveillance

3. Right-click an engine element and browse to Options in the menu that opens.
Setting Engine Options 193

4. Select/deselect Status Surveillance.
What’s Next?
 Make sure System Alerts are escalated so that notification is sent out if status
surveillance detects a failure. See Getting Started with Alert Escalation (page 230).
Enabling/Disabling SSH Access to the Engine

Secure remote access to the engines is provided by the SSH daemon process. This process can
be started and stopped remotely as explained in this section. For maximum security, we
recommend you disable SSH access whenever it is not used.
Alternatively, you can enable and disable SSH access when logged in on the node as explained
in Reconfiguring Basic Engine Settings (page 203).
SSH uses TCP port 22. Make sure the connections are allowed in the policies of any firewalls
involved in the communications (including the firewall that you are trying to contact).
 To enable/disable SSH access

3. Right-click a node and select CommandsEnable SSH or CommandsDisable SSH. The
SSH process is started or stopped on the engine.
Changing the Engine Password

The password for access to the engine command line can be changed remotely through the
Management Client as explained in this section. The user account for command line access is
always root.
Alternatively, if you remember the old password, you can change the password when logged in
on the node as explained in Reconfiguring Basic Engine Settings (page 203).
 To change the command line password remotely

3. Right-click a node and select CommandsChange Password. The Change Password dialog
opens.
4. Type in the new password in both fields and click OK. The new password is effective
immediately.

Changing NetLink State Manually
Prerequisites: Creating NetLinks, Creating an Outbound Multi-Link Element
To change a NetLink’s state, it must be operational. NetLinks with grey (unknown) status cannot
be commanded.
 To change NetLink state manually

1. Select MonitoringSystem Status. The System Status view opens.
2. Expand the Multi-Link branch and the correct firewall underneath to view the firewall’s
NetLinks.
3. Right-click the NetLink whose state you want to change and select:
• CommandsForce NetLink Enable to set the NetLink to a permanently active state
regardless of probing results.
• CommandsForce NetLink Disable to set the NetLink to a permanently disabled state
regardless of probing results.
• CommandsReset to Auto to return the NetLink to automatic operation in which the
NetLink is used based on probing results.
Disabling/Enabling Cluster Nodes

Prerequisites: None
Disabling Nodes of a Cluster Temporarily

Disabling a node is required to allow continued management of the other cluster members if
one node goes out of operation. When you disable a node, you can physically remove it from the
cluster without removing its definition from the system.
Disabling the node tells the other nodes and the Management Server that it is not necessary to
try to contact it, preventing unnecessary communications attempts, alerts, test failures, etc.
Disabling a node also allows policy installations on the other nodes when one node is shut
down or malfunctions. No commands can be sent to a disabled node and no monitoring
information is available for it.
 To disable a node in a cluster

3. If the node is online, right-click the node that you want to disable and select
CommandsLock Offline.
4. Double-click the cluster element. The properties dialog for the cluster opens.
5. In the Nodes table on the Cluster tab, select the Disabled option for the node(s) you want
to disable and click OK.
6. Refresh the policy of the cluster.
When you re-enable the node, follow the procedure explained in Re-Enabling Disabled Cluster
Nodes (page 196).
Changing NetLink State Manually 195

Re-Enabling Disabled Cluster Nodes
When a cluster node has been disabled, its configuration is typically made obsolete by policy
installations done on the other members. This prevents the node from operating normally and
may in some cases disturb the operation of the whole cluster. Follow the procedure below to
make the node operational.
 To enable a node in a cluster

1. (Recommended) Before connecting the disabled node (the same physical device or a
replacement) into the operational networks, set the node in the initial configuration state
using the sg-reconfigure command on the engine command line. See Reconfiguring
Basic Engine Settings (page 203).
Caution – If you re-introduce a disabled node that has a working configuration, the node
must receive the heartbeat traffic from other nodes and accept it (based on certificates),
or the node will consider itself the only available cluster member and go online. This may
prevent the whole cluster from processing traffic.
2. Double-click the cluster element. The properties dialog for the cluster opens.
3. In the Nodes table on the Cluster tab, deselect the Disabled option for the node(s) you
want to re-enable and click OK.
4. Refresh the security policy to ensure that all nodes have the same configuration.
• If the policy installation is unsuccessful, return the previously disabled node to the initial
configuration state, see Reconfiguring Basic Engine Settings (page 203).
5. (Optional) Right-click the node and select CommandsGo Online or CommandsStandby
to return the node to operation.
Editing Engine Configurations

Prerequisites: None
The engines can be configured in the following ways:

• The network card drivers, mapping of physical interfaces on the network cards to Interface
IDs, and speed/duplex settings are defined using the configuration wizard on the engine
command line. See Reconfiguring Basic Engine Settings (page 203).
• Other engine-specific settings are defined in the engine elements’ properties in the
Management Client. See Modifying Existing Engine Elements (page 323).
• The routing information is defined mostly in the Routing view (see Configuring Routing
(page 439)). However, static ARP entries, multicast routing, and policy routing are defined in
the engine element’s properties. See Modifying Existing Engine Elements (page 323).

C HAPT ER 15
STOPPING TRAFFIC MANUALLY
The Access rules mainly determine which traffic is stopped, but you can also terminate or
blacklist connections manually when you want the action to be temporary.
Terminating Connections Manually (page 198)

Blacklisting Connections Manually (page 198)
197
Terminating Connections Manually
Prerequisites: None
On firewalls, you can terminate any current connection, for example, to remove an inactive
connection that has not been properly closed. Terminating an open connection alone does not
prevent any new connection from opening again immediately or later on. This action is not
available for SOHO firewalls or IPS engines.
 To terminate a connection manually

1. Select MonitoringConnections from the menu.
2. Select a firewall from the list. The Connections view for the selected firewall opens.
3. Select one or more connections in the table (use Shift-select or Ctrl-select to select more
than one).
4. Right-click a selected row and select Terminate. For each selected connection, a
confirmation message appears with information about the connection. When you click Yes,
the firewall terminates the connection.
Related Tasks
Blacklisting Connections Manually

Prerequisites: Enabling Blacklist Enforcement
You can blacklist traffic manually on both firewalls and sensors, for example, to temporarily
block a suspicious or disruptive source of communications while you conduct further
investigations. You can create blacklist entries in the Blacklist view, Connections view,
Monitoring view, and Logs view. The blacklist is not necessarily applied to all traffic; the Access
rules determine how the blacklist is used. This action is not available for SOHO firewalls.
Manual blacklisting from the Management Client requires the IPv4 Access rules to have an
Apply Blacklist rule with the Management Server as an Allowed Blacklister.
Note – If a connection is allowed by a rule placed above the blacklist rule in the Access
rules, the connection is allowed regardless of the blacklist entries. Check the logs to see
which connections are discarded based on blacklisting.
 To create manual blacklist entry

1. Create a new blacklist entry in one of the following ways:
• In the Blacklist view, Connections view, or Logs view: Right-click a row in the table and
select New Blacklist Entry or New Entry.
• To create a blacklist entry for a specific firewall or sensor: right-click the Firewall or Sensor
element in the Connections view, Monitoring view, or Logs view, and select New Blacklist
Entry or BlacklistNew Entry.
198 Chapter 15 Stopping Traffic Manually

Illustration 15.1 Blacklist Entry Properties
Leaving Duration as 0
cuts only the current
connections.
Port ranges are

available only if the
protocol is TCP or UDP.
Only IPv4 addresses

can be blacklisted.
2. Select the Duration for how long this entry will be kept.
• If you leave the value as 0, the entry only cuts the current connections. Otherwise, the
entry is enforced for the specified period of time.
3. Select the Address to blacklist for Endpoint 1 and Endpoint 2.
• Any: Matches any IP address.
• Predefined: Matches the specific IP address you enter in the field to the right of the
Address type list.
4. Select the Port to blacklist for Endpoint 1 and Endpoint 2.
• Ignored: Matches any port.
• IPredefined TCP and Predefined UDP: Matches the specific source and destination ports
that you enter in the fields to the right of the Port type list.
5. (Optional) Change the Netmask for Endpoint 1 and Endpoint 2 to define the range of IP
addresses that are blacklisted.
• For example, the netmask 255.255.255.0 blacklists all the addresses in the same C-
class network.
• The default netmask 255.255.255.255 blacklists only the specific IP address you enter.
6. Select the Blacklist Executors that enforce the blacklist entry. The executors must be
configured to accept blacklist requests from the Management Server.
7. Click OK. The blacklist entry is sent to the executor and the traffic is blocked.
Related Tasks
 Enabling Blacklist Enforcement (page 680)
 Configuring Automatic Blacklisting (page 681)
 Editing Access Rules (page 518)
Blacklisting Connections Manually 199

200 Chapter 15 Stopping Traffic Manually
C HAPT ER 16
WORKING ON THE ENGINE COMMAND LINE
This section includes instructions for using the engine command line.
Getting Started with the Engine Command Line (page 202)

Accessing the Engine Command Line (page 202)
Reconfiguring Basic Engine Settings (page 203)
Creating Engine Scripts (page 204)
Restoring a Previous Configuration Manually (page 205)
201
Getting Started with the Engine Command Line
Prerequisites: None
Nearly all aspects of engine configuration are done through the Management Client, but some
engine settings and options must be defined and configured on the command line. Command
line tools allow you to define and configure these settings and options.
What You Can Do on the Engine Command Line
• Reconfigure the engine’s keyboard layout, time zone, network card settings, and network card
to Interface ID mapping.
• Create scripts that run when the engine changes its state.
• (Re-)establish contact between the engine and the Management Server.
• Manually revert to the previous configuration.
• Run various general and StoneGate-specific tools that assist in problem solving.
Limitations of the Engine Command Line
Changes made on the engine command line apply only to the node on which they were made. If
you want to apply the changes to other engines, such as all the nodes in a cluster, you must
make the same changes separately on the command line of each engine.
Some engine configuration options, such as network interface settings, cannot be changed
through an SSH console. To be able to change these settings, you must connect using a serial
cable or connect a display and keyboard directly to the engine machine.
The Management Server contact settings that are displayed in the engine configuration wizard
(sg-reconfigure) do not show the engine’s actual working configuration (transferred whenever the
engine’s policy is installed/refreshed), but instead display the values that were set when the
node was initialized.
Accessing the Engine Command Line

Prerequisites: None
 To access the command line on the engines

1. Connect to the engine in one of the following ways:
• Physically through a serial console using a null-modem cable (9600bps, 8 databits, 1
stopbit, no parity).
• Physically using a display and keyboard connected directly to the engine machine.
• Remotely using an SSH client. SSH access to the engine can be enabled and disabled
through the Management Client as explained in Enabling/Disabling SSH Access to the
Engine (page 194).
202 Chapter 16 Working on the Engine Command Line

2. Log in as root and enter the engine password.
• If you forget the password, you can change it in the Management Client as explained in
Changing the Engine Password (page 194).
What’s Next?
 If you want to reconfigure the engine’s basic settings or re-establish the trust
relationship between the engine and the Management Server, proceed to Reconfiguring
 If you want to create engine scripts that run when the engine changes its state, proceed
to Creating Engine Scripts (page 204).
 If you want to revert to the previous engine configuration, proceed to Restoring a
Previous Configuration Manually (page 205).
Reconfiguring Basic Engine Settings

Prerequisites: Accessing the Engine Command Line
During the installation of the engine, the engine’s keyboard layout (for command line use), time
zone (for command line use), network card settings, and network card to Interface ID mapping
were defined. The sg-reconfigure command allows you to change these settings. The
procedure also allows you to re-establish a trust relationship between the engine and the
Management Server if the trust is lost. On engines that are fully configured, each operation can
be done individually without changing the other options.
 To reconfigure engine settings

1. Launch the Configuration Wizard using one of the following commands:
• sg-reconfigure --no-shutdown: The Configuration Wizard starts without shutting the
engine down. Network interface settings cannot be changed in this mode.
• sg-reconfigure: The engine shuts down and the Configuration Wizard starts. All options
are available if you have a local connection. If you have a remote SSH connection, you
cannot change network interface settings (engine uses the “no-shutdown” mode).
2. Use the Configuration Wizard to change the settings. Detailed descriptions of the options
can be found in the Firewall/VPN Installation Guide and the IPS Installation Guide.
• The Management Server contact details are not used by the engine after a policy has
been installed from the Management Server. They are shown for your reference only.
• If you select the Switch to Initial Configuration option, all configuration and policy
information that has been transferred to the engine is cleared. You must install a policy
on the engine before it can be operational again.
Caution – Do not select the Switch to Initial Configuration option in the Prepare for
Management Contact screen unless you want to reset the engine to the post-installation
state (including a policy that allows communication only between the engine and the
Management Server).
• If you select Contact Management Server and enter a new one-time password, the
Management Server and the engine re-establish their trust relationship. Select this
option when you want to replace a missing or expired certificate or if contact to the
Reconfiguring Basic Engine Settings 203

Management Server is lost for any other reason, such as changing the Management
Server’s IP address.
Note – If there is a firewall between a remote engine and the Management Server, you
must allow the connection in the firewall’s IPv4 Access rules. If there is a NAT device
between a remote engine and the Management Server, you must also configure NAT rules
for the connection. Otherwise, the remote engine cannot contact the Management Server.
Related Tasks
 Engine Commands (page 926)
Creating Engine Scripts

Engine scripts run when the engine changes its state. The following scripts can be created:
Table 16.1 Possible Scripts on the Engines
Triggering Event Script Location and Name

Engine boots up /data/run-at-boot
Administrator refreshes or installs the policy /data/run-at-policy-apply
Engine enters the Online state /data/run-at-online
Administrator issued the ‘Lock Online’ command /data/run-at-locked-online
Engine enters the Offline state /data/run-at-offline
Administrator issued the ‘Lock Offline’ command /data/run-at-locked-offline
Engine enters the Standby state /data/run-at-standby
The script names and locations cannot be changed. If the scripts are not found, engine
operation continues as normal. If a script is found, it is executed and a log entry is created. To
stop this from happening, you must delete or move the script.
Note – If you want to use a script in a cluster, remember to create the script on all the
nodes in the cluster or copy the script to all of them, so that all the nodes function in the
same way when their state changes.
 To create a script
1. Create a text file with the commands you want the engine to execute (the first line of the
script must be #!/bin/sh) in one of the following ways:
• Create and edit the script on the engine’s command line using the vi text editor.
• Create and edit the script on a different host and transfer the file to the engine, for
example, using SSH.
2. Save the script in the correct folder on the engine (see Table 16.1).
3. Make the file executable by typing the following command:
chmod a+x /data/<script name>

The script is executed whenever the engine encounters the triggering event for running the
script.
Related Tasks
Restoring a Previous Configuration Manually

If the engine loses management connectivity due to a faulty configuration, the previous
configuration can be restored manually through the command line.
Note – You must restore the configurations separately on each node of a cluster. All nodes
in a cluster must have the exact same configuration (as indicated by an identification code
that is generated at each policy installation).
 To manually revert to the previous configuration

 Enter the following command:
/usr/lib/stonegate/bin/sgcfg -a -d /data/config/policy/previous apply
Related Tasks
Restoring a Previous Configuration Manually 205

M ANAGEMENT C ENTER
C ONFIGURATION
In this section:
Automatic Updates and Engine Upgrades - 209
Administrator Accounts - 213
Alert Escalation - 229
Domains - 245
Setting up the Web Portal - 255
Distributing Management Clients Through Web Start - 269
Log Server Configuration - 275
Secondary SMC Server Configuration - 287
Reconfiguring the Management Center - 301
207
208
C HAPT ER 17
AUTOMATIC UPDATES AND ENGINE

UPGRADES
You can configure automatic updates for dynamic update packages, remote upgrades for
engines, and new versions of licenses.
Getting Started with Automatic Updates and Engine Upgrades (page 210)
Configuring Automatic Updates and Engine Upgrades (page 210)
209
Getting Started with Automatic Updates and Engine
Upgrades
Prerequisites: None
Automatic update is available for dynamic update packages, remote upgrades for engines, and
licenses. On firewalls, Anti-virus signatures are always updated automatically when anti-virus is
active.
What Do Automatic Updates and Engine Upgrades Do?
The Management Server can automatically perform the following tasks:
• Check for new dynamic update packages and automatically download and install them
according to your selection.
• Check for new engine upgrade packages. Engine upgrades can be also automatically
downloaded, but they must always be installed manually.
• Upgrade the licenses.
• When automatic updates and engine upgrades are active, you can also view information on
the maintenance contract and support level of your licenses in the Management Client (see
Checking Maintenance Contract Information (page 107).
Limitations
• There are no automatic updates for the Management Center.
• New engine software versions may require an upgraded version of the Management Center.
Check the Release Notes for compatibility information before upgrading the engines.
• Upgrades and updates (both automatic or manual) require an active maintenance/support
contract with Stonesoft.
• If you select only to receive a notification when updates and upgrades are available, you must
manually download the updates engine upgrades.
What’s Next?
 Proceed to Configuring Automatic Updates and Engine Upgrades.
Configuring Automatic Updates and Engine Upgrades

Prerequisites: None
The Management Server can periodically check the Stonesoft website for new dynamic update
packages, engine upgrades, and licenses. This feature is active by default.
There are several different options for how new available updates and upgrades are handled.
The automatic updates and engine upgrades require the Management Server to be able to
connect to the Stonesoft servers (at least to
https://update.stonesoft.com and https://smc.stonesoft.com) either directly (using HTTPS on
port 443) or through an HTTP proxy. Additionally, you must have a valid maintenance/support
contract with Stonesoft.
210 Chapter 17 Automatic Updates and Engine Upgrades

 To configure automatic updates and engine upgrades
1. Select FileSystem ToolsConfigure Updates and Upgrades.
2. Select Enable sending proof of license codes to Stonesoft servers. This allows you to
select settings for dynamic updates and for engine and license upgrades. It also allows you
to view maintenance contract and support level information for your licenses in the
Management Client.
3. Configure the Dynamic Updates settings:
Setting Description
Do not check for updates You are not notified of new dynamic updates.
Notify me when updates You receive an alert when a new dynamic update becomes available.
become available You must manually download and activate the update.
You receive an alert when a new dynamic update becomes available.

Notify me and download
StoneGate also automatically downloads the update. You must
updates
manually activate the update.
Automatically download and StoneGate automatically downloads and activates the new dynamic
activate updates updates.
(Optional) StoneGate automatically refreshes the policies after

Refresh policies after update
activating the dynamic updates. This option becomes available when
activation
you select Automatically download and activate updates.
Note – Because update packages may change system elements, the policies may require
editing after update activation.
Configuring Automatic Updates and Engine Upgrades 211

4. Select one of the Remote Upgrades for Engines settings:
Setting Description
Do not check for engine upgrades You are not notified of new engine upgrades.
Notify me when engine upgrades You receive an alert when a new engine upgrade becomes
become available available. You must manually download and install the update.
You receive an alert when a new engine upgrade becomes

Notify me and automatically
available. StoneGate automatically downloads the new engine
download engine upgrades
upgrade. You must manually install the update.
5. (Optional) Select Generate and Install New Licenses Automatically to automatically

regenerate and install the licenses required for upgrading StoneGate to a major new
release.
6. (Optional) Switch to the Connection tab and select the Check Interval to define how often
the system checks for new updates.
7. (Optional) If the connection from the Management Server to the Stonesoft servers requires
a proxy server, select Use proxy server for HTTPS connection and enter the Proxy
Address and Proxy Port.
8. (Optional) If the proxy server requires user authentication, select Authenticate to the
proxy server and enter the User Name and Password.
9. Click OK.
Related Tasks
 Checking Maintenance Contract Information (page 107)
 Scheduling Tasks (page 820)
 Getting Started with Licenses (page 824)
 Getting Started with Upgrading the SMC (page 834)
 Getting Started with Upgrading Engines (page 840)
 Manual Dynamic Updates (page 845)
212 Chapter 17 Automatic Updates and Engine Upgrades

C HAPT ER 18
ADMINISTRATOR ACCOUNTS
The rights and privileges of StoneGate administrators are defined flexibly with administrator
accounts.
Getting Started with Administrator Accounts (page 214)

Defining Administrator Roles and Access Control Lists (page 215)
Defining Administrator Accounts (page 218)
Customizing Log Colors (page 222)
Defining Password and Login Settings for Administrators (page 223)
Changing Administrator Passwords (page 226)
Authenticating Administrators Using RADIUS (page 226)
Deleting Administrator Accounts (page 227)
213
Getting Started with Administrator Accounts
Prerequisites: None
An administrator account specifies what kinds of actions the administrator can take (create new
elements, browse logs, etc.).
How Administrator Accounts Can Be Configured
• Sets of administrator privileges are defined as reusable lists.
• Each list of privileges is applied to a specific group of elements.
• Several different pairs of privileges and elements can be applied to a single administrator
account, for example, to give viewing access to some elements and editing access to other
elements.
• You can also create unrestricted accounts for “superusers” that can perform any action on
any element. Some maintenance tasks require an unrestricted account.
What Do I Need to Know Before I Begin
Management Client accounts are valid in the Web Portal as well, but actual user accounts are
created separately. See Defining Web Portal User Accounts (page 260).
1. (Optional) Define customized reusable lists of allowed tasks for accounts with restricted
permissions. See Defining Administrator Roles (page 215).
2. (Optional) Define customized reusable lists of elements for defining access rights for
restricted accounts. See Defining Access Control Lists (page 217).
3. Create administrator accounts for each administrator. See Defining Administrator
Accounts (page 218).
4. (Optional) Configure strength requirements and expiration intervals for administrator
passwords. See Defining Password and Login Settings for Administrators (page 223).
Caution – Do not use shared accounts. Using shared accounts makes auditing difficult and
may prevent timely discovery should there be a security breach.
214 Chapter 18 Administrator Accounts

Defining Administrator Roles and Access Control Lists
Prerequisites: None
You can use Administrator Roles and Access Control Lists in accounts that define restricted
administrator permissions. You can either use the predefined Administrator Roles and Access
Control Lists or create new ones.
What’s Next?
 Defining Administrator Roles (page 215)
 Defining Access Control Lists (page 217)
Defining Administrator Roles

Administrator Roles specify a restricted set of permissions, for example, the right to create,
modify, and delete elements. There are several predefined Administrator Roles to choose from
(stored in AdministrationAccess RightsAdministrator Roles.
Caution – Any changes you make to an Administrator Role are applied immediately to
every administrator account that uses the role (possibly including yourself). Take special
care that the selection is correct before you apply changes to existing Administrator Roles
that are in use.
 To create a new Administrator Role

2. Right-click Access Rights and select NewAdministrator Role. The Administrator Role
Illustration 18.1 Administrator Role Properties
Defining Administrator Roles and Access Control Lists 215

3. Give the Administrator Role a unique Name and enter an optional free-form Comment for
your own reference.
4. Select the permissions that are applied to the elements selected for the role:
• Edit Element Properties: allows editing the elements’ properties.
• Delete Elements: allows deleting the elements.
• View Element Contents: allows viewing the contents of the elements.
• Create Elements: allows creating new elements.
• Refresh Policies: Allows refreshing policies on engines if both the engines and the
policies are selected for the role and the policies are allowed policies for the engines. It
also allows creating and running Policy Refresh Tasks.
• Send Commands: Allows sending commands to the selected engines. The administrator
can also run SgInfo and Remote Upgrade tasks. If the role includes this permission and
the permission to Browse Logs and Alerts from Granted Elements, the administrator can
also terminate connections from the selected elements and browse and create blacklist
entries for them.
• Upload Policies: Allows uploading policies on engines if both the engines and the policies
are selected for the role and the policies are allowed policies for the engines. It also
allows creating and running Policy Upload Tasks.
• Browse Audit Logs: allows browsing logs about administrator actions and events in
StoneGate.
• Browse Logs and Alerts from Granted Elements: Allows browsing logs from the selected
elements and acknowledging alerts about them. If the role includes this permission and
the permission to Send Commands, the administrator can terminate connections from
the selected elements and browse and create blacklist entries for them.
• Manage Administrators: allows viewing and managing Administrator, Administrator Role,
and Access Control List elements.
• Manage Alerts: allows viewing and managing Alert, Alert Chain, and Alert Policy
elements, and installing Alert Policies.
• Manage Backups: allows viewing and managing backups, and creating and running
Backup Tasks.
• Manage Licenses: allows viewing, installing, binding, unbinding, and removing licenses.
• Manage Logs: allows creating and running log data tasks (Export Log Tasks, Archive Log
Tasks, and Delete Log Tasks).
• Manage Log Pruning: allows pruning logs with Immediate Discard and Discard Before
Storing filters.
• Manage Reports: allows viewing and managing reports.
• Manage Updates and Upgrades: Allows downloading, importing, activating, and
removing dynamic update packages. It also allows downloading, importing, and removing
engine upgrades.
• Manage VPNs: allows viewing and managing elements related to VPNs.
• View System Alerts: allows browsing and acknowledging System Alerts, which are alerts
about the internal operation of StoneGate.
5. Click OK.
What’s Next?
 If you want to define Access Control Lists for creating reusable groups for elements,
proceed to Defining Access Control Lists.
 Otherwise, the new Administrator Role is now ready to be used when defining
administrator accounts. See Defining Administrator Accounts (page 218).

Defining Access Control Lists
An Access Control List defines a group of elements. There are several predefined Access
Control Lists to choose from (stored in AdministrationAccess RightsAccess Control
Lists).
 To create an Access Control List

2. Right-click Access Rights and select NewAccess Control List from the menu. The
Access Control List Properties dialog opens.
Illustration 18.2 Access Control Lists Properties
3. Give the Access Control List a unique Name and enter an optional free-form Comment for
your own reference.
4. Select the Firewall, IPS, SOHO Firewall, Firewall Policy, IPS Policy, or SSL VPN Gateway
element(s) you want to add to the Access Control List from Resources and click Add. The
selected element(s) are added to the Granted Elements list in the right panel.
5. Click OK.
What’s Next?
 To define new administator accounts that use the new Access Control List, proceed to
Defining Administrator Accounts (page 218).
 To assign the Access Control List to an existing restricted account, proceed to Defining
Rights for Restricted Administrator Accounts (page 220).
Related Tasks
 Defining an Engine’s Administrator Permissions (page 408)
Defining Administrator Roles and Access Control Lists 217

Defining Administrator Accounts
Prerequisites: (Optional) Defining Administrator Roles and Access Control Lists
An unrestricted permissions account is automatically created during installation to ensure there

is a “superuser” account available in the system. With this first account, you can create the
necessary number of administrator accounts for daily management tasks.
The administrator accounts for the users of the optional StoneGate Web Portal are defined with
Web Portal User elements. All other administrator accounts are defined with Administrator
elements (see Defining Web Portal User Accounts (page 260)).
You can authenticate administrators against a simple password stored in StoneGate’s internal
database or you can use an external RADIUS server for authentication (see Authenticating
Administrators Using RADIUS (page 226)).
What’s Next?
 Creating a New Administrator Element (page 218)
Creating a New Administrator Element

 To create an Administrator element
2. Right-click Access Rights and select NewAdministrator from the menu. The
Administrator Properties dialog opens.
Illustration 18.3 Administrator Properties - General Tab

3. Give the administrator a unique Name and enter an optional free-form Comment for your
own reference. This is the username the administrator uses to log in to the Management
Client.
4. Select the authentication method: Internal Authentication or RADIUS Authentication.
• If you want to use an external authentication server, select the RADIUS Authentication
option and a RADIUS server or an Active Directory server from the list. See Authenticating
Administrators Using RADIUS (page 226) for more information.
• If you select Internal Authentication, type in a Password and confirm it in the field
below, or click Generate Password to generate a random 7-digit alphanumeric password.
• (Optional) Select Password Never Expires if you want the password to always be valid.
Selecting this option overrides the password expiration settings in the Administrator
Password Policy. See Defining Password and Login Settings for Administrators (page 223)
for more information.
• Select whether the account is Always Active or enter an Expiration Date.
Note – We recommend that passwords be at least eight characters long and contain a
combination of numbers, letters, and special characters. Secure passwords are never
based on personal information such as names, birthdays, social ID numbers, phone
numbers, street names, registration plate numbers.
What’s Next?
 Continue by Defining Administrator Permissions.
Related Tasks
 Defining Password and Login Settings for Administrators (page 223)
Defining Administrator Permissions

 To define an administrator’s permissions
1. Switch to the Permissions tab in the Administrator element’s properties.
Illustration 18.4 Administrator Properties - Permissions Tab
Defining Administrator Accounts 219

2. In Administrator Permissions, select the general level of access:
• Unrestricted Permissions (Superuser): The administrator can manage all elements and
perform all actions without any restrictions.
• Restricted Permissions: The administrator has a limited set of rights that apply only to
the elements granted to the administrator.
Caution – Grant unrestricted permissions only to administrators who absolutely need them.
What’s Next?
 If you selected Restricted permissions for this administrator, proceed to Defining
Rights for Restricted Administrator Accounts.
 If you selected Unrestricted Permissions for this administrator and you want to limit
the log entries viewable by this account, proceed to Restricting the Logs an
Administrator Can View (page 222).
 If you selected Unrestricted Permissions for this administrator and you want to adjust
the display colors of log entries individually for this account, proceed to Customizing Log
Colors (page 222).
 Otherwise, click OK. The administrator account is ready for use.
Related Tasks
Defining Rights for Restricted Administrator Accounts

To define the permissions in detail as explained below, the Administrator element must have
Restricted Permissions selected as the general permissions level.
 To define the administrator rights for a restricted account

1. Switch to the Permissions tab in the Administrator element properties.
Illustration 18.5 Administrator Properties - Permissions Tab
2. Click Add Role. A new Administrator Role appears in the list above.

3. Click the Role cell for the newly added row and select the Administrator Role that defines
the rights you want to set. In addition to any customized roles, there are four predefined
Administrator Roles:
• Editor: Can create, edit, and delete selected elements. Can send commands to engines,
refresh and upload policies, and browse logs and alerts from selected elements.
• Operator: Can view the properties of selected elements. Can also send commands to
selected engines, refresh and upload policies, and browse logs and alerts from selected
elements.
• Owner: Can view the properties of selected elements, and edit and delete the selected
elements.
• Viewer: Can view the properties of selected elements.
4. Double-click the Granted Elements cell on the same row and select the elements that are
covered by the corresponding Administrator Role in the dialog that opens.
• The Set to ALL action also depends on the selection on the left. For example, if you
browse to firewalls and click Set to ALL, the item “All Firewalls” is added.
• You can also select one or more predefined or user-created Access Control Lists. “Simple
elements” includes all elements except Incident Cases and elements that have a
dedicated system Access Control List (Firewalls, SOHO Firewalls, IPS engines, Firewall
and IPS policies, SSL VPN Gateways, Administrators, and Web Portal Users).
5. (Optional) If Domain elements have been configured, click the Domain cell on the same row
to select the Domain(s) in which the rights granted by the Administrator Role and the
selected elements apply.
• Or leave the default Shared Domain selected in the Domains cell. All the elements
automatically belong to the predefined Shared Domain if Domain elements have not been
configured. See Domains (page 245) for more information on Domains.
• You can also select the ALL Domains Access Control List to grant the permissions for all
the Domains that exist in the system.
6. (Optional) Repeat Steps 2 to 7 to add further Administrator Role - element - Domain
mappings.
7. (Optional) If Domain elements have been configured, leave Allow Login to Shared Domain
selected if you want to grant the administrator permission to log in to the Shared Domain.
In addition to the privileges you explicitly set, administrators who are allowed to create and
delete elements are automatically awarded privileges to view, edit, and delete elements they
create themselves, even if they are not allowed to view, edit, or delete any other elements.
What’s Next?
 If the administrator has the right to view logs, you can further restrict the logs the
administrator can view as explained in Restricting the Logs an Administrator Can View
(page 222).
 If you want to adjust the display colors of log entries individually for this account,
proceed to Customizing Log Colors (page 222).
Related Tasks
 Defining Administrator Roles and Access Control Lists (page 215)
Defining Administrator Accounts 221

Restricting the Logs an Administrator Can View
If an administrator is allowed to view logs and alerts, you can select filters that are applied to
the log data before it is displayed to the administrator.
This section explains how you can select log filters in Administrator elements. See Selecting Log
Browsing Permissions for a Web Portal User (page 263) for information on selecting log
browsing permissions and filters for Web Portal users.
 To select log filters in an Administrator element

1. Switch to the Permissions tab in the Administrator element properties.
2. Under Log Filters, click Select. The Select Element dialog opens.
3. Click All Filters to select one or more Filters from the list of all Filters or click Filter Type to
select the Filter(s) according to their type.
What’s Next?
 If you want to adjust the display colors of log entries individually for this account,
proceed to Customizing Log Colors.
Related Tasks
 Filtering Data (page 159)
Customizing Log Colors

Prerequisites: None
By default, certain logs are shown with a colored background in the Logs view. The colors are
determined by Log Color Filters. You can customize the default log colors used by default in all
administrator accounts or define administrator-specific log colors in the Administrator element’s
properties. To use customized colors for logs, you must also create the Filter(s) that match
those logs. Only administrators with the right to manage administrator accounts can customize
log colors.
 To customize default log color filters

1. In the Administration Configuration view, start in one of the following ways:
• If you want to customize the default log colors, expand the Access Rights branch, right-
click Administrators, and select Edit Default Color Settings. The Administrator Default
Color Settings dialog opens.
• If you want to customize the log colors for a particular administrator, open the correct
Administrator element’s properties and switch to the Log Filters tab.

Illustration 18.6 Log Color Settings
2. At the top, select the log type whose color filter(s) you want to modify:
• Log and Alert to modify colors for logs and alerts displayed in the Logs view.
• Connections to modify colors for currently open connections displayed in the Connections
view.
• Blacklist to modify colors for blacklist entries in the Blacklist view.
3. (Optional) To define a new filter, click Add and double-click the Filter cell in the new color
filter row to select the filter.
4. Double-click the Color cell of the filter whose color you want to modify. A palette of colors
opens.
5. Select a color from the palette or click More Colors to select a custom color. The selected
colors are assigned to the filters and they are used whenever logs match the filter.
6. Click OK.
Defining Password and Login Settings for Administrators

Prerequisites: None
You can define settings for password strength, password expiration, failed logins, and actions
related to temporary and long-term inactivity in the Administrator Password Policy. The
Administrator Password Policy is applied to all administrator accounts defined with Administrator
and Web Portal User elements. The Administrator Password Policy is not enforced by default.
Note – The Password Never Expires option in the Administrator or Web Portal User
element properties overrides the password expiration settings. If the option is selected, the
password expiration settings do not apply to the account.
What’s Next?
 Begin the configuration by Enabling Enforcement of Password Settings (page 224).
Related Tasks
 Defining Password Policy Settings (page 225)
Defining Password and Login Settings for Administrators 223

Enabling Enforcement of Password Settings
 To enable enforcement of password settings
1. Select FileSystem ToolsEnforce Password Settings from the main menu. A
confirmation dialog opens showing the current password policy settings.
Illustration 18.7 Administrator Password Policy - Confirmation Dialog.
• History of Obsolete Passwords: The number of previous passwords that an administrator

cannot reuse.
• Inactivity Delay before Screen Lock: The number of minutes after which an
administrator who is idle is automatically logged out.
• Single GUI Connection: Defines whether an administrator can open only a single session
at a time to the Management Client or to the Web Portal.
• Inactivity Delay before Disabling Account: The maximum number of days an
administrator account can be inactive before it is disabled.
• Minimum Number of Characters in Password: The minimum number of characters
administrator passwords must contain.
• Password Validity: The number of days after which administrator passwords expire and
must be changed.
• Maximum Number of Failed Login Attempts before Lock-Out: The maximum number of
failed login attempts before an administrator account is locked.
• Lock-Out Duration: The duration (in minutes) for which the administrator account is
locked when the maximum number of failed login attempts is reached.
• Both Letters and Numbers Required in Password: Defines whether administrator
passwords must contain both letters and numbers.
2. Click Yes. Administrator passwords are now checked against the password policy settings.
What’s Next?
 If you want to modify the current password policy settings, continue by Defining
Password Policy Settings (page 225).

Defining Password Policy Settings
The administrator password policy is defined in the SGConfiguration.txt file that is stored on
the Management Server. You can either use the default values for each setting or modify the
settings as necessary.
 To define administrator password policy

1. Browse to the <installation directory>/data directory on the Management Server.
2. Open SGConfiguration.txt and configure the following parameters as needed:
Table 18.1 Password Policy Settings
Parameter Name Description

OBSOLETE_PASSWORD_QUEUE_ Enter a number to prevent the reuse of the specified number
LENGTH of previous passwords. The default number is 4.
Enter the number of minutes after which administrators who

GUI_INACTIVITY_MAX_IN_
are idle are logged out of the Management Client. The default
MINUTES
is 15 minutes.
Define (as True or False) whether the same administrator

account can be used to log in the Management Client only
SINGLE_GUI_SESSION once at a time.
The default value is True. When the value is True, only a
single login per each account is allowed.
DAYS_OF_ACCOUNT_INACTIVITY_ Enter the maximum number of days an administrator account

MAX can be inactive before it is disabled. The default is 90 days.
PASSWORD_CHARACTER_NUMBER_ Enter the minimum number of characters administrator

MINIMUM passwords must contain. The default is 7 characters.
Enter the number of days after which the administrator

PASSWORD_EXPIRATION
password must be changed. The default is 90 days.
Enter the maximum number of failed login attempts, after

FAILED_AUTH_ATTEMPT_MAX which the administrator account is locked. The default is 6
attempts.
Enter the number of minutes for which the administrator

account is locked when the maximum number of failed logins
TIME_LOGIN_LOCKED is reached. The default is 30 minutes.
You must define a value for FAILED_AUTH_ATTEMPT_MAX to
use this.
PASSWORD_BOTH_LETTER_AND_ Define (as True or False) if administrator passwords must

NUM_REQUIRED contain both letters and numbers. The default is True.
3. Save the changes you have made to the file.
Related Tasks
 Enabling Enforcement of Password Settings (page 224)
Defining Password and Login Settings for Administrators 225

Changing Administrator Passwords
Prerequisites: None
If you have not configured administrator passwords to automatically expire, we recommend that
you change administrator passwords regularly. An administrator who has the right to manage
administrator accounts can change any other administrator’s password. All administrators can
change their own passwords once logged in to the Management Client or the StoneGate Web
Portal.
 To change any administrator’s password

1. In the Administration Configuration view, browse to
AdministrationAccess RightsAdministrators or
AdministrationAccess RightsWeb Portal Users.
2. Double-click the correct Administrator or Web Portal User element to open the element
properties.
3. Type the new password in the Password field and confirm it in the field below.
4. Click OK.
 To change your own administrator password

1. Select FileSystem ToolsChange Password. The Change Password dialog opens.
2. Enter your current password in the Old Password field.
3. Enter a new password in the New Password field.
4. Confirm the new password in the Confirm New Password field.
5. Click OK.
Related Tasks
 Defining Password and Login Settings for Administrators (page 223)
Authenticating Administrators Using RADIUS

Prerequisites: You must have an external authentication server that supports the RADIUS protocol
You may authenticate administrator and Web Portal user logins against an external
authentication server that supports the RADIUS protocol. This allows logging in to the
Management Client or Web Portal using any authentication method supported by your RADIUS
server. You can enable RADIUS authentication on a per-administrator-basis.
StoneGate’s internal user database does not allow external authentication servers to query the
administrator account information, so you have to maintain accounts separately both in
StoneGate and in some external user database that the RADIUS server can access. The
administrator name must be the same in both user databases.
 To set up RADIUS authentication for administrator accounts

1. Define a RADIUS authentication server element (see Defining an Authentication Server
(page 635)) or an Active Directory Server element (see Defining an Active Directory Server
Element (page 627)).
• The shared secret used in the communications is defined in the RADIUS Server or Active
Directory Server element.

2. Create a rule in your Policy allowing traffic from your Management Server to the external
RADIUS server.
3. Right-click the Management Server and select Properties.
4. Select the RADIUS Method for the security method you want to use for authenticating the
Management Server’s communications with your external RADIUS server. You have a choice
of:
• PAP (Password Authentication Protocol), which is not recommended since it exchanges
the password in cleartext.
• CHAP (Challenge-Handshake Authentication Protocol)
• MSCHAP, MSCHAP 2 (Microsoft versions of the aforementioned protocol), out of which
we recommend preferring MS-CHAP 2 over MS-CHAP if supported by the RADIUS server.
• EAP-MD5 (Extensible Authentication Protocol with an MD5 Hash)
Caution – The security of the system requires that these communications remain
confidential. Whichever security method you choose, we recommend that the
communications between the Management Server and the RADIUS server are transferred
over secure networks only.
5. Set up the external RADIUS server for use with StoneGate.

• Define the StoneGate Management Server as a RADIUS client on your server.
• Define the same security method for authentication on your RADIUS server as you
selected in the Management Server properties in the previous step.
6. Select the RADIUS Authentication option for administrator accounts (as explained in
Defining Administrator Accounts (page 218)). The Administrator element’s name must be
the same as in the user database that the RADIUS server uses.
Deleting Administrator Accounts

Prerequisites: Creating a New Administrator Element
When you delete an administrator account, all references to the administrator are removed (for
example, from element modification history).
Note – There must be at least one account with unrestricted privileges in the system. It is
not possible to delete the last remaining unrestricted account.
If you delete an Administrator element that represents the account of an administrator who has
modified any elements in the Management Center, all the history of the changes the
administrator has made is lost. Instead of deleting the account permanently, you can disable
the account by right-clicking the correct Administrator element and selecting Disable. See
Deleting Elements (page 79) for general information on deleting elements.
Deleting Administrator Accounts 227

C HAPT ER 19
ALERT ESCALATION
The alerting system can be configured to escalate the alerts generated so that notifications
are sent to the administrators through multiple channels.
Getting Started with Alert Escalation (page 230)

Creating Alerts (page 231)
Defining Alert Chains (page 233)
Defining Alert Policies (page 238)
Installing Alert Policies (page 240)
Acknowledging Alerts (page 240)
Using Custom Scripts for Alert Escalation (page 242)
Setting up a Dedicated Alert Server (page 243)
Testing Alerts (page 244)
229
Getting Started with Alert Escalation
Prerequisites: None
Alerts notify you in case something unexpected or suspicious happens. It is vital to the health of
the system that alerts do not go unnoticed.
What Alert Escalation Does
The alert escalation process starts when an alert is triggered by a system warning or error, or
because traffic matches a rule that is configured to trigger an alert. The Log Server can send out
different types of notifications to any number of administrators. Alert escalation stops when one
of the administrators acknowledges the triggering alert or when all configured alert notifications
have been sent.
Limitations
• SOHO firewalls do not send alerts.
• The alert escalation for the SSL VPN is configured in the SSL VPN Administrator interface.
• Only one e-mail recipient can be configured for each notification. To send an e-mail to several
people at the same time, you must configure an e-mail group on the mail server or configure
several notifications consecutively without delays.
• Test alerts cannot be sent with firewall or IPS engines as the sender, and they always have
default Severity and Situation information.
Illustration 19.1 Elements in the Configuration
Alert Chains Alert Policy Log Server
(Custom) Alerts
Policies and Engines
1. (Optional) Create new Custom Alert elements to allow more fine-grained matching in the
Alert Policy. See Defining Custom Alerts (page 231).
2. Make sure that alerts are generated for all necessary events. See Defining What Triggers
an Alert (page 232).
3. Create lists of actions to take when an alert is escalated. See Defining Alert Chains
(page 233).
4. Define which alerts are matched against which Alert Chain. See Defining Alert Policies
(page 238).
230 Chapter 19 Alert Escalation

Creating Alerts
Prerequisites: None
There are three predefined Alert elements in the system:

• the System alert, which is reserved for alerts about the system operation.
• the Default alert, which is a ready-made element for you to use as you wish.
• the Test alert, which is used in Alert Policies for testing Situations.
Additionally, you can define custom Alert elements, which are useful if you want to configure
different alert notifications for different types of events.
You can create new Alert elements for traffic matches and test failures, and create specialized
handling rules for them in your Alert Policy. System events are always associated with the
System Alert element.
What’s Next?
 To create or modify a custom Alert element, proceed to Defining Custom Alerts.
 To configure which events generate alerts, proceed to Defining What Triggers an Alert
(page 232).
 To send a test alert, see Testing Alerts (page 244).
Defining Custom Alerts

 To define a custom alert
2. Right-click Alert Configuration and select NewCustom Alert. The Custom Alert
Illustration 19.2 Custom Alert Properties
3. Give the alert definition a unique Name. This is the name displayed in the Logs view.
4. (Optional) Type a Message for the alert. This is also shown in logs.
Creating Alerts 231

5. (Optional) If you are using SNMP traps for delivering alerts, define the SNMP trap specific
code in the SNMP Trap Specific Code field. This is included in the SNMP messages sent.
The value depends on how the receiving system is set up and the purpose you have
planned for this alert.
6. Click OK. The new custom Alert element appears in the Alerts folder.
If you edited a custom Alert that is already in use in some Alert Policy, the changes you made
take effect only after you reload the Alert Policy on the Log Server(s).
What’s Next?
 Use the custom Alert by Defining What Triggers an Alert.
Defining What Triggers an Alert

System or custom Alerts are always triggered by a situation matching in the system. The
Situation can be a warning or error in the operation of the StoneGate system, a test failure, a
rule match, or a match to a pattern defined in one of the Situation elements in deep packet
inspection. In addition to the System alerts triggered by internal events in the StoneGate
system, you can configure alerts on the following:
• You can define that a certain rule in your Firewall or IPS Policy triggers an alert. See Defining
Access Rule Logging Options (page 528) or Defining Access Rule Logging Options
(page 528).
• You can activate Status Surveillance on engines to trigger an alert when the Management
Server does not receive the status updates for a while, see Enabling/Disabling Engine Status
Monitoring (page 192).
• You can configure the tester to issue an alert whenever a test fails (for example, when a
network link goes down). Some tests are run in the system by default. See Getting Started
with the Engine Tester (page 398).
• Server Pool Monitoring Agents can trigger alerts when they detect problems with the servers.
See Getting Started with Inbound Traffic Management (page 468).
• You can set thresholds for monitored items in Overviews to trigger alerts when the threshold
is reached. See Setting Thresholds for Monitored Items (page 96).
What’s Next?
 To define how administrators are notified of new alerts in the system, proceed to
Defining Alert Chains (page 233).

Defining Alert Chains
Prerequisites: None
Alert Chains define which notification channels are used to send alert notifications to
administrators. Alert Chains are used in Alert Policies. The Alert Policy defines which Alert
Chains are triggered by which Alerts.
What’s Next?
 If you want to send alerts through any channel other than as a notification in the
Management Client, and you have not defined Alert channels, start by Defining Alert
Channels.
 Otherwise, start by Creating New Alert Chains (page 234) or Modifying Existing Alert
Chains (page 235).
Defining Alert Channels

Alert Channels are ways to send notifications to administrators. If you want to send alerts over
e-mail, as SMS text messages, through a custom script, or as SNMP traps, you must configure
the alert channels you want to use for each Log Server that handles alert escalation.
 To define the alert channels

2. Browse to Servers, right-click the correct Log Server and select Properties.
3. Switch to the Alert Channels tab.
Illustration 19.3 Alert Channels
4. (Optional) If you want to send alert notifications as e-mail, fill in:

• SMTP Server: the host name or IP address of the SMTP server to which the alert
notifications are sent as e-mail.
• Mail Sender Name: the name of the e-mail sender.
• Mail Sender Address: the e-mail address of the e-mail sender.
5. (Optional) If you want to send alert notifications as SMS text messages, fill in:
• GSM COM Port: the COM port from which the SMS messages are sent. Type in the port
where the GSM modem is attached (for example, COM1 on Windows, /dev/ttyS0 on
Linux)
• (Optional) PIN Code: Type in the PIN code, if required by the GSM modem.
Defining Alert Chains 233

6. (Optional) If you want to send alert notifications as SNMP traps, fill in:
• SNMP Gateways: the host name or IP address of the SNMP gateway to which the alert
notifications are sent as SNMP traps.
• You can specify a list of gateways by separating them with semi-colons (for example,
snmp-gw1; snmp-gw2).
• In case your SNMP gateway port is other than the default 162, specify the port number by
typing a colon and the port after the host name (for example, snmp-gw:4390).
7. (Optional) If you want to send alert notifications to be processed by a custom script, fill in:
• Script Root Path: the path where alert handling scripts are stored on this Log Server. The
default location is <installation directory>/data/notification on the Log Server.
• Do not define the script name here; you add it in the alert chain at each place where you
want to call a particular script. You can use multiple scripts.
• For information on creating the script, see Using Custom Scripts for Alert Escalation
(page 242).
8. Click OK.
Repeat the above steps for all Log Servers you plan to use for Alert Escalation.
What’s Next?
 Continue by Creating New Alert Chains.
Creating New Alert Chains

You can create several Alert Chains. Alert Chains are used in the Alert Policy, which can escalate
different alerts to different Alert Chains according to rules set in the Alert Policy.
 To create a new alert chain

1. Select ConfigurationConfigurationAdministration. The Administration Configuration
view opens.
2. Right-click Alert Configuration and select NewAlert Chain. The Alert Chain Properties
dialog opens.
Illustration 19.4 Alert Chain Properties
3. Give the Alert Chain a unique Name.

4. Click OK. The new alert chain is created and the Alert Chain opens for editing.
What’s Next?
 Continue by defining the alert escalation chain as explained in Editing Alert Chains
(page 235).
Modifying Existing Alert Chains

 To modify an existing alert chain
2. Browse to Alert ConfigurationAlert Chains.
3. Right-click the alert chain you want to modify and select one of the following:
• Properties: modify the properties information (such as the name).
• Edit Alert Chain: modify the rules for escalating alerts and modify the Alert Chain as
explained in Editing Alert Chains (page 235).
Editing Alert Chains

An Alert Chain is defined in rows that are read from top to bottom. Each row represents a
different recipient or a different alert channel to a given recipient.
Tip – It is not mandatory to add any rows to an Alert Chain, for example, if you want to create a chain
that just uses the Final Action to automatically acknowledge or stop the escalation of alert
entries that the Alert Policy directs to the chain.
 To edit an alert chain

1. Add a row:
• In an empty Alert Chain, right-click the Final Action row and select RuleAdd Rule.
• In an Alert Chain with existing rules, right-click a rule and select RuleAdd Rule Before
or RuleAdd Rule After.
Illustration 19.5 Alert Chain

2. Select the Alert Channel cell. The options are:
• Custom Script: alerts are sent for processing to a script you create. See Using Custom
Scripts for Alert Escalation (page 242).
• Delay: processing is paused for the specified time before the next rule is applied.
• SMS: an SMS text message is sent.
• SMTP: an e-mail message is sent.
• SNMP: an SNMP trap is sent.
• User Notification: a blinking icon appears at the bottom right corner of the selected
administrators’ Management Client. The icon works as a shortcut to a Logs view pre-
filtered to display the currently active alerts.
3. Specify the Destination of the alert notification. The destination information varies
according to the selected alert channel:
• Custom script: Enter the name (or full path) of the script file (note that the root path of
the script is defined in the Log Server properties).
• SMS: Enter the recipient’s mobile phone number
• SMTP: Enter the recipient’s e-mail address. Only one address is allowed. Use a mail
group address or create additional rows without delays to send the e-mail to multiple
recipients at the same time.
• SNMP: Not editable, because the SNMP server is defined in the Log Server’s properties
(the actual SNMP trap that is sent depends on the alert event).
4. (Optional) To set a limit to how many alerts the designated recipient is sent, double-click the
Threshold to Block cell and use the dialog that opens to set the following options:
• Pass on Max: Enter the maximum number of alerts that the recipient is to receive. After
this threshold is reached, any rows with this recipient are ignored.
• During: Enter the time period in hours (h) and minutes (min) for counting the number of
alerts to the recipient.
• Notify first blocking: select this option if you want the system to notify the alert recipient
once alert blocking has started.
• No moderation: select this option if you do not want to set any threshold for blocking.
Note – If you leave the Threshold to Block cell empty, there is no blocking threshold for the
alerts sent to the recipient.
5. (Mandatory for the Delay channel, optional for other channels) Enter the Delay, define a
pause (in minutes) before the next row of the alert chain is processed.
• The purpose of the delay is to give to the recipient of the notification time to acknowledge
the alert before the next notification is sent.
• If sending the notification through the selected channel fails, the delay entered here is
ignored. If you want to add delays that are always valid, add a row with Delay as the alert
channel and set the delay on that row.

6. Continue adding further rows until the Alert chain is complete.
What’s Next?
 If you have not defined what happens when the end of the Alert Chain is reached,
proceed to Defining the Final Action of an Alert Chain (page 237).
 If you have defined what happens when the end of the Alert Chain is reached, save the
finished Alert Chain. If it is not included in your Alert Policies yet, proceed as explained
in Defining Alert Policies (page 238).
 Otherwise, reload the Alert Policies that use this Alert Chain (see Installing Alert
Policies (page 240)).
Defining the Final Action of an Alert Chain

The Final Action row in an Alert Chain determines what happens when all Alert Channels in the
Alert Chain have been tried, but none of the Administrators have acknowledged the alert.
 To define the Final Action

1. Select the Final Action that the system takes if the last row of the alert chain is reached:
• None: The alert escalation ends. No further notifications are sent, but the alert stays in
the list of active alerts.
• Acknowledge: The alert escalation ends here and the system automatically
acknowledges the alert (removes it from the list of active alerts).
• Redirect: The alert escalation continues in the Alert Chain you select in the other
selection box.
• Return: Returns the processing to the Alert Policy. The Alert Policy matching continues
from the next row. If there is another matching rule in the Alert Policy, the alert escalation
continues. If no further matches are found, the escalation ends and the alert stays in the
list of active alerts.
2. Click the Save icon in the toolbar.
What’s Next?
 If the Alert Chain is not included in your Alert Policies yet, proceed as explained in
Defining Alert Policies (page 238).
 Otherwise, reload the Alert Policies that use this Alert Chain (see Installing Alert
Policies (page 240)).

Defining Alert Policies
Prerequisites: Defining Alert Chains
Alert Policies determine the criteria for selecting which alerts generated by various sources are
escalated to which Alert Chains.
Firewalls, analyzers, and the SMC servers are possible sources for alerts. Sensors send their
alerts through analyzers and SOHO firewalls do not generate alert entries at all. If Domain
elements have been configured in the system, you can select a Domain as a Sender in an Alert
Policy in the Shared Domain. Additionally, alert events can be directed to different Alert Chains
depending on the time of the day or the (Custom) Alert element used in the triggering
configuration.
What’s Next?
 Proceed to Creating New Alert Policies (page 238) or Modifying Existing Alert Policies
(page 239).
Creating New Alert Policies

 To create a new alert policy
view opens.
2. Right-click Alert Configuration and select NewAlert Policy from the menu. The Alert
Policy Properties dialog opens.
Illustration 19.6 Alert Policy Properties
3. Give the alert policy a unique Name.

4. Click OK. The new alert policy opens for editing.
What’s Next?
 Proceed by defining the alert policy rules as explained in Editing Alert Policy Rules
(page 239).

Modifying Existing Alert Policies
 To edit an alert policy
view opens.
2. Browse to Alert ConfigurationAlert Policies in the element tree. The existing alert
policies are displayed.
3. Right-click the appropriate alert policy and select one of the following:
• Select Properties to change the properties information (such as the name).
• Select Edit Alert Policy to modify the actual alert policy rules and proceed as explained
in Editing Alert Policy Rules.
Editing Alert Policy Rules

 To edit alert policy rules
1. Add a new rule in the Alert Policy:
• In an empty Alert Policy, right-click the rule table and select RuleAdd Rule.
• In an Alert Policy with existing rules, right-click a rule and select RuleAdd Rule After or
RuleAdd Rule Before.
Illustration 19.7 Alert Policy

2
2. Select the Log Server to which this Alert Policy applies.

3. (Optional) Specify the Sender that this alert rule matches:
• You can add Analyzers, Firewalls, Groups, or Servers, or right-click and select Set to ANY.
Note – If you have a backup Analyzer, remember to add both the primary and the backup
Analyzer as a Sender. The backup Analyzer is not included automatically.
4. (Optional) Specify the Alert and Situation that this rule matches.
5. (Optional) Double-click the Time cell and select the days and times when you want the rule
to be applied. Click OK.
• If you do not specify any validity time, the alert rule is always applicable.
• The time is entered as UTC (GMT) time. You must calculate yourself the effects of the
time difference to your local time. Also, take into account that UTC does not adjust to
daylight saving time (summer time).
6. (Optional) Double-click the Severity cell and specify the Severity value or the range of
Severity values that this rule matches.
• To define a single Severity value, select Severity and one of the Severity options.
• If you want the rule to match a range of Severities, select Severity Range and define the
range in the From and To lists.
7. Select which Alert Chain is processed when an alert event matches this rule.
Defining Alert Policies 239

8. Repeat these steps to add any further rules, then click the Save icon in the toolbar.
What’s Next?
 Activate the Alert Policy on your Log Server by Installing Alert Policies.
Installing Alert Policies

Prerequisites: None
Changes made to alert policies take effect when you install the Alert Policy on a Log Server.
 To install an Alert Policy

view opens.
2. Browse to Alert ConfigurationAlert Policies.
3. Right-click the Alert Policy you want to install, and select Install Policy. The Task Properties
window opens.
4. Select the Log Server(s) on which you want to install the Alert Policy and click Add.
5. Click OK.
After you install a policy on a Log Server, you can simply right-click the Log Server element and
select Current Alert PolicyRefresh to transmit any changes you have made in the Alert Policy
to the Log Server.
Acknowledging Alerts
Prerequisites: There must be at least one active alert in the system
Once your system starts generating alert entries they are sent to the Log Server. Alert entries
are displayed together with other types of log entries in the Logs view. Alert entries are marked
with an icon on their left side to help them stand out from the other log entries. Alerts that have
not yet been acknowledged are marked with an Unacknowledged Alert icon (a yellow triangle with
an exclamation mark and an asterisk).
Alert entries can be acknowledged in the Logs view and in the Web Portal. See the Web Portal
Online Help for more information about acknowledging alerts through the Web Portal. Once an
alert entry is acknowledged by an administrator, it is removed from the list of active alerts and
all Alert Chain processing for that alert entry is stopped. Alert entries can be acknowledged
individually, or you can acknowledge all the active alert entries at once.
Alert entries can be managed like other log entries. For instructions on using the log
management tools, see Getting Started with Log Data Management (page 800).
What’s Next?
 Acknowledge alerts either by Acknowledging Individual Alerts (page 241) or by
Acknowledging All Active Alerts (page 241).

Acknowledging Individual Alerts
Note – When you acknowledge an alert entry, alert escalation stops for that alert entry and
no new notifications are sent out from the Log Server to administrators.
 To acknowledge one or a few selected alert entries

1. Select MonitoringLogs from the menu. The Logs view opens.
2. Select only Alerts to be displayed using the drop-down list at the top of the Query
Properties panel. Optionally, you can also select MonitoringSystem Status in the menu
and click the number indicating the total number of alerts to open the Logs view which
shows all active alerts.
3. (Optional) Define additional filtering criteria to find the desired alerts.
4. Click Apply in the Query panel to filter the view.
5. Select one or more alert entries in the log entry table.
6. Select DataAcknowledge from the menu. A confirmation dialog opens.
7. Select Yes to acknowledge the alert(s).
Acknowledging All Active Alerts
Note – When you acknowledge an alert entry, alert escalation stops for that alert entry and
no new notifications are sent out from the Log Server to administrators.
 To acknowledge all displayed alerts

1. In the System Status view, click the number indicating the total number of alerts in your
system. The Logs view opens pre-filtered to show all active alerts.
2. Select DataAcknowledge All from the menu. A Confirmation dialog opens.
3. Select Yes to acknowledge the alerts.
Acknowledging Alerts 241

Using Custom Scripts for Alert Escalation
Prerequisites: None
All custom scripts must be stored in the same root path, which is defined for each Log Server in
the Log Server element’s properties (see Defining Alert Channels (page 233)). If the Log Server
is installed in the default installation directory, the path is:
• In Windows: C:\Stonesoft\StoneGate\data\notification\.
• In Linux: /usr/local/stonegate/data/notification/.
There is an example notification script in this directory called notify.bat in Windows and
notify.sh in Linux that can be modified for your own use. On Linux, the sgadmin user needs
read, write, and execute permissions in the script’s directory.
The alert information is given to the script as command arguments as described in Table 19.1.
Table 19.1 Arguments Passed to the Custom Scripts
Argument
Content Description
Number
1 Alert ID Identifies the alert uniquely in the system.
2 Alert Name The name defined in the alert properties.
The IP address of the Sensor, Analyzer, Firewall, or other system

3 Alert Originator
component that generated this alert.
4 Alert Date The date when the alert was originally generated.
5 Alert Message A short alert description.
The Severity value of the alert from 1 to 10 where 1 is the least

severe and 10 is the most severe. The numerical Severity value
6 Alert Severity
corresponds to the following Severity value in the generated alert:
1= Info, 2-4=Low, 5-7=High, and 8-10=Critical.
Alert Short
7 The contents of the Comment field in the alert properties.
Description
8 Event ID IPS only: reference to the event ID that triggered the alert.
Situation
9 Long description of the situation that triggered the alert.
Description
When the alert script is executed, the output (stdout) is appended to the notify.out file in the
script’s directory. The error output (stderr) is appended to the notify.err file in the script’s
directory.

The Linux script in Illustration 19.8 is an example on how to create an operating system log
entry using the custom script alert notification.
Illustration 19.8 Example Custom Alert Script

#!/bin/sh
# This script uses the ‘logger’ utility to create an operating system
# log entry of the StoneGate Log Server alert notification.
PATH=/bin:/usr/bin
# Create log entry: “StoneGate Alert (<ALERT_ID>): Severity <SEVERITY>

# : <ALERT_NAME> : <ALERT_DESCRIPTION>”
/usr/bin/logger “StoneGate Alert ($1): Severity $6 : $2 : $5”
exit 0
What’s Next?
 Alert scripts stored in the correct directory (as defined in the Log Server element’s
properties) can be called from Alert Chains by their name. See Editing Alert Chains
(page 235).
Setting up a Dedicated Alert Server

Prerequisites: You must have at least two Log Servers
The Alert Server features are part of every Log Server installation. However, you can also
forward all alerts from one Log Server to another. You can, for example, use one Log Server just
for handling alerts and have all the other Log Servers send the alerts they generate and receive
to the Log Server dedicated to handling alerts.
As a result, Alert Chains and Alert Policies do not need to be managed for each server, which
may help in simplifying alert management. On the other hand, you must consider that a loss of
that one Log Server then can mean that no alerts are received from anywhere in the system.
 To set up a dedicated Alert Server

1. Right-click a Log Server that you do not want to handle alerts anymore, and select
Properties. The Properties dialog for that Log Server opens.
2. Select the Forward all Alerts to option.
3. Select the Log Server you want to use as a dedicated Alert Server.
4. Click OK to close the dialog. The Log Server starts forwarding the alerts immediately.
Repeat as necessary for other Log Servers.
Setting up a Dedicated Alert Server 243

Testing Alerts
Prerequisites: None
You can test the correct functioning of alerting by sending a test alert. It is treated in the same
way as any other alert. The test alerts have the lowest possible severity value “Low” and they
have their own specific Situation. The sender is always an SMC server, so it is not possible to
test how alerts from other components are handled using the test alert.
Note – A test alert is escalated only if the Alert Policy rules match test alerts.
 To test an alert
view opens.
2. Browse to Alert ConfigurationAlerts.
3. Right-click the alert to be tested and select Test Alert. The Select Alert Server dialog
opens.
4. Select the server that will send the alert and click Select.
5. Check that the alert entry appears in the Logs view.
What’s Next?
 Acknowledge the alert as explained in Acknowledging Alerts (page 240).

C HAPT ER 20
DOMAINS
Domain elements allow you restrict which elements are displayed to the administrators in the
Management Client and in the optional StoneGate Web Portal. They also allow you to define in
which administrative Domain(s) an administrator has permissions. Configuring Domains
requires a special license.
Getting Started with Domains (page 246)

Creating Domains (page 247)
Logging in to a Domain (page 249)
Logging out of a Domain (page 250)
Deleting Domains (page 250)
Moving Elements Between Domains (page 250)
Using the Domain Overview (page 252)
245
Getting Started with Domains
Prerequisites: None
Domain elements help you in managing large networks and in defining administrator
permissions.
How Domains Can Be Configured
• Domain elements allow you to group together elements that belong to specific configurations
(for example, elements that belong to a specific customer or site).
• You can use Domains to divide responsibilities between administrators, so that
administrators only have access to elements in specific Domains.
What Do I Need to Know Before I Begin
• You must have a special license to be able to configure Domain elements. The number of
Domains that you can create depends on the license.
• The predefined Shared Domain is meant for all the elements that do not belong to a particular
customer or site. All the system elements belong to the Shared Domain. If there is no
Domain license in StoneGate or no Domains have yet been configured, all the elements
belong to the Shared Domain.
• The elements in the Shared Domain are displayed to all administrators when they are logged
in to any Domain in the Management Client.
• Domains, Management Servers, Secondary Management Servers, Log Pruning Filters, and
Administrator accounts with unrestricted permissions are elements that automatically belong
to the Shared Domain. You can only create these elements in the Shared Domain, and you
cannot move them to any other Domain.
1. Generate and install your purchased license for Domains, see Generating New Licenses
(page 826).
2. Define the Domain element(s) in the Shared Domain. See Creating Domains (page 247).
• If you have already configured Domain elements, you must log in to the Shared Domain to
create more Domains. See Logging in to a Domain (page 249).
3. Log in to each Domain and define the elements that belong to them. See Logging in to a
Domain (page 249).
• If you want to move existing elements from one Domain to another, you must first log in to
the Domain in which the elements are and then move the elements to the correct
Domain. See Moving Elements Between Domains (page 250).
Caution – The elements in the Shared Domain are displayed to all the administrators when
they log in to any Domain in the Management Client. Make sure that each Domain-specific
element is assigned to the right Domain.
246 Chapter 20 Domains

Creating Domains
Prerequisites: You must have installed a license for Domains and you must be logged in to the Shared Domain
Your Domain license defines how many Domains you can create. Only an administrator who has
unrestricted permissions can create Domains.
 To create a Domain
2. Expand the Other Elements branch.
3. Right-click Domains and select New Domain. The Domain Properties dialog opens.
Illustration 20.1 Domain Properties - General Tab.
4. Give the Domain a unique Name and enter an optional Comment with any information for
your own reference.
5. (Optional) Fill in the E-mail Address and Phone Number fields with information that you
want to be displayed in the Domain Overview.
You can define in the Domain properties an announcement that is displayed to the users of the
optional StoneGate Web Portal. See Writing Announcements to Web Portal Users (page 266).
What’s Next?
 If you want to define a logo for the Domain, continue by Defining a Domain Logo
(page 248).
 Otherwise, click OK. The Domain is ready for use. If you want to move existing elements
to the Domain, see Moving Elements Between Domains (page 250). To create new
elements in the Domain, continue by Logging in to a Domain (page 249).
Creating Domains 247

Defining a Domain Logo
You can define a logo for each Domain. The Domain logo is displayed in the upper right corner of
the Management Client window and next to the Domain’s name in the Domain Overview (see
Using the Domain Overview (page 252) for more information). It is also displayed in the
StoneGate Web Portal.
 To define a Domain logo

1. Switch to the Logo tab in the Domain element’s properties.
Illustration 20.2 Domain Properties - Logo Tab
2. Select the logo option from the list:

• Select None if you do not want to specify a logo for the Domain.
• Select an existing logo from the list or select Other and select a logo in the dialog that
opens.
• Or select New to import a new Logo in the Logo Properties dialog that opens.
3. Click OK. The Logo tab shows a preview of the select Logo.
You can define in the Domain properties an announcement that is displayed to the users of the
optional StoneGate Web Portal. See Writing Announcements to Web Portal Users (page 266).
What’s Next?
 Click OK. The Domain is ready for use. If you want to move existing elements to the
Domain, see Moving Elements Between Domains (page 250). To create new elements
in the Domain, continue by Logging in to a Domain (page 249).

Logging in to a Domain
Prerequisites: Creating Domains
If you only have permissions in a single Domain, you automatically log in to the Domain when
you log in to the Management Client. If you have permissions in more than one Domain, you
must log in to the correct Domain before managing elements that belong to the Domain. You
can be logged in to more than one Domain at the same time.
There are alternative ways to log in to a Domain:
• in the Management Client’s login dialog
• in the Domain Overview that opens automatically after Management Client login when you
have permissions in more than a single Domain
• in the Administration Configuration view
When you log in to a Domain, the Management Client displays by default the System Status
view that shows the status of the elements in the Domain.
 To log in to a Domain in the Management Client’s login dialog

1. To log in to a Domain in the Management Client’s login dialog, enter the User Name and
Password as usual.
2. In the Server Address field, select or enter the server’s IP address and enter the name of
the Domain separated by a slash (/) or a backslash (\) after the IP address.
Example 192.168.200.31/Example Domain or 192.168.200.31\Example Domain.
• If Remember Server Addess is selected, also the Domain information is saved in the
Server Address list for further logins.
3. Click Login.
 To log in to a Domain in the Domain Overview

1. If the Domain Overview is not open, select MonitoringDomain Overview from the menu.
2. In the Domain Overview, double-click the section where the Domain’s information is
displayed (see Using the Domain Overview (page 252)).
 To log in to a Domain in the Administration Configuration view

1. In the Administration Configuration view, browse to Other ElementsDomains in the
Administration tree.
2. Right-click a Domain and select Login.
Logging in to a Domain 249

Logging out of a Domain
Prerequisites: None
if you have permissions in more than one Domain, you can log out of Domains without closing
the Management Client either in the Administration Configuration view or in the Domain
Overview. Logging out through the Domain Overview is particularly useful if you are logged in to
multiple Domains.
 To log out of a Domain in the Administration Configuration view

1. In the Administration Configuration view, browse to Other ElementsDomains in the
Administration tree.
2. Right-click a Domain and select Logout.
 To log out of all Domains in the Domain Overview

1. If the Domain Overview is not open, select MonitoringDomain Overview from the menu.
2. To log out of all Domains that you are currently logged in to, select FileLogout from All
Domains from the menu.
Related Tasks
 Logging in to a Domain (page 249)
Deleting Domains
Only administrators who have unrestricted permissions can edit and delete Domains. You
cannot delete the predefined Shared Domain. If you delete a Domain, all the elements that
belong to the Domain are also deleted. If there are elements that you do not want to delete, you
must move them to another Domain before deleting the Domain (see Moving Elements Between
Domains (page 250)).
Moving Elements Between Domains

Most elements can be moved to a different Domain. However, some elements always belong to
the Shared Domain (predefined system elements, Domains, Management Servers, Secondary
Management Servers, Log Pruning Filters, and Administrator accounts with unrestricted
permissions) and you cannot move these elements from the Shared Domain.
 To move elements between Domains

1. Log in to the Domain from which you want to move element(s). See Logging in to a Domain
(page 249).
2. Select the element(s) that you want to move to another Domain (Shift- or Ctrl-click to select
multiple elements).
Tip – To see only elements from the current Domain, click the Tools icon and select Show Only
Current Domain.
3. Right-click one of the selected elements and select ToolsMove to Domain. The Move to
Domain dialog opens.

Illustration 20.3 Move to Domain Dialog
4. Click Select for the Target Domain.

5. (Optional) Select more elements that you want to move in the Elements panel and click
Add. The selected elements are added to the list of elements in the Content panel.
6. Click Move. StoneGate automatically checks if there are references from/to the selected
elements in the current Domain. A new view opens showing the reference status.
Illustration 20.4 References View

Elements to be moved
Referred or
referring
elements
More
information
on references
7. Check the information in the Element References panel.
Moving Elements Between Domains 251

8. If the panel shows Referring or Referenced Elements, expand the branches to see the
referring/referenced elements and resolve the element references:
• Select the element and click Add to move also that element or right-click the element and
use the commands in the menu that opens to resolve the references (for example, open
the policy that contains the element you want to move and remove the element from the
policy).
• Click Refresh when you have resolved a reference to view the status of element
references. You must resolve all element references before moving the selected
elements.
9. If the Element References panel is empty, there are no element references. Click Continue
to move the element(s) to the selected Domain.
What’s Next?
 If you want to view or modify the moved elements, log in to the Domain where you
moved them. See Logging in to a Domain (page 249).
Related Tasks
 Creating Domains (page 247)
Using the Domain Overview

The Domain Overview allows you to see at a glance if there are problems with some Domains
and their elements, so that you do not need the check their status separately for each Domain.
The Domain Overview is available only to administrators who have permissions in more than one
Domain. The information in the Domain Overview depends on the administrator’s rights. It only
shows information for those Domains in which the administrator has permissions. By default,
the Domain Overview shows the status of all Domains only to administrators who have
unrestricted permissions.
To open the Domain Overview in the Management Client, select Monitoring Domain Overview
from the menu. If Domain elements have been configured, the Domain Overview also
automatically opens when an administrator who has permissions in more than one Domain
logs in to the Management Client without specifying the Domain in the login dialog.
Illustration 20.5 Domain Overview

Login information
To log in to a
Domain, double-
click the Domain
information.
You can send

e-mail through
the shortcut.

The Domain Overview shows the names and logos of the Domains in which you have
permissions. It also shows any other information (for example, e-mail addresses and telephone
numbers) defined in the Domain properties. In addition, the Domain Overview shows the status
of the elements and the number of active alerts in each Domain.
You can log in to a Domain by double-clicking the Domain’s information in the Domain Overview.
You can log out of all Domains that you are currently logged in by selecting FileLogout from
All Domains from the menu in the Domain Overview.
Related Tasks
 Creating Domains (page 247)
 Deleting Domains (page 250)
Using the Domain Overview 253

C HAPT ER 21
SETTING UP THE WEB PORTAL
The Web Portal provides browser-based access to logs, reports, and policy snapshots for
specific authorized users. The Web Portal is provided by the Web Portal Server, which is an
optional component that you can purchase for your Management Center.
Getting Started with Web Portal Access (page 256)

Defining Web Portal Server Settings (page 257)
Activating HTTPS on the Web Portal Server
Allowing Web Portal Connections (page 259)
Defining Web Portal User Accounts (page 260)
Customizing the Web Portal (page 264)
Writing Announcements to Web Portal Users (page 266)
255
Getting Started with Web Portal Access
Prerequisites: Your must have licenses for running a Web Portal Server and creating Web Portal Users
What the Web Portal Does

The Web Portal provides restricted clientless access to logs, reports, and policy snapshots. It is
particularly useful for managed service providers for providing customers information about their
system. There is no software for end-users to install; they can access the information using a
Web browser.
Limitations of the Web Portal
If Domains are configured in your system, each Web Portal User account is always restricted to
working within a single Domain. Administrators with full unrestricted accounts can select
between domains after logging in to the portal if the Web Portal Server element is in the Shared
Domain.
In addition to the licensed limit for the number of user accounts you can create, each Web
Portal Server also has a fixed limit for the maximum number of concurrent users.
1. Define a Web Portal Server element. See Defining Web Portal Server Settings (page 257).
2. If providing the Web Portal over HTTPS, generate a certificate for the server. See Activating
HTTPS on the Web Portal Server (page 258).
3. Allow the necessary connections in the Firewall Access rules. See Allowing Web Portal
Connections (page 259).
4. Install the Web Portal Server. See the Installation Guide for instructions.
• We recommend placing the Web Portal Server in a DMZ network if you offer access to
external users.
• You must generate and install a License for the Web Portal Server.
5. Create Web Portal User accounts for the end-users. See Defining Web Portal User
• The number of Web Portal users you can configure is limited by license. You must
generate and install a separate License file for the Web Portal Users.
• Management Client administrator accounts are also valid in the Web Portal.
6. (Optional) Make installation-specific changes to your portal. See Customizing the Web
Portal (page 264).
What’s Next?
 To begin the configuration, proceed to Defining Web Portal Server Settings (page 257).
Related Tasks
 Writing Announcements to Web Portal Users (page 266)
256 Chapter 21 Setting up the Web Portal

Defining Web Portal Server Settings
Prerequisites: None
The Web Portal Server is a Web server that offers end-users access either through plain HTTP or
through the secure HTTPS protocol. The Web Portal Server fetches data from other Management
Center servers, filters it, and presents the resulting data to the users.
Caution – Always use HTTPS unless the connections are otherwise secured.
 To define a new Web Portal Server element

1. Select MonitoringSystem status from the menu.
2. Right-click Servers and select NewWeb Portal Server. The Web Portal Server Properties
dialog opens.
Illustration 21.1 Web Portal Server Properties
3. Enter a unique Name and the correct IP Address for the Web Portal Server.
4. Select the correct Location if necessary in your environment. See Getting Started with
System Communications (page 60).
5. Select the Log Server that is used as the Alert Server for sending the alerts generated by
this Web Portal Server.
6. Switch to the Web Portal tab and select Enable to activate the Web Portal.
7. (Optional) Enter the Host Name that the Web Portal uses.
8. (Optional) Change the (TCP) Port Number that the service listens. By default, the port 8080
is used.
Note – Make sure the listening port is not already in use on the server. For ports reserved
for StoneGate services, see Default Communication Ports (page 933).
Defining Web Portal Server Settings 257

9. (Optional) Enter the IP address to use in the Listen Only on Address field if the server has
several addresses and you want to restrict access to one address. Make sure the Host
Name you entered resolves to this address.
10.(Optional) Select Generate Server Logs if you want log files to be generated on the file
system when the Web Portal is accessed.
What’s Next?
 (Recommended) To encrypt the connections between the clients and the server,
continue by Activating HTTPS on the Web Portal Server.
 To use plain HTTP that sends the information in cleartext, click OK and continue by
Allowing Web Portal Connections (page 259).
Activating HTTPS on the Web Portal Server

Prerequisites: Defining Web Portal Server Settings
To protect the transported information from eavesdropping, you can encrypt the
communications by activating HTTPS on the Web Portal Server. If you secure the Web Portal
connections using HTTPS, the Web Portal Server requires a certificate. You can either self-sign
the certificate directly in the dialog or use an externally signed certificate:
• If you self-sign the certificate directly, Web browsers display a warning to the users and
require them to accept the certificate. The certificate is valid for one year. Renewing is done
by recreating the certificate in the same way as a new certificate is created (explained below).
• Alternatively, you can sign the certificate using an external certificate authority that the clients
already trust (such as one of the large commercial certificate authorities or a company-
internal certificate authority that all clients are configured to trust).
Certificates have a fixed validity time (from a certain date and time to a certain date and time).
Make sure the date, time, and timezone settings are correct on both the Management Server
and the Web Portal Server computers, as mismatches may prevent using the Web Portal. Clients
also check the certificate validity, but incorrect time settings on the client computers typically do
not prevent using the Web Portal. Instead, browsers usually display a warning that users can
dismiss.
 To activate HTTPS on the Web Portal

1. Select Enable HTTPS on the Web Portal tab of the Web Portal Server element.
2. Click Generate in the Pending Certificate Request section. The Web Portal Server
Certificate Request dialog opens.
Illustration 21.2 Web Portal Server Certificate Request

3. Sign the certificate request:
• To sign the certificate in this dialog, just click Self-Sign. This option is mainly intended for
testing purposes.
• To sign using an external certificate authority, click Export to save the certificate request
to a file. After signing, you can Import the signed certificate file through this same Web
Portal Server Properties dialog. This method is recommended when setting up a system
for everyday use, so that you can use a certificate authority that the clients are already
configured to trust.
4. When the certificate is signed, click OK in the pop-up message that opens to delete the
certificate request. The certificate request is not needed when the signed certificate is
present.
5. Click OK.
What’s Next?
 Modify the Access rules to allow Web Portal connections as instructed in Allowing Web
Portal Connections (page 259).
Allowing Web Portal Connections

Prerequisites: Defining Web Portal Server Settings
If the connections are routed through a firewall, you must modify the IPv4 Access rules in your
security policy to allow the connections from the Web Portal Server to the Management Server
and the Log Server, and the end-user connections to the Web Portal Server.
 To configure Access rules for the Web Portal

 Allow following connections in the IPv4 Access rules as needed:
Table 21.1 Access Rules for Web Portal Server
Source Destination Port/Service Action

Port defined in the Web
Web Portal users’ networks (or hosts) Web Portal Server Portal Server Properties Allow
dialog.
Management SG Control
Web Portal Server Allow
Server (8902-8913/TCP)
SG Data Browsing (Web

Web Portal Server Log Server(s) Portal Server) Allow
(8916-8917/TCP)
Note – Remember to adjust the NAT rules as well if it is necessary in your network setup.
Allowing Web Portal Connections 259

What’s Next?
 Install the Web Portal Server’s license and the Web Portal Server as instructed in the
Management Center Installation Guide.
 Create Web Portal User accounts for the end-users. See Defining Web Portal User
 To change the appearance of the portal, see Customizing the Web Portal (page 264).
Defining Web Portal User Accounts

Prerequisites: The number of Web Portal user accounts in the system must not exceed your licensed limit
End-users are defined using special Web Portal User accounts. Management Client
administrator accounts are also valid in the Web Portal to allow testing and other internal use.
If Domain elements have been configured, each Web Portal user account always belongs to a
specific Domain and only grants permissions to the Domain in which the Web Portal User
element is created.
 To create a Web Portal user account

2. Right-click Access Rights and select NewWeb Portal User from the menu. The Web
Portal User Properties dialog opens.
Illustration 21.3 Web Portal User Properties - General Tab
3. Enter a unique Web Portal user Name. This is the username that the Web Portal user uses
to log in to the StoneGate Web Portal.
4. For Internal Authentication, configure the settings as follows:
• Type in a Password and confirm it in the field below, or click Generate Password to
generate a random 7-digit alphanumeric password.
• Select whether the account is Always Active or enter an Expiration Date.

5. For RADIUS Authentication, select a RADIUS server from the list.
• See Authenticating Administrators Using RADIUS (page 226) for more information.
Caution – We recommend that passwords be at least eight characters long and contain a
combination of numbers, letters, and special characters. Secure passwords are never
based on personal information such as names, birthdays, social ID numbers, phone
numbers, street names, or registration plate numbers.
What’s Next?
 Continue by Granting Engines to a Web Portal User.
Granting Engines to a Web Portal User

To define a Web Portal user’s permissions, you must first select the engines.
 To select granted engines for a Web Portal User

1. Switch to the Engines tab in the Web Portal User element’s properties.
Illustration 21.4 Web Portal User Properties - Engines Tab
2. Select the granted engines:

• Click Allow ANY if you want to grant all the engines to the Web Portal user. If Domain
elements have been configured, only the engines in the current Domain are granted to the
Web Portal user.
• Or click Add to select the engines. The Select Engine dialog opens.
3. Select the engine(s) from which the administrator is allowed to view logs and/or policy
snapshots and click Select.
What’s Next?
 Continue by Selecting Policy Permissions for a Web Portal User (page 262).
Related Tasks
 Selecting Report Data Permissions for a Web Portal User (page 264)
 Selecting Log Browsing Permissions for a Web Portal User (page 263)
Defining Web Portal User Accounts 261

Selecting Policy Permissions for a Web Portal User
You can select one or more policies from which the Web Portal user is allowed to view policy
snapshots. You can only select policies that are installed on engines granted to the Web Portal
user (see Granting Engines to a Web Portal User (page 261)). You can define in fine detail which
parts of the policies are shown in the policy snapshots.
 To select policy permissions for a Web Portal User

1. Switch to the Policies tab in the Web Portal User element’s properties.
Illustration 21.5 Web Portal User Properties - Policies Tab
2. Define if the Web Portal user has access to policy snapshots:

• Deselect Show Policy Snapshots from Granted Engines if you want to deny the Web
Portal user access to policy snapshots. Proceed to Selecting Log Browsing Permissions
for a Web Portal User (page 263) to define the log permissions for the Web Portal user.
• Otherwise, make sure that the option is selected.
3. (Optional) Deselect Show Main Policies if the Web Portal user is not allowed to view the
rules in the upper-level policies.
4. (Optional) Select Show Inherited Rules if the Web Portal user is allowed to view rules
inherited from policy templates.
• If you want to select from which templates inherited rules are shown, click Add and select
the template(s) in the dialog that opens.
5. (Optional) Deselect Show Sub-Policies if the Web Portal user is not allowed to view
information from sub-policies.
• If you want to select the sub-policies from which rules are shown, click Add and select
one or more sub-policies in the dialog that opens.
6. (Optional) Deselect Show Policy Upload History if the Web Portal user is not allowed to
view and compare all policy snapshots from the granted engines.
• If this option is selected, the Web Portal user can view and compare policy snapshots of
any policies that have been installed on the granted engines (not only policy snapshots of
policies granted to the Web Portal user).

7. (Optional) Deselect Show Policy Upload Comments if the Web Portal user is not allowed to
view the comments that administrators have added at policy upload.
What’s Next?
 Continue by Selecting Log Browsing Permissions for a Web Portal User.
Selecting Log Browsing Permissions for a Web Portal User

 To select log browsing permissions for a Web Portal User
1. Switch to the Logs tab in the Web Portal User element’s properties.
Illustration 21.6 Web Portal User Properties - Logs Tab
2. Define if the Web Portal user is allowed to view logs in the Web Portal:
• Deselect Show Logs from Granted Engines to deny the Web Portal user access to logs.
Proceed to Selecting Report Data Permissions for a Web Portal User (page 264).
• Otherwise, make sure that the option is selected.
3. (Optional) Click Select next to Log Filter Selection to define a Filter that is applied to the
log data before the data is displayed to the Web Portal user.
4. (Optional) Click Add next to Log Browsing Filters to select one or more Filter Type(s) that
define the groups of Filters that the Web Portal user can use when browsing log data in the
Web Portal.
What’s Next?
 Continue by Selecting Report Data Permissions for a Web Portal User (page 264).
Defining Web Portal User Accounts 263

Selecting Report Data Permissions for a Web Portal User
 To select report data permissions for a Web Portal User
1. Switch to the Reports tab in the Web Portal User element’s properties.
Illustration 21.7 Web Portal User Properties - Reports Tab
2. Define if the Web Portal user is allowed to view reports in the Web Portal.
• Deselect Show Reports to deny the Web Portal user access to reports.
• Otherwise, make sure that Show Reports is selected.
3. Click Add if you want to select the Reports Designs based on which the Web Portal user is
allowed to view reports. The Web Portal user is allowed to view all the reports that are
based on the granted Report Resigns (regardless of the Domain in which the reports were
created if Domain elements have been configured).
4. Click OK to save the Web Portal User element. The Web Portal user account is ready for
use.
Related Tasks
 Reports (page 145)
Customizing the Web Portal

Prerequisites: See Getting Started with Web Portal Access
Adding a New Web Portal Language

You can add new translations of the Web Portal interface labels in addition to the default
languages offered. When you modify the language files, save the file using the UTF-8 or the UTF-
16 character encoding. Visit the StoneGate user community at
http://stoneblog.stonesoft.com/stoneblog-community/ for some example translation files.
Importing a Web Portal Language File through the Management Client

 To import a language file through the Management Client

2. Browse to Other ElementsWeb Portal Localizations. A list of existing Web Portal
Localizations opens.
3. Right-click the list and select New Web Portal Localization. The Web Portal Localization
4. Click Import and browse to the location of the language file. You are prompted to confirm
the change of Locale.
5. Click Yes. The contents of the imported language file are displayed in the dialog.
6. Click OK to save the changes.
Importing a Web Portal Language File on the Command Line

The language files can be imported on the command line using the
<installation directory>/bin/sgImportWebPortalLanguage script on the Web Portal
server. See Management Center Commands (page 918) for more information.
Enabling/Disabling a Web Portal Localization

Web Portal Localization languages can be enabled and disabled through the Management
Client. Disabled Web Portal Localizations are marked with an icon.
 To enable/disable a Web Portal language

2. Browse to Other ElementsWeb Portal Localizations. A list of existing Web Portal
Localizations opens.
3. Right-click the Web Portal Localization and select Enable/Disable. The language is shown/
hidden in the Web Portal language selection options.
Customizing the Web Portal 265

Customizing the Look of the Web Portal
The Web Portal pages presented to the users are generated dynamically based on configuration
files. The following aspects of the presentation can be adjusted:
• If you are using Domains, the icon in the Web Portal is sourced from the icon defined for the
Domain in the Management Client. See Defining a Domain Logo (page 248).
• You can add new languages as explained in Adding a New Web Portal Language (page 264).
In addition to the two items listed above, it is possible to customize the Web Portal source files
more extensively, but with some major limitations:
• Any changes to files are overwritten at upgrade.
• It may not be possible to reuse customized files after an upgrade. You may have to re-
customize the corresponding new files after the upgrade.
• Customization requires some previous knowledge of HTML and CSS coding.
With the issues mentioned above in mind, the following local files on the Web Portal Server
control the display of content to users and are fairly safe to edit (although we recommend you to
create copies of the files before you edit them):
• The CSS files are stored in <installation directory>/webserver/webapps/webclient/
resources/css/.
• The page template files that are stored in <installation directory>/webserver/
webapps/webclient/ as several .jsp files.
• The help pages that are stored in <installation directory>/webserver/webapps/
webclient/help/ as several .jsp files.
Writing Announcements to Web Portal Users

Prerequisites: See Getting Started with Web Portal Access
You can display announcements to the administrators who log in to the StoneGate Web Portal.
This can be useful, for example, for service break notifications.
 To define an announcement for Web Portal users

1. Open the properties of the correct element:
• Announcements in the Web Portal Server element are shown for all users that connect to
that Web Portal Server.
• Announcements in the Management Server properties are shown for all users.
• If you have administrative Domains, announcements in the properties of Domain
elements are shown to users that exist within that specific Domain (or to all users if
defined in the properties of the Shared Domain).
• You can define an announcement in any combination of the elements listed above. Each
type of announcement adds a bullet point for users who can view several
announcements.
2. Switch to the Announcement tab.
3. Select Display Announcement to Web Portal Users, and enter the announcement in the
field below. The length is limited to 160 characters. You can add formatting to the
announcement with standard HTML tags (which are also included in the character count).
Example This produces <b>boldface</b> text.
Example This produces <u>underlined</u> text.

Example This text is displayed in the automatically added bullet point.
</li><li>But this text is displayed in a second bullet point underneath.
Example Here is an internal <a href="policies/policies.jsf">link</a>.
Example Here is an external <a href="http://www.example.com">link</a>.
Example Here is a small image scaled to be roughly proportionate with the surrounding text
<img height=”20px” src="http://www.example.com/images/note_icon.jpg">
Note – If you leave out the protocol (HTTP:// or HTTPS:// part) from a URL, the protocol is
attached automatically based on the protocol the Web Portal Server is using. This may
prevent an otherwise valid link from working.
4. Click OK. The announcement is displayed on the home page of the Web Portal (Services
page) to affected users the next time they (re)load the page.
The announcement can be removed from the Web Portal by disabling the Display
Announcement to Web Portal Users option. The announcement you have entered is not
deleted, so you can later display the same announcement without typing it in again.
Related Tasks
 Defining Web Portal User Accounts (page 260)
Writing Announcements to Web Portal Users 267

C HAPT ER 22
DISTRIBUTING MANAGEMENT CLIENTS

THROUGH WEB START
The Management Client can be distributed through Web Start. This eliminates the need for
each administrator to upgrade their client when the SMC is upgraded to a new version (the
version of the client must always match the version of the Management Server).
Getting Started with Web Start Distribution (page 270)

Activating Web Start on Management Server (page 271)
Distributing Web Start from External Servers (page 272)
Accessing the Web Start Clients (page 273)
269
Getting Started with Web Start Distribution
Prerequisites: None
What Web Start Distribution Does

Distributing Management Clients through Web Start allows users to log in to the Management
Client through a Web browser.
The Management Server can be configured to serve a Web page for launching the Management
Client. When the Management Center is upgraded, the Web Start files are also updated, and
Web Start automatically downloads the updated version when the user logs in. Alternatively, you
can make the clients available on some other server, with the limitations described below.
Limitations of Web Start Distribution
The new Management Client version is automatically available to the Web Start users when the
Management Center is updated only if you use the Management Server as the Web Start server.
If you install the Web Start package on another server, you must delete the existing files and
install a new Web Start package according to the instructions in Distributing Web Start from
External Servers (page 272) each time you upgrade the Management Center.
When the Web Start package is installed on a shared network drive, the path to the network,
including the drive letter, must be the same for all administrators that use that particular version
of the Web Start package. If the network drive paths vary, consider placing the package on a
Web server instead, for example, in the Intranet of your company.
What Do I Need to Know Before I Begin?
A current version of the Java Runtime Environment (JRE) must be installed on each computer
where the Web Start installation is to be used. It can be downloaded for free from www.java.com
or from java.sun.com.
1. Enable Web Start access in one of the following ways depending where users will access
the Web Start login:
• Enable Web Start access on the Management Server as instructed in Activating Web Start
on Management Server (page 271)
• Configure Web Start access on a separate Web server or shared network drive as
instructed in Distributing Web Start from External Servers (page 272).
2. Test the Web Start distribution as instructed in Accessing the Web Start Clients
(page 273).
What’s Next?
 If you want to use the Management Server as a Web Start server, proceed to Activating
Web Start on Management Server (page 271).
 Otherwise, proceed to Distributing Web Start from External Servers (page 272).
270 Chapter 22 Distributing Management Clients Through Web Start

Activating Web Start on Management Server
Prerequisites: None
When you install the Management Server, the files needed for distributing the Management
Clients are included in the installation. You can simply enable Web Start access to these files
on the Management Server. This activates a Web page that administrators can contact using a
Web Browser to launch the Management Client.
 To enable a Web Start server

1. Right-click the Management Server that you want to use as a Web Start server and select
Properties. The Management Server Properties dialog opens.
2. Switch to the Web Start tab.
Illustration 22.1 Management Server Properties
3. Select Enable. The Web Start service is activated.

4. (Optional) Enter the Host Name that the Web Start service uses.
5. (Optional) Enter the (TCP) Port Number that the service listens. By default, the standard
HTTP port 80 is used.
Note – Make sure the listening port is not in use on the server. For ports reserved for
StoneGate services, see Default Communication Ports (page 933).
6. (Optional) Enter the IP address to use in the Listen Only on Address field if the server has
several addresses and you want to restrict access to one address. Make sure the Host
Name you entered resolves to this address.
7. (Optional) Select Generate Server Logs if you want to log all file load events for further
analysis with external web statistics software.
8. Click OK.
If you leave the Host Name and Listen Only on Address fields empty, the users can access the
Web Start files at any addresses that the Management Server may have.
What’s Next?
 Test the Web Start installation by following the instructions in Accessing the Web Start
Clients (page 273).
Activating Web Start on Management Server 271

Distributing Web Start from External Servers
Prerequisites: None
You can use Web Start even if you do not want to use the Management Server as a Web Start
server. In this case, you can place the Web Start package on any Web Server.
The Web Start package can also be placed on a shared network drive. There is a limitation to
this: the path to the network, including the drive letter, must be the same for all administrators
that use that particular version of the Web Start package.
Note – You must delete the existing files and install a new Web Start package according to
these instructions each time you upgrade the Management Center. Otherwise, any
administrators that use Web Start-installed Management Clients are not able to log in.
 To install the Web Start package

1. Browse to StoneGate_SW_InstallerWebstart on the installation CD-ROM.
Caution – The Web Start installation creates an index.html file. Any existing index.html file
will be overwritten. We strongly recommend creating a new directory for the Web Start
files.
2. Copy all files and all directories from the Web Start directory on the installation CD-ROM to
the directory on the Web server or network drive where you want the Web Start files to be
served.
3. On the command line, change to the directory on your server where the Web Start files are
located.
4. Run the Web Start setup script and give the URL or the path of the directory on your server
where the Web Start files are located as the parameter:
• Windows: cscript webstart_setup.vbs <web start directory>
• Linux: ./webstart_setup.sh <web start directory>
Table 22.1 Example Web Start Paths
Installation on Example Web Start Directory

Web server http://www.example.com/webstart/
Network drive file://localhost/C:/support/webstart/
5. If necessary, modify the configuration of the Web server to return the appropriate MIME
type for.jnlp files (application/x-java-jnlp-file). Consult the manual of your Web
server for instructions on how to configure the MIME type.

6. Delete the webstart_setup.vbs and webstart_setup.sh files from the directory.
• For security reasons, the webstart_setup.vbs and webstart_setup.sh script files should
not be in the same directory as the generated Web Start files and other shared client
files.
What’s Next?
 Test the Web Start installation by following the instructions in Accessing the Web Start
Clients.
Accessing the Web Start Clients

Prerequisites: Activating Web Start on Management Server/Distributing Web Start from External Servers
After the Web Start package is installed on a Web server or a network drive or the Management
Server has been enabled as a Web Start Server, the administrators can install the Management
Client using the Web Start package.
To be able to use the Web Start Management Client, there must be a current version of the Java
Runtime Environment (JRE) installed (the version required is shown on the example login page
provided).
Note – If Web Start access is required through the firewall, you must allow these
connections in your firewall’s policy. They are not allowed by default.
 To access the Web Start Clients

1. Enter the Web Start download page address in your Web browser
http://<server address>:<port>
• :<port> is only needed if the server is configured to run on a different port from the HTTP
standard port 80.
2. Click the link for the Web Start client.
• Web Start automatically checks if the version on the server is already installed on your
local computer. If not, the new client is automatically installed on your computer. This is
done each time the client is started this way, automatically upgrading your client
installation whenever needed without any action from you.
• The client starts and displays the login dialog.
3. Log in with your account credentials.
Related Tasks
 See Administrator Accounts (page 213) for information on setting up user accounts for
Management Clients.
Accessing the Web Start Clients 273

C HAPT ER 23
LOG SERVER CONFIGURATION
The sections below contain information on how to define Log Servers, how to change Log
Server configuration parameters, and how to export log data from a Log Server to an external
syslog server.
Defining a Log Server (page 276)

Changing Log Server Configuration Parameters (page 279)
Exporting Log Data to Syslog (page 282)
275
Defining a Log Server
Prerequisites: None
Usually, the StoneGate Log Server element is created during the Log Server installation.
However, a different Log Server element can also be defined manually. For more information on
defining a Log Server element during installation, see the StoneGate Management Center
Installation Guide or StoneGate IPS Installation Guide.
The Log Server installation always includes the Alert Server. You can let the Log Server function
in both roles, or you can forward all alerts from one Log Server to another, for example to use it
as a dedicated, central Alert Server (see Setting up a Dedicated Alert Server (page 243)).
Related Tasks
 Defining a Log Server Element (page 276)
 Certifying the Log Server (page 278)
 Configuring an Alert Server (page 278)
Defining a Log Server Element

 To define a new Log Server element
2. Right-click Servers and select NewLog Server. The Log Server Properties dialog opens.
Illustration 23.1 Log Server Properties
3. Specify the Name and IP Address of the server.

4. A Location and Contact Address are needed if there is a NAT device between a firewall/
sensor/analyzer and the Log Server. For instructions, see Defining Contact IP Addresses
(page 62).
276 Chapter 23 Log Server Configuration

5. (Optional) Define the Log Server’s TCP Port Number. We recommend that you always use
the default port 3020 if possible.
Note – If you want to use a non-standard port for the Log Server, you must manually add
rules to allow communications using the new port from the firewall engines to the Log
Server even when using the Default template.
6. (Optional) If you want the Log Server to send its own alerts and forward all alerts it receives
to a different Log Server, select the Forward all Alerts to option and then select the correct
Log Server from the selection box.
7. (Optional) If you want to use additional commands with the new Log Server, select a Tools
Profile for adding the new commands.
8. (Optional) Select Exclude from Log Browsing, Statistics and Reporting if you do not want
the Log Server to gather statistical information for monitoring and you do not want its
logging data to be included in Reports. In most situations, it is better to leave this option
deselected (for more information about Reports, see Reports (page 145)).
Caution – Be very careful when excluding Log Servers from reporting. If you select this
setting for a Log Server that is in use, there is no warning that the generated reports are
missing parts of the log data.
9. Click OK.
What’s Next?
 If you want to set one or several secondary Log Servers for the Log Server, select the
secondary Log Servers as described in Selecting Secondary Log Servers (page 277).
 If you plan to use this Log Server for Alert Escalation, continue with the alert escalation
configuration as explained in Getting Started with Alert Escalation (page 230).
 Otherwise, check that the Log Server is licensed and certified (see Generating New
Licenses (page 826) and Certifying the Log Server (page 278)).
Selecting Secondary Log Servers

You can select several secondary Log Servers for a Log Server in a Log Server’s properties. The
same Log Server can simultaneously be a primary Log Server for some components and a
secondary Log Server for components that primarily use some other Log Server. You can also
set Log Servers to be secondary Log Servers for each other so that whenever one goes down,
the other Log Server is used. If you have not yet defined secondary Log Servers, see Installing a
Secondary Log Server (page 293).
Caution – If the log volumes are very high, make sure that the secondary Log Server can
handle the traffic load in fail-over situations.
 To select a secondary Log Server

2. Select Servers.
Defining a Log Server 277

3. Double-click to open the properties of the Log Server that you want to select a secondary
Log Server.
4. Switch to the High Availability tab.
Illustration 23.2 Log Server Properties - High Availability Tab
5. Click Add. The Select Element dialog opens.

6. Select one or more Log Servers and click Select.
7. Click OK.
Certifying the Log Server

If the Log Server was not certified during the installation, or if it needs a new certificate, certify
it as directed below.
 To certify the Log Server

1. Stop the Log Server:
• If you run the Log Server as a service in Windows, you can stop it in the Windows Control
Panel’s Services list.
• Otherwise, run the script <installation directory>/bin/sgStopLogSrv.bat (in
Windows) or <installation directory>/bin/sgStopLogSrv.sh (in Linux).
2. Request the certificate:
• In Windows, run the script <installation directory>/bin/sgCertifyLogSrv.bat.
• In Linux, run the script <installation directory>/bin/sgCertifyLogSrv.sh.
3. Log in using a Superuser-level StoneGate administrator account.
4. If there are Domains configured in the system and the Log Server does not belong to the
Shared Domain, enter the name of the Domain.
5. Wait for the certification to finish and start the Log Server again through the Windows
Services list or using the sgStartLogSrv script.
Configuring an Alert Server

The Alert Server is always included in every Log Server installation, so you have a functioning
Alert Server if you have properly configured a Log Server. If you have not done so already, define
an Alert Server for each Management Server you have, see Modifying a Management Server
Element (page 302).
If you want to set up a dedicated Alert Server that does not handle logs, refer to Setting up a
Dedicated Alert Server (page 243).
Related Tasks
 Getting Started with Alert Escalation (page 230)

Changing Log Server Configuration Parameters
Prerequisites: None
To configure the Log Server in detail, you can edit the Log Server configuration file
LogServerConfiguration.txt as explained in this section. The file is located on the Log
Server machine in the folder <installation directory>/data/.
Normally, it is not necessary to configure the Log Server any more than it is possible through the
Log Server element in the Management Client. However, under special circumstances, you may
want more control over the way the Log Server behaves.
 To change the Log Server configuration parameters

1. Stop the Log Server.
2. Open the LogServerConfiguration.txt file in a text editor.
3. Modify the parameter values as explained in Table 23.1.
4. Save the changes.
5. Restart the Log Server.
All configuration parameters are listed in the following table. Note that all parameters are not
listed in the default configuration file and must be added manually if needed.
Table 23.1 Log Server Configuration Parameters in LogServerConfiguration.txt file
Parameter name Description

Directory that is used for storing the logs archived by the Log Data
tasks. By default, ARCHIVE_DIR_0=${SG_ROOT_DIR}/data/
ARCHIVE_DIR_0
archive. You can define up to 32 directories: ARCHIVE_DIR_0 …
ARCHIVE_DIR_31.
Directory used for archiving audit logs. By default,

AUDIT_ARCHIVE_DIR
${SG_ROOT_DIR}/data/audit/archive.
The threshold for minimum available disk space for audit logs. If
AUDIT_DISK_LIMIT the free disk space goes below this limit, the Log Server considers
the disk full and stops storing audit logs.
Directory used for audit logs. By default, ${SG_ROOT_DIR}/data/

AUDIT_LOG_DIR
audit/log.
The number of alerts that are automatically acknowledged if the

AUTO_ACK_ALERT_NB active alert list is full (5000 by default). The alerts by lowest
severity and oldest timestamp are acknowledged first.
The threshold for minimum available disk space (in kilobytes). If

the free disk space goes below this limit, the Log Server considers
DISK_THRESHOLD_IN_KBYTES
that the disk is full and stops storing log records (100000 by
default).
FILESTORAGE_ALERT_DIR Directory used for Alerts. By default, ${FILESTORAGE_DIR}/Alerts.
Directory used for Alert event traces. By default,

FILESTORAGE_ALERT_EVENT_TRACES_DIR
${FILESTORAGE_DIR}/AlertEvent.
Changing Log Server Configuration Parameters 279

Table 23.1 Log Server Configuration Parameters in LogServerConfiguration.txt file (Continued)

FILESTORAGE_IPS_DIR Directory used for IPS logs. By default, ${FILESTORAGE_DIR}/IPS.
Directory used for StoneGate IPS event recording files. By default,

FILESTORAGE_IPS_RECORDINGS_DIR
${FILESTORAGE_DIR}/IPS_Recordings.
Directory used for firewall logs. By default, ${FILESTORAGE_DIR}/

FILESTORAGE_STONEGATE_DIR
Firewall.
SNMP community string used for sending SNMP messages from

SNMP_COMMUNITY
the Log Server (public by default).
SNMP Enterprise Object Identifier (OID) used for SNMP messages

SNMP_ENTERPRISE_OID
sent from the Log Server (.1.3.6.1.4.1.1369 by default).
Directory used for Log Server backup files. By default,

LOG_BACKUP_DIR ${SG_ROOT_DIR}/backups. The backup files must be moved to a
separate media after creating a backup.
Directory used for storing the files exported by Log Data tasks. By
LOG_EXPORT_DIR
default, ${SG_ROOT_DIR}/data/export.
Log Server port that listens for connections from the StoneGate
LOG_FW_PORT Firewall/VPN and IPS engines (3020 by default). Changing this
value requires reinstalling the Log Server software.
Directory used for storing the logfile.txt that logs the task
LOG_LOGFILE_DIR
scheduler operations. By default, ${SG_ROOT_DIR}/data.
Timeout (in milliseconds) for queries in the Logs view (30000 by

LOG_QUERY_TIMEOUT
default).
Directory for the scripts used in Log Data tasks. By default,

LOG_SCRIPT_DIR
${SG_ROOT_DIR}/data/script.
IP address of the Log Server. Changing this value requires

LOG_SERVER_ADD
reinstalling the Log Server software.
Maximum number of active alerts. If there are more alerts, they are
MAX_ACTIVE_ALERT_NB
automatically acknowledged (50000 by default).
IP address of the Management Server. Do not change this

parameter value directly to the file. Instead, use the
MGT_SERVER_ADD
sgChangeMgtIPOnLogSrv.bat (or .sh) script to change this
parameter value.
The script used for starting the Log Server database. By default,
PHY_EXE
bin\\sgStartLogDatabase.bat or bin/sgStartLogDatabase.sh.
Log Server database location. By default, ${SG_ROOT_DIR}/data/

PHY_LOC
db/logserver.
Log Server database port that the Log Server connects to (1314 by
PHY_PORT
default).


Defines the port used for receiving SNMP traps. The default port is
SNMP_TRAP_RECEPTION_PORT UDP 162 in Windows and UDP 5162 in Linux. Note, that only the
reception of SNMPv1 traps is supported.
Configuration file for syslog data. By default, the file is stored in

${SG_ROOT_DIR}/data/fields/syslog_templates.
This parameter is currently needed only when StoneGate IPS is
SYSLOG_CONF_FILE
configured to send syslog data to Bradford Networks’ NAC Director
or Campus Manager. The bradford_syslog_conf.xml file is then
used as the configuration file.
SYSLOG_EXPORT_FORMAT The file format used for syslog exporting. Either CSV or XML.
Defines whether to export StoneGate Alerts to syslog. Either YES

SYSLOG_EXPORT_ALERT
or NO.
Defines whether to export StoneGate Firewall/VPN logs to syslog.

SYSLOG_EXPORT_FW
Either YES or NO.
Defines whether to export StoneGate IPS logs to syslog. Either YES

SYSLOG_EXPORT_IPS
or NO.
Defines how many of the defined filters a log event must match to
forward the event to the syslog server. The value “ALL” sends only
SYSLOG_FILTER_MATCH events that match all defined filters. The value “ONE” sends all
events that match any of the defined filters. The value “NONE”
sends only events that match none of the defined filters.
Defines how the defined filters are used for sending events to the
SYSLOG_FILTER_TYPE syslog server. The value “KEEP” sends all the matching events.
The value “DISCARD” sends only the events that do not match.
The priority (0–191) of the syslog message is included at the

SYSLOG_MESSAGE_PRIORITY
beginning of each UDP packet (the default is 6). See RFC 3164.
SYSLOG_PORT The target UDP port for sending syslog. The default port is 514.
The UDP port for receiving syslog. If this parameter has not been
defined, the default port (514 for Windows or 5514 for Linux) is
SYSLOG_RECEPTION_PORT used.
Note - In Linux the value of this parameter must always be set >
1024.
The TCP port for receiving syslog. If this parameter has not been
defined, the UDP default port (514 for Windows and 5514 for
SYSLOG_RECEPTION_TCP_PORT Linux) is used.
Note - In Linux the value of this parameter must be set > 1024.
The IP address of the syslog server used for sending log events to
SYSLOG_SERVER_ADDRESS
syslog using the UDP protocol.
Changing Log Server Configuration Parameters 281


The IP address of the syslog server used for sending log events to
SYSLOG_TCP_SERVER_ADDRESS
syslog using the TCP protocol.
SYSLOG_TCP_PORT The target TCP port for sending syslog. The default port is 514.
Defines whether to use double quotes (“) in syslog messages to

delimit the field values. The default setting
SYSLOG_USE_DELIMITER “ALWAYS_EXCEPT_NULL” uses double quotes only for non-empty
fields. “NEVER” does not use delimiters. “ALWAYS” uses double
quotes as delimiters for all empty and non-empty field values.
Exporting Log Data to Syslog

Prerequisites: None
StoneGate Log Servers can be configured to send log data to external syslog servers. The log
data to be transmitted can be selected by using filters just as any other StoneGate log data.
Logs that are deleted by the Immediate Discard log pruning filters are not sent to a syslog
server. Discard Before Storing pruning does not affect syslog exports. Audit entries cannot be
exported to a syslog server.
What’s Next?
 To configure the syslog settings of the Log Server, first adjust the Defining
General Syslog Settings.
Defining General Syslog Settings

 To define general syslog settings
1. Stop the Log Server.
• If you have defined the Log Server as a service in Windows you may stop the Log Server in
the Windows Services list. Alternatively, you can run
<installation directory>/bin/sgStopLogSrv.bat.
• In Linux, run <installation directory>/bin/sgStopLogSrv.sh.
2. Create a text file on the Log Server that lists the fields to export in the correct order.
• The <installation directory>/data/fields/syslog_templates/ directory contains
example configuration files, which show you the correct syntax to use.
• See Log Entry Fields (page 976) for listings of the syslog export names for the log fields.

3. Modify the LogServerConfiguration.txt file as shown in Table 23.2. The file is located
in <installation directory>/data/. For a list of syslog entry message categories, see
Syslog Entries (page 1014).
Table 23.2 Log Server Configuration
Parameter Value Description

Path to the file you created in Step 2,
SYSLOG_CONF_FILE <File name> which defines the fields that are exported
and their order.
YES Defines whether to export Alert entries to

SYSLOG_EXPORT_ALERT
NO syslog.
CSV Defines the file format used for syslog

SYSLOG_EXPORT_FORMAT
XML exporting. Either CSV or XML.
YES Defines whether to export StoneGate

SYSLOG_EXPORT_FW
NO Firewall/VPN logs to syslog.
YES Defines whether to export IPS logs to

SYSLOG__EXPORT_IPS
NO syslog.
ALL The log is exported if it matches all filters.
The log is exported if it matches at least

ONE
SYSLOG_FILTER_MATCH one filter.
The log is exported if it does not match

NONE
any of the filters.
The matching logs are sent to the syslog

KEEP
server.
SYSLOG_FILTER_TYPE
The matching logs are not sent to the
DISCARD
syslog server.
The priority of the syslog message is

included at the beginning of each UDP
SYSLOG_MESSAGE_PRIORITY 0-191 a packet (the default is 6).
a) As defined in RFC 3164 (http://
www.ietf.org/rfc/rfc3164.txt).
The target UDP port for sending syslog.

SYSLOG_PORT [UDP port]
The default port is 514.
The IP address of the syslog server for

SYSLOG_SERVER_ADDRESS [IPv4 address] syslog sending over UDP. If left empty,
transfers are not made.
The IP address of the syslog server for

syslog sending over TCP. This parameter is
SYSLOG_TCP_SERVER_ADDRESS [IPv4 address]
not listed by default. If left empty,
transfers are not made.
Exporting Log Data to Syslog 283

Table 23.2 Log Server Configuration (Continued)
Parameter Value Description

The target TCP port for sending syslog. The
SYSLOG_TCP_PORT [TCP port] default port is 514.
This parameter is not listed by default.
Defines whether to use double quotes (“)

in syslog messages to delimit the field
ALWAYS_EXCEPT_N values. The default setting
ULL “ALWAYS_EXCEPT_NULL” uses double
SYSLOG_USE_DELIMITER
NEVER quotes only for non-empty fields. “NEVER”
ALWAYS does not use delimiters. “ALWAYS” uses
double quotes as delimiters for all empty
and non-empty field values.
4. Save the file and restart the Log Server.
What’s Next?
 If you want to use filter the data sent to the syslog server, continue by Exporting Log
Filters for Syslog Sending.
 If you do not want to use filters, continue by Creating a Rule Allowing Traffic to the
Syslog Server (page 285).
Exporting Log Filters for Syslog Sending

You can use filters to select the data sent from the Log Server to the syslog server. First create
the filter(s) as instructed in Filtering Data (page 159). You can then export and apply the filters
to firewall logs and IPS logs separately.
 To export log filters for syslog sending

2. Expand the Other Elements tree.
3. Browse to FiltersAll Filters or FiltersBy Filter Tag in the left panel.
4. Right-click the filter you want to export and select ToolsSave for Command Line Tools
from the menu. The Save Filter dialog opens.
5. Select Local Workstation and click the Browse button to select where the filter is
exported. The Export Data dialog opens.
• To use the filter for filtering firewall logs, select
<installation directory>/data/syslog/Firewall as the directory.
• To use the filter for filtering IPS logs, select
<installation directory>/data/syslog/IPS as the directory.
Note – If you cannot export the filter directly to these directories, export the filter (.flp file)
to another location and then copy the filter manually to the <installation directory>/
data/syslog/Firewall or <installation directory>/data/syslog/IPS directory.

6. Give the export file a name and click OK to export the filter.
What’s Next?
 Continue by Configuring Syslog Filter Settings.
Configuring Syslog Filter Settings

Once you have exported the filter(s) for filtering the log data sent to the syslog server, you can
define how the log data is matched with the filter(s). Add the filter settings to the
LogServerConfiguration.txt file by setting values for the SYSLOG_FILTER_TYPE= and
SYSLOG_FILTER_MATCH= parameters. Editing the file is explained in Defining General Syslog
Settings (page 282). The parameters and their values are explained in Table 23.2.
Table 23.3 shows an example of filter settings.
Table 23.3 Example Filter Setting Combinations
SYSLOG_FILTER_TYPE= SYSLOG_FILTER_MATCH= Effect

The logs matching all filters are
KEEP ALL
sent to the syslog server.
The logs matching at least one of

KEEP ONE the filters are sent to the syslog
server.
The logs matching none of the

KEEP NONE
filters are sent to the syslog server.
Note – If you do not use filters for the data to be sent, remove the SYSLOG_FILTER_TYPE=
and SYSLOG_FILTER_MATCH= parameters from the <installation directory>/data/
LogServerConfiguration.txt file.
What’s Next?
 Continue by Creating a Rule Allowing Traffic to the Syslog Server.
Creating a Rule Allowing Traffic to the Syslog Server

If the syslog server and the Log Server are located on different networks separated by a firewall,
you need to modify your policy to allow the traffic through the firewall. This may also require
defining an appropriate NAT rule.
 To create a rule allowing traffic to the syslog server

1. Select ConfigurationConfigurationFirewall or ConfigurationConfigurationIPS.
The Firewall Configuration view or IPS Configuration view opens.
2. Select Firewall Policies (or IPS Policies), right-click the policy and select Edit Firewall
Policy.
Exporting Log Data to Syslog 285

3. Add an IPv4 Access rule with the following values:
• Source: your Log Server
• Destination: the syslog server
• Service: Syslog (UDP) or Syslog (TCP) depending on protocol used.
• Action: Allow
• Logging: In most cases, we recommend setting the logging to None, since logging syslog
connections can create a loop (a log entry is sent to the syslog server, creating a log entry
that is sent to the syslog server, creating a new log entry, and so on). If you want to log
the syslog connections, make sure they are filtered out from syslog sending as explained
in Configuring Syslog Filter Settings (page 285). Make sure the filter accounts for error
conditions, for example, the ICMP “Destination unreachable” messages that are
generated if the syslog destination server goes down.

C HAPT ER 24
SECONDARY SMC SERVER

CONFIGURATION
You can install several secondary Management Servers and Log Servers to provide a standby
system for the StoneGate Management Center (SMC).
About Secondary SMC Servers (page 288)

Installing a Secondary Management Server (page 288)
Installing a Secondary Log Server (page 293)
Changing the Active Management Server (page 297)
Disabling and Enabling Automatic Database Replication (page 298)
Synchronizing Management Databases Manually (page 298)
Restoring a Backup Taken from a Different Management Server (page 299)
287
About Secondary SMC Servers
Prerequisites: Management Server high availability is a separately licensed feature
Although the firewall and IPS engines always work independently without the SMC according to
their installed configuration, configuration changes and system monitoring are not possible
without a Management Server and a Log Server. The Management Server in particular is a
critical component, since it is the only place where the full configuration information is stored.
Secondary Management Servers and Log Servers can be installed as backups that can be
activated if the active components fail. The high-availability (HA) solution includes automatic
replication of the configuration data stored on the Management Server. This way, manual
intervention is minimized, and the system can be fully managed and monitored without going
through a manual re-installation and backup restoration process.
What’s Next?
 Installing a Secondary Management Server (page 288)
 Installing a Secondary Log Server (page 293)
Related Tasks
 Changing the Active Management Server (page 297)
 Disabling and Enabling Automatic Database Replication (page 298)
 Synchronizing Management Databases Manually (page 298)
Installing a Secondary Management Server

Prerequisites: Your organization must have purchased a license that allows activating this feature
To use a secondary Management Server, you must have a special Management Server license
that includes the high availability features. The license is a combined license for all
Management Servers and it must list the IP addresses of all Management Servers.
Up to five secondary Management Servers can automatically replicate the configuration data on
the primary Management Server. If the primary Management Server becomes unusable, you can
manually activate a secondary Management Server, which allows you to work normally.
Note – The secondary Management Servers are meant for backup and disaster recovery
purposes. Only one Management Server at a time can be used for configuring and
managing the system.
1. Create the element as explained in Defining a Secondary Management Server Element
(page 289).
2. License the servers as explained in Installing a License for a Secondary Management
Server (page 290).
3. Allow communications to the new server through firewalls as necessary as explained in
Creating Access Rules for a Secondary Management Server (page 291).
4. Install the software on the target server as explained in Installing Secondary Management
Server Software (page 291).
288 Chapter 24 Secondary SMC Server Configuration

Defining a Secondary Management Server Element
Any new Management Server elements you add to an existing Management Center are
considered to be secondary Management Servers. You can set up several secondary
Management Servers.
 To define a secondary Management Server element

from the menu. The Firewall Configuration or IPS Configuration view opens.
2. Browse to Network ElementsServers.
3. Right-click Servers and select NewManagement Server. The Management Server
4. Type in the Name and IP Address.

5. If NAT is used to translate addresses in communications between this server and other
StoneGate components, define the Location and Contact Address. See Defining Locations
(page 61) and Defining Contact IP Addresses (page 62) for more information.
6. Select the Alert Server to which any alerts generated by this Management Server are sent.
7. If you use a RADIUS server for authenticating administrators, define the method that
StoneGate uses to contact the RADIUS server from the RADIUS Method list.
8. (Optional) If you want to send generated reports as e-mail directly from the Management
Server, type the address of the mail server in the SMTP Server field and an address that is
attached to these e-mails in the Sender Address field.
Installing a Secondary Management Server 289

9. (Optional) If you do not want the changes in configurations to be automatically replicated to
the secondary Management Server from the primary Management Server, select the
Disable Database Replication option.
• Automatic replication transfers the changes periodically, greatly reducing the likelihood of
configuration changes being lost when the primary Management Server is lost. The option
to disable automatic replication is meant for temporary use.
• You can also manually synchronize the databases (see Synchronizing Management
Databases Manually (page 298)).
10.(Optional) If you want to enable Web Start users to access the Web Start files through a
Web browser at the address that the secondary Management Server uses, switch to the
Web Start tab and configure the settings (see Activating Web Start on Management Server
(page 271)).
11.Click OK.
What’s Next?
 Continue by Installing a License for a Secondary Management Server.
Related Tasks
 Adding Custom Commands to Element Menus (page 53)
 Writing Announcements to Web Portal Users (page 266)
Installing a License for a Secondary Management Server

Using a secondary Management Server requires a special combined license that lists the IP
addresses of all Management Servers within the same SMC. After receiving the proof-of-license
(POL) code from Stonesoft, generate the License file at the Stonesoft Website at https://
my.stonesoft.com/managelicense.do. For more information on generating licenses, see
Generating New Licenses (page 826).
 To install a license for a secondary Management Server

1. Select FileSystem ToolsInstall Licenses from the menu. The Install License File(s)
dialog opens.
2. Browse to the License file on your local workstation and click Install.
4. Browse to LicensesUnlicensed ComponentsServers and make sure the secondary
Management Server is not listed there.
• If the server is listed, check that the IP address information is the same in the license
and the secondary Management Server element.
What’s Next?
 Continue by Creating Access Rules for a Secondary Management Server.

Creating Access Rules for a Secondary Management Server
The Default template rules allow connections between a firewall and all Management and Log
Servers the firewall connects to. However, if other components need to connect through a
firewall to the secondary Management Server, you must add rules that allow this traffic in the
firewall’s policy, along with possible NAT rules when necessary.
The rules are normal IPv4 Access rules that allow the system communications needed. See
Default Communication Ports (page 933) for information on ports and default Service elements
for StoneGate system communications. For more information on adding Access rules, see
Editing Access Rules (page 518).
What’s Next?
 After adding the Access rules, continue by Installing Secondary Management Server
Software.
Installing Secondary Management Server Software

Secondary Management Servers are installed using the normal Management Center installation
wizard. To install the software, you need the Management Center installation files, see
Obtaining the SMC Installation Files (page 835).
 To install secondary Management Server software

1. If you are installing from a .zip file, unzip the file and run setup.exe on Windows or
setup.sh on Linux. Alternatively, insert the StoneGate installation CD-ROM and run the
setup executable from the CD-ROM:
• On Windows, run \StoneGate_SW_Installer\Windows\setup.exe
• On Linux, run /StoneGate_SW_Installer/Linux/setup.sh
Note – If the CD-ROM is not automatically mounted in Linux, mount the CD-ROM with
“mount /dev/cdrom /mnt/cdrom”.
2. Proceed according to instructions in the Installation Wizard until you are prompted to select
which components you want to install.
• If you also want to install a Log Server and a local Management Client on this computer,
leave the Typical selected and click Next.
• Otherwise, select Custom, select the components you want to install and click Next.
3. Select the IP address of the Management Server from the list or type it in.
• This must be the IP address defined for the corresponding Management Server element.
4. Type in the IP address of the Log Server for sending alerts.
5. Select Install as a Secondary Management Server for High Availability.
6. Click Next and follow the instructions to start the installation. A login prompt for
Replication opens.
7. Log in using an unrestricted administrator account. The Management Server Selection
dialog opens.
Installing a Secondary Management Server 291

Illustration 24.2 Management Server Selection
8. Select the correct Management Server from the list and click OK. The databases are
synchronized.
Note – If the synchronization fails for some reason (such as a network connection
problem), the secondary Management Server is not installed properly. Run the Installation
Wizard again when connectivity is restored. You can also follow the procedure for Restoring
a Backup Taken from a Different Management Server (page 299) to configure the server
as a valid backup server.
What’s Next?
 The Secondary Management Server configuration is complete. You can view replication
information in the Info panel when you select the Management Server.

Installing a Secondary Log Server
Prerequisites: None
A secondary Log Server can be used to allow continued monitoring of the system if a Log Server
fails: alert escalation proceeds normally, new logs can be browsed, and the engine status and
statistics can be examined. However, the log data is not automatically replicated between the
primary and secondary Log Servers, so some log data is always unavailable during outages.
Any Log Server can be used both as a normal Log Server for some components and a secondary
Log Server for one or more other Log Servers. However, you must consider the load of the Log
Servers before you set up an actively used Log Server as a secondary Log Server, to avoid
overloading when a fail-over occurs.
You can set up secondary Log Servers with normal Log Server licenses. A separate license for
each Log Server is required, even if used only as a backup.
The following overview can be used to install a new Log Server that works as a backup for some
other Log Server. However, you can alternatively define any existing Log Servers to be used as
backups for some other Log Server just by completing Step 3 and refreshing the policies of
engines that send their data to the primary Log Server.
1. Add an element for the secondary Log Server as explained in Creating a Secondary Log
Server Element (page 293).
2. License the secondary Log Server as explained in Installing a License for a Secondary Log
Server (page 295).
3. Define the Log Server as a Secondary Log Server for some other Log Server as explained
in Setting a Log Server as a Secondary Log Server (page 295).
4. Make sure the communications between system components and the secondary Log
Server are allowed as explained in Creating Access Rules for a Secondary Log Server
(page 296).
5. Install the Log Server as explained in Installing Secondary Log Server Software
(page 296).
Creating a Secondary Log Server Element

You can set up several secondary Log Servers for each primary Log Server.
 To create a secondary Log Server element

3. Right-click Servers and select NewLog Server. The Log Server Properties dialog opens.
Installing a Secondary Log Server 293

Illustration 24.3 Log Server Properties
4. Specify the Name and IP Address of the server.

5. If NAT is used to translate addresses in communications between this server and other
StoneGate components, define the Location and Contact Address. See Defining Locations
(page 61) and Defining Contact IP Addresses (page 62) for more information.
6. (Optional) Define the StoneGate Log Server’s TCP Port Number. We recommend that you
always use the default port 3020 if possible.
Note – If you want to use a non-standard port for the Log Server, you must manually add
rules to allow communications using the new port from the firewall engines to the Log
Server even when using the Default template.
7. (Optional) If you want the Log Server to send its own alerts and forward all alerts it receives
to a different Log Server, select Forward all Alerts to and then select the correct Log
Server.
8. (Optional) Select Exclude from Log Browsing, Statistics and Reporting if you do not want
the Log Server to gather statistical information for monitoring and reports.
What’s Next?
 Continue by Installing a License for a Secondary Log Server (page 295).
Related Tasks

Installing a License for a Secondary Log Server
Each secondary Log Server requires a separate license, even if it is only used as a backup for
some other Log Server. After receiving the proof-of-license (POL) code from Stonesoft, generate
the License file at the Stonesoft Website at https://my.stonesoft.com/managelicense.do. For
more information on generating licenses, see Generating New Licenses (page 826).
 To install a license for a secondary Log Server

dialog opens.
2. Browse to the License file on your local workstation and click Install.
4. Browse to LicensesUnlicensed ComponentsServers and make sure the secondary
Log Server is not listed there.
• If the server is listed, check that the IP address information is the same in the license
and the secondary Log Server element.
What’s Next?
 Continue by Setting a Log Server as a Secondary Log Server.
Setting a Log Server as a Secondary Log Server

You can select several secondary Log Servers for a Log Server in the Log Server’s properties.
The same Log Server can be a primary Log Server for some components and a secondary Log
Server for other components at the same time. You can also set Log Servers to be secondary
Log Servers for each other so that whenever one fails, the other Log Server is used. See
Selecting Secondary Log Servers (page 277).
If Domain elements have been configured, a Log Server and its secondary Log Server(s) must
belong to the same Domain.
Caution – If the log volumes are very high, make sure that the secondary Log Server can
handle the traffic load in fail-over situations.
What’s Next?
 Continue by Creating Access Rules for a Secondary Log Server (page 296).
Installing a Secondary Log Server 295

Creating Access Rules for a Secondary Log Server
The Default template rules allow connections between a firewall and all Management and Log
Servers the firewall connects to. However, if other components need to connect through a
firewall to the secondary Log Server, you must add rules that allow this traffic in the firewall’s
policy, along with possible NAT rules when necessary.
The rules are normal IPv4 Access rules that allow the system communications needed. See
Default Communication Ports (page 933) for information on ports and default Service elements
for StoneGate system communications. For more information on adding Access rules, see
Editing Access Rules (page 518).
What’s Next?
 After adding the Access rules, continue the installation of a new secondary Log Server
in Installing Secondary Log Server Software (page 296).
Installing Secondary Log Server Software

Secondary Log Servers are installed using the normal Management Center installation wizard in
exactly the same way as any other Log Servers. This section presents an outline of the
installation. If you need more help, see the Management Center Installation Guide for more
complete installation instructions.
To install the software, you need the Management Center installation files, see Obtaining the
SMC Installation Files (page 835).
 To install secondary Log Server software

1. If you are installing from a .zip file, unzip the file and run setup.exe on Windows or
setup.sh on Linux. Alternatively, insert the StoneGate installation CD-ROM and run the
setup executable from the CD-ROM:
• On Windows, run \StoneGate_SW_Installer\Windows\setup.exe
• On Linux, run /StoneGate_SW_Installer/Linux/setup.sh
Note – If the CD-ROM is not automatically mounted in Linux, mount the CD-ROM with
“mount /dev/cdrom /mnt/cdrom”.
2. Proceed according to instructions in the Installation Wizard until you are prompted to select
which components you want to install.
3. Select Custom, and select Log Server.
4. Finish the installation according to instructions in the Installation Wizard. You must certify
the Log Server either during or after the installation before the Log Server can connect to
the Management Server.

The secondary Log Server is now installed and should show green monitoring status in the
System Status view.
What’s Next?
 The logs are not automatically copied between the Log Servers by default, since the
volumes can be quite large. You can set up separate scheduled or manually run Tasks if
you want to copy logs between the servers. You can use log filters to reduce the
volumes without losing the most important logs. See Getting Started with Log Data
Management (page 800).
 Otherwise, the secondary Log Server installation is complete.
Changing the Active Management Server

Prerequisites: Installing a Secondary Management Server
Only one Management Server at a time can be the active Management Server. The standby
Management Servers cannot be used for day-to-day configuration and monitoring of the system.
The standby Management Servers replicate the changes done on the active Management
Server once an hour (or whenever you command them to do so, see Synchronizing Management
Databases Manually (page 298)) so that they have the up-to-date configuration information
available.
When you need to switch to a different Management Server, you must manually change the
active Management Server. The engines continue to operate normally even when no
Management Server is reachable, so there is no interruption to any network services.
This feature is primarily meant for disaster recovery. We do not recommend switching the active
Management Server unnecessarily.
 To change the active Management Server

1. Proceed according to the current status of the primary Management Server:
• If the primary Management Server is operational, launch the command line on the
primary Management Server.
• If the primary Management Server is out of order, launch the command line on the
secondary Management Server.
2. Switch to the folder <installation directory>/bin.
• By default, the installation directory is /Stonesoft/StoneGate.
3. Proceed according to the current status of the primary Management Server:
• If the primary Management Server is operational, run:
sgHA[.bat|.sh] -host <address of the secondary Management Server> -login
<administrator user name> -password <password> -set-active. The operation
contacts the secondary server, synchronizes the database, and changes the active/
standby status of both servers.
• If the primary Management Server is out of order, run:
sgHA[.bat|.sh] -login <administrator user name> -password <password> -
force-active. The operation makes this server the active Management Server.
Changing the Active Management Server 297

4. Run the command sgStartMgtSrv[.bat|.sh] to start the Management Server.
Administrators can now log in to this Management Server.
Caution – If the primary Management Server is down when you make the switch, but may
possibly recover, disconnect the previous primary Management Server from the network.
This avoids having two active Management Servers online at the same time. Set the
previous primary Management Server as a secondary Management Server and synchronize
the databases to return to normal operation.
Disabling and Enabling Automatic Database Replication

By default, changes in the configuration information stored on the currently active Management
Server are automatically copied to all standby Management Servers. If you have a specific
reason to stop this replication, you can do so. You can also synchronize the information
manually as explained in Synchronizing Management Databases Manually (page 298).
 To disable or enable automatic database replication

1. Double-click a secondary Management Server. The Management Server properties dialog
opens.
2. Select Disable Database Replication to disable automatic replication or deselect the
option to re-enable automatic replication.
Tip – You can view the status of currently running and previously executed Replication tasks under
the Tasks branch of the Administration Configuration view. You can also view replication
information for the selected Management Server on the General tab in the Info panel.
Synchronizing Management Databases Manually

You can synchronize the configuration information manually between all Management Servers
through the Management Client. This synchronization is always done from the currently active
Management Server to the standby Management Server(s).
 To synchronize the databases manually

1. Connect to the active Management Server using the Management Client.
2. Open the properties of each standby Management Server and make sure that Disable
Database Replication is not selected unless you want to exclude the servers from
synchronization.
3. Select FileSystem ToolsManagement HASynchronize from the menu.
4. Click OK to confirm the synchronization. All existing configurations on the standby server(s)
are overwritten.
Tip – If there is no network connectivity between the servers, replication of a single secondary
Management Server can alternatively be done by Restoring a Backup Taken from a Different
Management Server (page 299). This requires a current backup of the primary Management
Server.

Restoring a Backup Taken from a Different Management
Server
Prerequisites: The Management Server on which you are restoring must exist as an element in the backup
If normal (automatic or manual) synchronization between redundant Management Servers is not

possible, the configurations can still be updated on a secondary server by restoring a backup.
Typically, the primary Management Server is the only server that is backed up, since it always
contains the latest changes. You can restore this backup on any of the secondary servers, but
this requires a special procedure. The normal backup restoration always connects the local
installation to the element of the installation that created the backup (to support hardware
replacement). If this is what you want to happen, perform a normal backup restoration. To
connect the secondary server to its existing element, follow the special procedure below.
Caution – Restoring a backup erases all configuration data stored on the Management
Server on which you perform the operation.
 To restore a backup taken from a different Management Server

1. Copy the backup file to the <installation directory>/backups/ folder on the Management
Server on which you want to restore the backup.
2. Browse to <installation directory>/bin/.
3. Run the script sgStopMgtSrv[.bat|.sh]to shut down the Management Server.
4. Run the script sgReplicate[.bat|.sh] -backup <backup file path and filename> -
standby-server <name of the Management Server element that corresponds to the
physical server you are working on>.
• Despite the name of the option, the current primary/standby status of this server has no
relevance to the operation. You must only make sure it
• For further options, run the sgReplicate script with the option --help.
5. Run the script sgStartMgtSrv[.bat|.sh] to start the Management Server.
• The server starts as a secondary server in this case. See Changing the Active
Management Server (page 297) to switch the role to primary.
Related Tasks
 Restoring Backups (page 796).
Restoring a Backup Taken from a Different Management Server 299

C HAPT ER 25
RECONFIGURING THE MANAGEMENT

CENTER
This section includes tasks related to configuring additional settings for Management
Servers, as well as changing your Management Center hardware platform or the IP addresses
used in system communications.
Modifying a Management Server Element (page 302)

Changing the Management Database Password (page 303)
Changing the Management Platform (page 304)
Changing IP Addressing (page 304)
If Configuration Changes Prevent Managing the Engines (page 307)
301
Modifying a Management Server Element
Prerequisites: None
The Management Server element is automatically created during the installation. Check and
modify the settings as necessary. You can rename the Management Server element freely, but
you cannot delete the Management Server that the SMC is connected to. To define secondary
Management Servers for high availability, see Installing a Secondary Management Server
(page 288).
To change the management database password that was automatically created during the
installation, see Changing the Management Database Password (page 303).
 To modify a Management Server element

2. Select Servers.
3. Double-click your Management Server element. The Management Server Properties dialog
opens.
4. (Optional) Change the Name of the Management Server.

5. (Optional) Add a Location and a Contact Address if there is a NAT device between a
firewall/Sensor/Analyzer and the Management Server, so that they cannot connect directly
to the IP address defined for the interface. See Defining Contact IP Addresses (page 62) for
more information.
6. Select the Alert Server to which any alerts generated by this Management Server are sent.
7. If you use a RADIUS server for authenticating administrators, define the RADIUS Method
that StoneGate uses to contact the RADIUS server.
8. If you want to send generated reports as e-mail directly from the Management Server, type
the address of the mail server in the SMTP Server field and an address that is shown as
the e-mail sender in the Sender Address field. Remember to allow these connections in the
firewall policy if necessary. See E-Mailing Reports (page 157) for more information.
302 Chapter 25 Reconfiguring the Management Center

9. (Optional) If this Management Server is used as a secondary Management Server and you
do not want the changes in configurations to be automatically replicated to it from the
primary Management Server, select the Disable Database Replication option.
• Automatic replication transfers the changes periodically, greatly reducing the likelihood of
any configuration changes being lost when the primary Management Server is lost. The
option to disable automatic replication is meant for temporary use.
• You can also manually synchronize the databases (Synchronizing Management Databases
Manually (page 298)).
10.(Optional) If you want to enable Web Start users to access the Web Start files through a
Web browser at the address that the Management Server uses, switch to the Web Start
tab and proceed as described in Activating Web Start on Management Server (page 271).
11.(Optional) If you want to use a Tools Profile with the new Management Server, click Select
for Tools Profile.
12.Click OK to apply the changes.
Changing the Management Database Password

Prerequisites: None
The Management Server contains a database for storing the configuration information. The
password for the database is automatically created during the installation of the Management
System. In some rare cases, you may need this password to complete an operation, in which
case you can simply change it.
 To change the database password

1. Select FileSystem ToolsChange Database Password in the menu. The Change
Database Password dialog opens.
Illustration 25.2 Change Database Password
2. Enter the password in the New Password and the Confirm New Password fields.
3. Click OK to confirm the change.
Changing the Management Database Password 303

Changing the Management Platform
Prerequisites: None
If you want to change the hardware or the operating system that the Management Server, Log
Server, or Web Portal Server components run on, you can follow the procedure below.
 To change the Management Platform

1. Take backups of your Management Server(s) and your Log Server(s) as instructed in
Creating Backups (page 795).
• The Web Portal Server has no information to back up.
2. Install new Management Server(s) and Log Server(s) on the new platform(s). See the
StoneGate Management Center Installation Guide for instructions.
3. Restore the Management Server and Log Server backups from the old environment to the
new installation. See Restoring Backups (page 796).
For any Web Portal Server, install the new Web Portal Server as a fresh installation as instructed
in the StoneGate Management Center Installation Guide.
Changing IP Addressing
Prerequisites: None
The following instructions explain how you can change IP addresses without losing management
connectivity. When you change IP addressing, other connections between the different
components may be temporarily lost. You must make sure that the connections return to normal
after the IP address changes.
What’s Next?
 If you want to change IP addresses and the Management Server and Log Server are on
the same machine, proceed to Changing IP Addresses of Combined Management/Log
Servers (page 306).
 Otherwise, proceed to Changing the Management Server’s IP Address or Changing the
Log Server’s IP Address (page 305) depending on which component’s IP address you
want to change.
Changing the Management Server’s IP Address

This section explains how to change the Management Server’s IP address if the Management
Server and the Log Server are on different machines. If your Management Server and Log Server
are on the same machine, see Changing IP Addresses of Combined Management/Log Servers
(page 306).
Before changing the Management Server’s IP address, we recommend making a backup of the
Management Server and the Log Server as instructed in Creating Backups (page 795).
Note – If your firewall policies do not use the Default template, check that they allow all
the necessary connections.

 To change the Management Server’s IP address
1. Request an IP address change for the Management Server license (in Stonesoft’s online
License Center at www.stonesoft.com/license/).
2. (For StoneGate firewalls) Add IPv4 Access rules (and possibly NAT rules) that allow policy
upload connections from the new Management Server IP address to the firewall (see
Editing Access Rules (page 518)).
• The services needed for the communications between the different StoneGate
components are explained in Default Communication Ports (page 933).
3. (For StoneGate firewalls) Refresh the firewall policies.
4. Stop the Management Server and all Log Server services.
5. On the Management Server, run the command
sgChangeMgtIPOnMgtSrv <new Management Server IP address>.
6. On all Log Servers, run the command
sgChangeMgtIPOnLogSrv <new Management Server IP address>.
7. Start the Management Server and all Log Server services and log in using the Management
Client.
8. Import the new Management Server license when prompted.
9. (For StoneGate firewalls) Remove the rules that you created in Step 2. After running the IP
change scripts, the Alias elements in the inherited rules point to the right IP addresses.
10.Refresh the policies of all engine components.
Changing the Log Server’s IP Address

When you change the Log Server’s IP address, the traffic between the Log Server and the
engines is interrupted and the logs are spooled on the engines. Changing the IP address may
also mean that the transfer of engine status and statistics information is temporarily
interrupted.
Before changing the Log Server’s IP address, we recommend making a backup of the
Management Server and the Log Server as instructed in Creating Backups (page 795).
 To change the Log Server’s IP address

1. Request a license binding change for the Log Server if the license is bound to the Log
Server’s IP address (in Stonesoft’s online License Center at www.stonesoft.com/license/)
and import the new license.
2. Edit the <installation directory>/data/LogServerConfiguration.txt file on the
Log Server and update the Log Server IP address (see Changing Log Server Configuration
Parameters (page 279)).
3. In the Management Client, open the Log Server properties and update the Log Server IP
address.
4. Shut down and restart the Log Server service.
5. Refresh the policies of all engine components that send data to the Log Server.
Changing IP Addressing 305

Changing IP Addresses of Combined Management/Log Servers
This section explains how to change the Management Server’s IP address if the Management
Server and the Log Server are on the same machine. If your Management Server and Log Server
are on separate machines, see Changing the Management Server’s IP Address (page 304) and
Changing the Log Server’s IP Address.
When you change the Log Server’s IP address, the traffic between the Log Server and the
engines is interrupted and the logs are spooled on the engines. Changing the IP address may
also mean that the transfer of engine status and statistics information is temporarily
interrupted.
Before changing the IP addresses, we recommend making a backup of the Management Server
and the Log Server as instructed in Creating Backups (page 795).
Note – If your firewall policies do not use the Default template, check that they allow all
the necessary connections.
 To change the IP Address of a combined Management Server and Log Server

1. Request a licence binding change to the new IP address for the Management Server
license, and also the Log Server if the license is bound to an IP address (in Stonesoft’s
online License Center at www.stonesoft.com/license/).
2. (For StoneGate firewalls) Add IPv4 Access rules (and possibly NAT rules) that allow policy
upload connections from the new IP addresses to the firewall (see Editing Access Rules
(page 518)).
• The services needed for the communications between the different StoneGate
components are explained in Default Communication Ports (page 933).
3. (For StoneGate firewalls) Refresh the firewall policies.
4. Stop the Management Server and Log Server services.
5. Change the IP address of the host server in the operating system.
6. Run the sgChangeMgtIPOnMgtSrv script on the Management Server (see Command Line
Tools (page 917)).
7. Run the sgChangeMgtIPOnLogSrv script on the Log Server (see Command Line Tools
(page 917)).
8. Edit the <installation directory>/data/LogServerConfiguration.txt file on the
Log Server and update the Log Server IP address (see Changing Log Server Configuration
Parameters (page 279)).
9. Start the Management Server service and log in using the Management Client.
10.Import the new licenses when prompted.
11.Open the Log Server properties and update the IP address.
12.Start the Log Server service.
13.(For StoneGate firewalls) Remove the rules that you created in Step 2. After running the IP
change scripts, the Alias elements in the inherited rules point to the right IP addresses.
14.Refresh the policies of all engine components.

If Configuration Changes Prevent Managing the Engines
Prerequisites: None
If an engine cannot connect to the Management Server because of changes in the system
configuration, you can restore the contact by generating a new initial configuration for the engine
(through the engine’s right-click menu) and then run the sg-reconfigure command on the
engine command line. If you also suspect that the engine’s configuration is out of date, also
select the option to return the engine to the initial configuration state. See instructions in
Reconfiguring Basic Engine Settings (page 203).
Caution – Returning the engine to the initial configuration state clears the engine’s
configuration. Only management communications are allowed and no traffic is allowed to
pass through the firewall.
If Configuration Changes Prevent Managing the Engines 307

E NGINE E LEMENT
C ONFIGURATION
In this section:
Creating and Modifying Engine Elements - 311
Network Interface Configuration - 341
Connecting Engines to the StoneGate Management Center - 391
Configuring the Engine Tester - 397
Engine Permissions - 407
Alias Translations for Engines - 411
Advanced Engine Settings - 415
Setting up SNMP for Engines - 431
309
310
C HAPT ER 26
CREATING AND MODIFYING ENGINE

ELEMENTS
Engine elements contain the configuration information that is directly related to the firewalls,
sensors, and analyzers, such as the interface definitions, cluster mode selection, tester
settings, and other such engine-specific options. This section explains how to create and
modify these elements and lists the tasks you can do in the engine element properties (in the
“Editing...” sections below).
Getting Started with Engine Elements (page 312)

Creating New Engine Elements (page 313)
Modifying Existing Engine Elements (page 323)
Editing Single Firewall Properties (page 333)
Editing Firewall Cluster Properties (page 334)
Editing SOHO Firewall Properties (page 335)
Editing Analyzer Properties (page 336)
Editing Single Sensor Properties (page 337)
Editing Sensor Cluster Properties (page 338)
Editing Combined Sensor-Analyzer Properties (page 339)
About Engine Time Synchronization (page 340)
311
Getting Started with Engine Elements
Prerequisites: None
What Engine Elements Do

Engine elements are the center point of all configuration and management tasks related to your
firewalls, sensors, and analyzers. They contain settings that cannot be reused in the
configuration of other components, such as the network interface configuration. The engine
elements also determine which of the reusable elements the configuration of a particular
component includes (for example, the Log Server to which the component sends its log data).
All engines are centrally configured and controlled through the Management Server.
If you are configuring new engine elements for the first time, we recommend that you follow the
instructions in the Firewall/VPN Installation Guide or the IPS Installation Guide instead of the
instructions here. For background information on how the system works, see the Firewall/VPN
Reference Guide or the IPS Reference Guide.
Note – The engines are always configured through the StoneGate Management Center
(SMC). If you have no SMC installed, see the Management Center Installation Guide.
The overview below does not cover the StoneGate SSL VPN product. See Creating a New SSL
VPN Gateway Element (page 322). For information on configuring StoneGate SSL VPN, see the
SSL VPN Administrator’s Guide.
1. Install a license for the engine. See Getting Started with Licenses (page 824).
2. Create a new engine element and define the basic properties. See Creating New Engine
3. Configure the engine’s interfaces. See Getting Started with Interface Configuration
(page 342).
4. (Not applicable to SOHO Firewalls) Configure the routing. See Getting Started with Routing
(page 440).
5. Generate the initial configuration for the engine and use it to establish a connection
between the engine and the Management Server. See Connecting Engines to the StoneGate
Management Center (page 391).
6. (Not applicable to SOHO Firewalls) Install a policy on the engine. See Installing Policies
(page 501).
Related Tasks
 Editing Single Firewall Properties (page 333)
 Editing Firewall Cluster Properties (page 334)
 Editing SOHO Firewall Properties (page 335)
 Editing Analyzer Properties (page 336)
 Editing Single Sensor Properties (page 337)
 Editing Sensor Cluster Properties (page 338)
 Editing Combined Sensor-Analyzer Properties (page 339)
312 Chapter 26 Creating and Modifying Engine Elements

Creating New Engine Elements
Prerequisites: None
You can create a new engine element either by defining a blank new element or by duplicating
the properties of an existing element. Before you define a new engine element, make sure you
have a license for it. The element can be configured without a license, but you must have a
license to make the engine operational.
You can either create a new element as instructed in the sections listed below or you can copy
and modify an existing element as explained in Duplicating an Existing Engine Element
(page 323).
What’s Next?
 Creating a New Single Firewall Element (page 313)
 Creating a New Firewall Cluster Element (page 314)
 Creating One New SOHO Firewall Element (page 315)
 Creating Multiple New SOHO Firewall Elements (page 316)
 Creating a New Analyzer Element (page 318)
 Creating a New Single Sensor Element (page 319)
 Creating a New Sensor Cluster Element (page 320)
 Creating a New Combined Sensor-Analyzer Element (page 321)
 Creating a New SSL VPN Gateway Element (page 322)
Creating a New Single Firewall Element

Single Firewall elements represent firewalls that consist of one physical device. They can also
be converted to Firewall Cluster elements.
 To create a new Single Firewall element

1. Select ConfigurationConfigurationFirewall from the menu. The Firewall Configuration
view opens.
2. Right-click Firewalls in the Firewall tree and select NewSingle Firewall from the menu.
The Single Firewall Properties dialog opens.
Illustration 26.1 Single Firewall Properties
3. Give the element a unique Name.

4. Select the Log Server that is used for sending the logs this engine creates.
Creating New Engine Elements 313

5. Select the correct Location for this engine if there is a NAT device between system
components affecting this firewall’s communications. See Defining Locations (page 61) for
more information.
What’s Next?
 Continue the configuration in Firewall Interface Configuration (page 343).
Creating a New Firewall Cluster Element

Firewall Cluster elements consist of 2 to 16 physical firewall devices that work together as a
single entity.
 To create a new Firewall Cluster element

view opens.
2. Right-click Firewalls in the Firewall tree and select NewFirewall Cluster from the menu.
The Firewall Cluster Properties dialog opens.
Illustration 26.2 Firewall Cluster Properties

4. Select the Log Server that is used for sending the logs this firewall cluster creates.
5. Select the correct Location for this firewall cluster if there is a NAT device between system
more information.
What’s Next?
 Continue the configuration in Firewall Interface Configuration (page 343).

Creating One New SOHO Firewall Element
SOHO firewalls are a specific type of StoneGate appliances. They have a wireless capability but
an otherwise reduced feature set compared to other StoneGate Firewall/VPN engines.
The instructions below are for creating just one SOHO firewall element. You can alternatively use
a wizard to create configurations for several SOHO firewalls at a time. See Creating Multiple New
SOHO Firewall Elements (page 316).
 To create a new SOHO Firewall element

view opens.
2. Browse to Network ElementsSOHO Firewalls in the Firewall tree.
3. Right-click SOHO Firewalls and select NewSOHO Firewall from the menu. The SOHO
Firewall properties dialog opens.
Illustration 26.3 SOHO Firewall Properties

more information.
7. Enter the IP address or hostname of an NTP server in at least the Primary Time Server
field.
• Stonesoft maintains NTP servers that are freely available for all SOHO Firewall users at
the following addresses: soho-ntp-1.stonesoft.net: 192.89.38.174 (default Primary Time
Server) and soho-ntp-2.stonesoft.net: 84.34.144.104 (default Secondary Time Server).
• If you use a private NTP server, make sure it is reachable from the SOHO firewall. If the
time server has a private IP address, you must set up NAT and enter the external IP

address in the SOHO firewall’s configuration so that the SOHO firewall can reach the
server through public networks.
• Use the same NTP server also to synchronize the time of the Management Server and the
Log Server. If the SOHO Firewall, the Management Server, and the Log Server do not have
the same time, there may be problems with monitoring and logging.
Caution – At least one of the NTP servers must be reachable at installation time or the
installation will fail.
What’s Next?
 Continue the configuration in SOHO Firewall Interface Configuration (page 364).
Creating Multiple New SOHO Firewall Elements

SOHO firewalls are a specific type of StoneGate appliances. They have a wireless capability but
an otherwise reduced feature set compared to other StoneGate Firewall/VPN engines.
The instructions below are for creating multiple SOHO firewall elements using a wizard. You can
alternatively create configurations for SOHO firewalls one at a time. See Creating One New
SOHO Firewall Element (page 315). Note that you can also duplicate existing SOHO firewall
elements (see Duplicating an Existing Engine Element (page 323)).
After you complete the wizard, you can change any of the settings through the properties dialog
of the individual elements that are generated.
 To create multiple new SOHO Firewall elements

view opens.
2. Browse to Network ElementsSOHO Firewalls in the Firewall tree.
3. Right-click SOHO Firewalls and select NewMultiple SOHO Firewalls from the menu. The
Create Multiple SOHO Firewalls dialog (wizard) opens.
Illustration 26.4 Create Multiple SOHO Firewalls
4. Enter the Name Prefix. The system adds a number to this to generate unique names for
the individual SOHO Firewalls.
5. Enter the Global Corporate IP Range. This address space is used for generating the local
IP address space for the internal Corporate networks that the SOHO firewalls protect.
6. Enter the number of SOHO Firewall elements you want to create in the No. of SOHO
Firewalls field.

7. Select the DHCP Server settings:
• You can deactivate the internal DHCP server completely by deselecting the DHCP Server
option.
• Otherwise, enter the number of static addresses to be reserved from the beginning of the
IP address range on each firewall in the No. of Static IP Addresses field. The minimum is
one static IP address (for the SOHO firewall itself).
8. Click Generate to create the name and IP address information for the SOHO Firewall
elements (shown in the table in the lower part of the dialog). The table is not editable: if
you want to modify the information, change the values you filled in and regenerate the
table. More detailed modifications are possible after the wizard is finished.
9. Click Next. The General tab opens (the tabs displayed in the wizard correspond to the tabs
in the properties dialog of the individual SOHO Firewalls).
Illustration 26.5 General Properties of Multiple SOHO Firewalls
10.Select a Log Server for storing the firewalls’ logs.

11.Select the correct Location for the firewalls if there is a NAT device between system
components affecting the firewalls’ communications. See Defining Locations (page 61) for
more information.
12.Enter the IP address or hostname of an NTP server in at least the Primary Time Server
field.
• If you use a private NTP server, make sure it is reachable from the SOHO firewalls. If the
time server has a private IP address, you must set up NAT and enter the external IP
address in the SOHO firewalls’ configuration so that the SOHO firewalls can reach the
server through public networks.
• Use the same NTP server also to synchronize the time of the Management Server and the
Log Server. If the SOHO Firewalls, the Management Server, and the Log Server do not
have the same time, there may be problems with monitoring and logging.
Caution – At least one of the NTP servers must be reachable at installation time or the
installation will fail.

What’s Next?
 The interface configuration for multiple SOHO firewalls differs only slightly from creating
a single SOHO Firewall. From this point on, the instructions are combined for both
procedures. Continue in SOHO Firewall Interface Configuration (page 364).
Creating a New Analyzer Element

IPS analyzers do not inspect network data directly, but collect event data from sensors and
perform further inspection and correlation before the event data is passed on to a Log Server.
You must define an Analyzer element before creating the Sensor elements to be able to
complete the configuration of the sensors.
 To create a new Analyzer element

1. Select ConfigurationConfigurationIPS from the menu. The IPS Configuration view
opens.
2. Right-click IPS Engines in the IPS tree and select NewAnalyzer from the menu. The
Analyzer Properties Dialog opens.
Illustration 26.6 Analyzer Properties

5. Select the Log Server for Alerts. This can be the same Log Server that you selected in the
previous step.
6. Select the Backup Analyzer for sensors to use when this analyzer is unavailable.
• If this is the first or the only analyzer in your system, leave the selection to None for now.
You can add this information once you have more Analyzer elements defined.
Note – There is no data synchronization between the analyzers. Even if you define a
backup analyzer, do not take analyzers offline unnecessarily to ensure the best possible
traffic screening results.
components affecting this analyzer’s communications. See Defining Locations (page 61) for
more information.
What’s Next?
 Continue the configuration in Sensor and Analyzer Interface Configuration (page 377).

Creating a New Single Sensor Element
IPS sensors look for harmful patterns in traffic and produce raw data for analyzers. Single
Sensor elements represent sensors that consist of one physical sensor device. They can be
later converted to clusters.
 To create a new Sensor element

opens.
2. Right-click IPS Engines in the IPS tree and select NewSingle Sensor from the menu. The
Single Sensor Properties dialog opens.
Illustration 26.7 Single Sensor Properties

4. Select the Analyzer to which the sensor sends its event data. If you want to define a
backup analyzer, configure it in the properties of the Analyzer element you select here. Only
stand-alone Analyzer elements are accepted (not combined Sensor-Analyzers).
5. Select the Log Server for Recordings to define where to store automatic traffic captures
triggered by your IPS rules.
components affecting this sensor’s communications. See Configuring System
Communications (page 59) for more information.
What’s Next?

Creating a New Sensor Cluster Element
IPS sensors look for harmful patterns in traffic and produce raw data for analyzers. Sensor
Cluster elements combine 2 to 16 physical sensor devices into a single entity.
 To create a new Sensor Cluster element

opens.
2. Right-click IPS Engines in the IPS tree and select NewSensor Cluster from the menu.
The Sensor Cluster Properties dialog opens.
Illustration 26.8 Sensor Cluster Properties

4. Select the Analyzer to which the engines in the sensor cluster send their event data. If you
want to define a backup analyzer, configure it in the properties of the Analyzer element you
select here. Only stand-alone Analyzer elements are accepted (not combined Sensor-
Analyzers).
triggered by your IPS rules.
6. Select the correct Location for the sensor cluster if there is a NAT device between system
components affecting this sensor cluster’s communications. See Configuring System
What’s Next?

Creating a New Combined Sensor-Analyzer Element
Sensor-Analyzers combine the IPS traffic inspection with further analysis and event correlation
in a single device.
 To create a new Sensor-Analyzer element

opens.
2. Right-click IPS Engines in the IPS tree and select NewCombined Sensor-Analyzer from
the menu. The Combined Sensor-Analyzer Properties dialog opens.
Illustration 26.9 Combined Sensor-Analyzer Properties

5. Select the Log Server for Alerts. This can be the same Log Server that you selected in the
previous step.
triggered by your IPS rules. This can also be the same Log Server as in the previous steps.
components affecting this sensor-analyzer’s communications. See Configuring System
What’s Next?

Creating a New SSL VPN Gateway Element
StoneGate SSL VPN appliances can be monitored through the Management Center. To receive
logs from the SSL VPN gateway, the SSL VPN appliance must be configured to send the logs as
a Syslog stream to the Log Server. For information on configuring StoneGate SSL VPN, see the
Appliance Installation Guide delivered with the appliance and the SSL VPN Administrator’s Guide.
Note – You cannot change any of the SSL VPN gateway’s settings in the Management
Client. The configuration in the Management Client is just for establishing contact between
the Management Center and the SSL VPN gateway.
 To create a new SSL VPN Gateway element

view opens.
2. Browse to Network ElementsSSL VPN Gateways in the Firewall tree.
3. Right-click SSL VPN Gateways and select NewSSL VPN Gateway from the menu. The SSL
VPN Gateway Properties dialog opens.
Illustration 26.10 SSL VPN Gateway Properties

components affecting this SSL VPN appliance’s communications. See Configuring System
7. If you have a mirrored pair of SSL VPN appliances, select Mirrored Pair above the Nodes
table. In this element, it does not matter which of the nodes is the primary appliance.
8. Double-click a node in the Nodes table to open its properties.
9. Fill in the Name, local IP Address, and (optional) Application Portal URL for the node and
click OK.
• The Application Portal URL is used when you open the portal through the SSL VPN
Gateway element’s right-click menu in the Management Client.
• This is also where you define the Contact Address information when necessary (see
Configuring System Communications (page 59) for more information).
10.If a Mirrored Pair, repeat the previous two steps for the other node.

11.Click OK.
What’s Next?
 Continue by Connecting SSL VPN Gateways to the SMC (page 396).
Duplicating an Existing Engine Element

If you have similar configurations at several sites, you can create a duplicate of an existing
single or clustered engine element to reduce the need for manual configuration work.
 To duplicate an existing engine element

1. Right-click the existing engine element and select NewDuplicate from the menu. The
properties dialog for the new engine opens.
2. Give the engine element a unique Name.
3. Adjust the rest of the properties as needed (see Modifying Existing Engine Elements
(page 323)). For all engine elements except SSL VPN Gateways, you must change at least
the IP address of the control interface (or configure the duplicate to use a different control
interface). The control interface must be unique for each engine. See Getting Started with
Interface Configuration (page 342).
4. Click OK. The new engine element is added to the element tree.
Modifying Existing Engine Elements

Prerequisites: Creating New Engine Elements
Existing engine elements are shown, depending on their type, in the System Status view under
engine-specific branches. Firewall elements and SSL VPN Gateway elements are shown in the
Firewall Configuration view under the Firewalls and the Network ElementsSSL VPN Gateways
branches. IPS elements are shown in the IPS Configuration view under the IPS Engines branch.
You can modify the properties of an individual engine element or the common properties shared
by several engine elements. You can also convert a single firewall or sensor into a cluster.
Related Tasks
 Modifying the Properties of One Engine Element (page 324).
 Modifying Properties of Several Engines at Once (page 324).
 Converting a Single Firewall to a Firewall Cluster (page 325).
 Converting a Single Sensor to a Sensor Cluster (page 329)
 Adding a Node to a Firewall or Sensor Cluster (page 330).
 Changing an Engine’s Control IP Address (page 331)
Modifying Existing Engine Elements 323

Modifying the Properties of One Engine Element
When you open the properties dialog for one element, you can modify any of its properties. You
can also change the properties of several engine elements simultaneously, but this restricts you
to actions and values that are applicable to all of them at the same time (see Modifying
Properties of Several Engines at Once (page 324)).
 To view or modify any properties of an engine element

1. Right-click an engine element and select Properties from the menu. The properties dialog
for the element opens.
2. Proceed to the one of the following sections depending on the type of the element:
• Editing Single Firewall Properties (page 333)
• Editing Firewall Cluster Properties (page 334)
• Editing SOHO Firewall Properties (page 335)
• Editing Analyzer Properties (page 336)
• Editing Single Sensor Properties (page 337)
• Editing Sensor Cluster Properties (page 338)
• Editing Combined Sensor-Analyzer Properties (page 339)
• Creating a New SSL VPN Gateway Element (page 322)
Modifying Properties of Several Engines at Once

You can select several engine elements to change properties that are common to all of the
elements. The options available to you are limited as follows:
• Properties specific to one individual engine element, such as IP address definitions, are
never available in the common properties.
• If you select both single and clustered engine elements, the cluster-specific options are not
available.
• If you select elements of different types, you can only set the Log Server, Location, and
Comment options.
 To modify common properties for several Firewalls, Analyzers, or Sensors

1. Shift-select or Ctrl-select the engine elements you want to modify.
2. Right-click one of the selected items and select Common Properties from the menu. The
Common Engine Properties dialog opens.
3. Select the options you want to set for all of the selected engines. The options you see
depend on how similar in type the selected engines are:
• Editing Single Firewall Properties (page 333)
• Editing Firewall Cluster Properties (page 334)
• Editing SOHO Firewall Properties (page 335)
• Editing Analyzer Properties (page 336)
• Editing Single Sensor Properties (page 337)
• Editing Sensor Cluster Properties (page 338)
• Editing Combined Sensor-Analyzer Properties (page 339)
• Creating a New SSL VPN Gateway Element (page 322)
4. Click OK. All selected engines now use the same new settings for the options you changed.

Converting a Single Firewall to a Firewall Cluster
When switching from a single firewall engine to a clustered firewall, the recommended procedure
is to run a conversion tool in the system that converts the Single Firewall element to a FIrewall
Cluster element. This maintains the relationship of the engine element with other configurations
in the system (for example, VPNs), allows you to maintain some of the existing interface
configurations (such as VLANs defined on the interfaces), and minimizes service interruptions.
The conversion requires that you select one Single Firewall element that you convert to a cluster.
It is not possible to merge two Single Firewall elements into a Firewall Cluster.
If the single firewall is managed remotely, make sure that enough IP addresses are available.
Each clustered engine node needs a dedicated IP address for its management communications
(on one or two ISP links depending on the desired level of redundancy). Additionally, the traffic
that the nodes inspect requires one dedicated IP address per cluster (for each ISP link).
Due to differences in the supported configurations, there are some configurations that prevent
you from switching from a single firewall to a firewall cluster. These are listed in the table below.
Table 26.1 Unsupported Configurations on Firewall Clusters
Configuration Notes
Firewall clusters do not support integrated ADSL modems. To convert to a
ADSL interfaces cluster, you must switch to an external ADSL modem that the firewall
engines access through an Ethernet connection.
Internal DHCP Server on Clustered firewalls support an internal DHCP server starting from software
older engine versions version 5.2. Upgrade the engine as necessary before conversion.
Firewall clusters can only have static IP addresses on their interfaces.

Dynamic IP addresses Clusters cannot use a dynamically assigned (DHCP or PPPoE) IP address
on their interfaces.
Firewall clusters can only have IPv4 addresses on their interfaces and can
IPv6 addresses only process IPv4 traffic. Postpone the conversion to cluster until a
software version with improved IPv6 support for clusters is released.
Firewall clusters do not support integrated 3G modems. You must switch

Modem interfaces to a configuration that uses an external 3G modem through an Ethernet
connection to convert to a cluster.

Preparing for Conversion to a Firewall Cluster
When converting from a single engine installation to a cluster, the engines should be prepared
for clustering as explained below.
 To prepare for conversion to a firewall cluster

1. If you are not using identical hardware, check that the performance levels match your
needs. Equipment with different performance levels can be used for balancing the load
between the clustered engines. For high availability when one engine is offline, the other
engine must be capable of handling all traffic alone.
2. Make sure both firewall engines have their own license. Clustered engines are licensed in
the same way as two single firewall engines. All current firewall engine licenses allow
clustering the nodes, so no license changes are needed to activate clustering.
• For more information, see Getting Started with Licenses (page 824).
3. Make sure the engines are running software versions that are compatible with the SMC,
and preferably that both engines are running the exact same version. Although the cluster
can be installed with the engines running different software versions (unless otherwise
stated in the Release Notes), long-term use with mismatched versions is not supported.
• For more information, see Upgrading Engines Remotely (page 841) or the local upgrade
instructions in the Installation Guide.
4. If the new engine you want to add to the cluster already has a working configuration from
previous use, return it to the initial configuration state in the boot menu (factory reset) or
through the sg-reconfigure wizard on the command line. Do not establish a connection
with the Management Server before the Firewall Cluster element is ready.
• For more information, see Getting Started with the Engine Command Line (page 202).
Caution – If the engine has a working configuration, it will go online and process traffic
when you power it on to configure it for the cluster.
5. Connect the network cables to the new engine and power it on.
Converting a Single Firewall Element to a Firewall Cluster

Firewall clusters have additional IP addressing requirements compared to single firewalls. The
requirements are due to the two types of IP addresses that clusters need to function (NDIs
needed for the node’s own communications and the shared CVIs needed to process traffic). The
conversion tool requires that you convert IP addresses used by these features into correct
types. You must switch a feature to use a different IP addresses before you start the conversion
if your chosen interface types conflicts with some feature that currently uses the IP address.

The IP address requirements and related important considerations are listed in the table below.
Table 26.2 Interface Type Requirements by Feature on Firewall Clusters
Feature Type Required Notes

Each node requires its own NDI address. Often, the current single
firewall IP address on the interface is used for both the engine’s
Control own communications and the general traffic that the engine
interface processes. In such cases, you can convert the IP address to a CVI
NDI
(Management to avoid reconfiguring external equipment and introduce new NDI
connections) addresses for the nodes.
If the firewall is managed remotely, make sure that there are
enough IP addresses available.
DHCP relay CVI Configured in the Physical Interface properties.
DHCP relay for

NDI Configured in the VPN Gateway properties.
VPN clients
Heartbeat and state synchronization communications between

clustered engines.
Use a dedicated interface for heartbeat, as reliable transmissions
Heartbeat
NDI are absolutely critical to the operation of the cluster. If you
interface
connect the heartbeat through a switch, make sure that the
switch does not throttle or block multicast traffic between the
clustered engines.
The engines do not allow any traffic that is sent to an NDI

address, but has some other destination.
Surrounding network devices that use the firewall as a default
gateway must refer to a CVI.
Routing CVI
If the internal DHCP server is used and configured to assign the
firewall itself as the default gateway for clients, the default
gateway IP address must be a CVI (configured in the Physical
Interface properties).
VPN endpoints CVI Configured in the VPN Gateway properties.
 To modify a Single Firewall element for conversion

1. If you plan to convert the current IP address for management connections to a CVI:
1a. Add the new (to be NDI) IP address as a backup Control Interface address in the Single
Firewall element.
1b. Adjust the Access and NAT rules of any firewalls on the communications path to allow
both the current and new control IP addresses to be used and refresh the policies of
these firewalls.
1c. Refresh the policy of the Single Firewall you plan to convert.
1d. Clear the Backup Control Interface selection and configure the new (to be NDI) control
IP address as the Primary Control Interface address.
2. Add any new IP addresses that are required to support the active features (see table above)
and configure the features to use those IP addresses.

3. If configured, remove dynamic IP addresses, IPv6 addresses, Modem Interfaces, and ADSL
Interfaces. These configurations are not supported on clusters.
 To run the element conversion tool and map the interface types
1. Right-click the Single Firewall element that you want to upgrade to a cluster and select
ConfigurationUpgrade to Cluster. An interface mapping dialog opens.
Illustration 26.11 Interface Mapping Dialog
2. Click the Upgrade to column cell for each interface and select the IP address type(s) for the
interfaces.
• An NDI (Node Dedicated IP Address) is used for communications between the engine
itself and some other host in the network, such as the other nodes in the cluster, the
Management Server, hosts you ping from the engine’s command line, etc.
• A CVI (Cluster Virtual IP Address) is used for handling traffic that the cluster examines. If
other network devices point to the firewall’s IP address (as a default gateway or as a VPN
endpoint, for example), converting the IP address to a CVI will allow those external
configurations to remain unchanged.
• You can select both a CVI and an NDI to be created for the same physical interface. This
is the recommended working configuration for all interfaces, but may not be appropriate
for all interfaces at this stage, since you cannot select which role the current IP address
takes. Additional IP addresses are generated automatically to create the CVIs and NDIs.
• Each selection is validated and you may not be able to select a type if it is incompatible
with some feature. See Table 26.2 above for a summary of requirements.
3. Click OK. The Cluster Properties dialog for the new Firewall Cluster element opens.
4. In the cluster element properties, check and change the settings as needed. For help on
defining the interfaces, see Getting Started with Interface Configuration (page 342).
4a. Switch to the Interfaces tab.
4b. Add the necessary Physical interfaces and IP addresses that are needed in addition to
those used on the single firewall. Check that the IP addresses on all interfaces are
correct and change as necessary.
4c. Select Packet Dispatch as the CVI mode and enter the related unicast MAC address in
the properties of all Physical Interfaces that have CVI definitions.
4d. Click Options and select the correct interfaces for the different roles.
4e. If the internal DHCP server is used and configured to assign the firewall itself as the
default gateway for clients, make sure the default gateway IP address is a CVI (Physical
Interface properties, DHCP tab).

5. Click OK. The Single Firewall element is converted to a Firewall Cluster. Note that you can
still click Cancel to return to the previous configuration and undo the conversion.
Activating the Clustered Configuration After Conversion

 To activate the Firewall Cluster configuration
1. If any external devices use the firewall as a default gateway or a VPN endpoint and the
previously used IP address is converted to an NDI, change the configurations of the
external equipment to refer to a CVI address instead.
2. Run the sg-reconfigure command on the new engine, make sure the interface IDs are
mapped correctly to network ports according to the engine’s cabling, and connect the new
engine node to the Management Center with a one-time password created for that cluster
node.
• For more information, see Saving an Initial Configuration for Firewall or IPS Engines
(page 393). Any new engine nodes are installed and configured as part of the cluster as
in a completely new installation.
3. Install the policy on the cluster.
• If you want to refresh the policy of the existing node before the new node(s) are initialized,
you must mark the inactive nodes in the cluster element’s properties as disabled (on the
Cluster tab). Otherwise, the policy installation will fail because all nodes cannot be
contacted.
If issues arise, you can command one node offline through the right-click menu or through the
command line to return to single-node operation.
Converting a Single Sensor to a Sensor Cluster

When you switch to a clustered configuration, the recommended procedure is to run the
conversion tool so that the connection between the Sensor element and other configurations is
preserved. The conversion requires that you select one Single Sensor element that you convert
to a cluster. It is not possible to combine two Single Sensor elements into one.
For more information on how clustered sensors fit in the network architecture, see the IPS
Reference Guide.
Caution – If you change the control IP address of the existing node in this process, the
connection between the engine and the SMC is lost. See Changing an Engine’s Control IP
Address (page 331) to change the control IP address without losing contact.
 To convert a Single Sensor to a Sensor Cluster

1. Make sure both engines are licensed. The licensing of clustered engine nodes is done in
the same way as the licensing of two Single Sensors. All current sensor engine licenses
allow clustering the nodes, so no license changes are needed to activate the feature.
• For more information, see Getting Started with Licenses (page 824).
2. Make sure the engines are running software versions that are compatible with the SMC,
and preferably that both engines are running the exact same version. Although the cluster
can be installed with the engines running different software versions (unless otherwise
stated in the Release Notes), long-term use with mismatched versions is not supported.
• For more information, see Upgrading Engines Remotely (page 841) or the local upgrade
instructions in the Installation Guide.

3. If the new engine you want to add to the cluster already has a working configuration from
previous use, return it to the initial configuration state in the boot menu (factory reset) or
through the sg-reconfigure wizard on the command line. Do not establish a connection
with the Management Server before the Sensor Cluster element is ready.
• For more information, see Getting Started with the Engine Command Line (page 202).
4. Connect the network cables to the new node and power it on.
5. Right-click the Single Sensor element that you want to upgrade to a cluster and select
ConfigurationUpgrade to Cluster. The Sensor Cluster properties dialog opens.
6. In the Sensor Cluster element properties, switch to the Interfaces tab.
7. Click Options and select the correct interfaces for the different roles.
• For more help on defining the interfaces, see Getting Started with Interface Configuration
(page 342).
8. Click OK. The Single Sensor is converted to a Sensor Cluster element. Note that you can
still click Cancel to return to the previous configuration and undo the conversion.
9. Connect the new engine node to the Management Center with a one-time password created
for that cluster node.
• For more information, see Saving an Initial Configuration for Firewall or IPS Engines
(page 393). Any new engine nodes are installed and configured as part of the cluster as
in a completely new installation.
10.Install the policy on the cluster.
• If you want to refresh the policy of the existing node before the new node(s) are initialized,
you must disable the inactive nodes in the cluster element’s properties (on the Cluster
tab). Otherwise, the policy installation will fail due to a lack of connectivity to all nodes.
Adding a Node to a Firewall or Sensor Cluster

The nodes represent the physical firewall or sensor engines. By default, the Cluster Properties
dialog displays two nodes on the Cluster tab. You can add new nodes to the cluster as
described below. StoneGate supports up to 16 nodes in one cluster.
Before you add a node in the configuration, install the additional physical engine device and
connect the cables for at least the control interface and the interface for communications
between the clustered engines. If the device already has a working configuration from previous
use, return it to the initial configuration state in the sg-reconfigure wizard on the command
line before connecting it to the network in its new position. It is not necessary to establish a
connection with the Management Server at this point, since it would have to be redone after you
complete the configuration.
 To add a node to a cluster

1. Right-click the cluster and select Properties from the menu. The Cluster Properties dialog
opens.
2. Click the Add Node button at the bottom left corner of the dialog. The Engine Node
3. Give the node a unique Name.
4. In the table below, check and modify the information in the IP Address, Contact IP
Address, and Comment columns for each NDI (double-click the value you want to change).
Firewall CVI details are identical between the nodes, so this operation does not require
changing the CVI configuration in any way.

5. Click OK in both open dialogs.
6. Save the initial configuration for the new engine node to create a one-time password (see
Saving an Initial Configuration for Firewall or IPS Engines (page 393)).
7. Connect the new engine to the Management Server using the new one-time password (see
the Firewall/VPN Installation Guide or the IPS Installation Guide).
The configuration changes are transferred to the engines the next time you install or refresh the
policy. If you want to refresh the policy of the existing node(s) before the new node(s) are
initialized, you must disable the inactive node(s) in the cluster element’s properties (on the
Cluster tab).
Changing an Engine’s Control IP Address

The following instructions explain how you can change an engine’s control IP address without
losing management connectivity. SOHO firewalls do not have a control IP address.
When you change IP addressing, other connections between the different components may be
temporarily lost. You must make sure that the connections return to normal after the IP address
changes.
Proceed to one of the following:
• Changing an Engine’s Control Address (page 331)
• Changing a Firewall’s Control Address to a Different Network (page 332)
Changing an Engine’s Control Address

The section explains how you can change the control IP address of an engine if the new control
IP address belongs to the same network as the old control IP address. If the new control IP
address of a firewall engine belongs to a different network than the engine’s old control IP
address, see Changing a Firewall’s Control Address to a Different Network (page 332).
If you do not mind losing management connectivity, you can alternatively just change the control
IP address in the SMC and then re-initialize the engine through the command line using a new
one-time password (see Connecting Engines to the StoneGate Management Center (page 391)).
If your engine cannot use both the old control IP address and a new control IP address
simultaneously, skip Step 5.
 To change the control IP address to an IP address from the same network

1. If you have an IP address bound license for the engine, request a new license at the
Stonesoft License center and import and bind the new license to the engine.
• You must switch to a Management Server POL code bound license, because IP address
bound licences are no longer supported. See Getting Started with Licenses (page 824).
2. In the engine properties, create a new interface for the new IP address and set the address
as the backup control IP address (see Getting Started with Interface Configuration
(page 342)).
3. Install the policy on the engine.
• From this point on, you can start using the new address in the network.
4. In the engine properties, set the old control IP address as the backup control IP address
and the new control IP address as the primary control IP address.
5. Refresh the policy.

6. Remove the old control IP address from the engine properties and the corresponding
network from the Routing view (see Getting Started with Routing (page 440)).
Note – If the connection with the Management Server is lost when you are trying to
change IP addressing, run the sg-reconfigure command on the engine command line to
return the engine to the initial configuration state and to re-establish initial contact
between the engine and the Management Server. See Connecting Engines to the
StoneGate Management Center (page 391).
Changing a Firewall’s Control Address to a Different Network

The section explains how you can change the control IP address of a firewall engine when the
new IP address is in a different network from the old one. If the firewall engine’s new control IP
address belongs to the same network as the old control IP address, see Changing an Engine’s
Control Address (page 331).
If you do not mind losing management connectivity, you can alternatively just change the control
IP address in the SMC and then re-initialize the engine through the command line using a new
one-time password (see Connecting Engines to the StoneGate Management Center (page 391)).
If your engine cannot use both the old control IP address and a new control IP address
simultaneously, skip Step 6.
 To change the firewall engine’s control IP address to an address from a different

network
1. If you have an IP address bound license for the engine, request a new license at the
Stonesoft License center and import and bind the new license to the engine.
• You must switch to a Management Server POL code bound license, because IP address
bound licences are no longer supported. See Getting Started with Licenses (page 824).
2. Edit the firewall’s properties and add a new interface (see Modifying Existing Engine
Elements (page 323)).
• Define the new primary control address as the backup control IP address.
• If your firewall is a cluster and you do not want to lose any connections, define also a new
CVI for the cluster (see Configuring Firewall Cluster IP Addresses (page 356)).
3. Create two NetLinks (one for the old control IP address and another for the new control IP
address) and an outbound Multi-Link (see Outbound Traffic Management (page 459)).
4. Install the policy on the firewall.
• From this point on, you can start using the new address in the network.
5. Edit the firewall’s properties and set the new control IP address as the primary control IP
address and the old control IP address as the backup control IP address.
7. Remove the interface with the old control IP address from the firewall’s properties.
8. Remove the Multi-Link configuration you created in Step 3.

Note – If the connection with the Management Server is lost when you are trying to
change IP addressing, run the sg-reconfigure command on the engine command line to
return the engine to the initial configuration state and to re-establish initial contact
between the engine and the Management Server. See Connecting Engines to the
StoneGate Management Center (page 391).
Editing Single Firewall Properties

If you are creating a new Single Firewall, proceed as explained in Creating a New Single Firewall
Element (page 313).
Table 26.3 Tasks to Do in Single Firewall Properties Dialog
Tab Tasks
For defining the basic properties, see Creating a New Single Firewall Element
(page 313).
For defining Locations and Contact addresses, see Defining Engine Location
(page 62).
Single Node For selecting an SNMP Agent, see Activating the SNMP Agent on Engines
(page 435).
For selecting Categories, see Using Categories (page 72).
For defining a Tools Profile, see Adding Custom Commands to Element Menus
(page 53).
For adding or modifying interfaces, see Firewall Interface Configuration

(page 343).
For defining interface options, see Setting Firewall Interface Options (page 361).
Interfaces
For adding or modifying ARP entries, see Configuring Manual ARP Settings
(page 387).
For configuring multicast routing, see Routing Multicast Traffic (page 447).
Tester See Getting Started with the Engine Tester (page 398).
See Getting Started with Engine Permissions (page 408).

Permissions For more information on Administrator privilege levels, see Getting Started with
Administrator Accounts (page 214).
Aliases See Getting Started with Alias Translations (page 412).
HTTPS Inspection See Activating HTTPS Inspection on the Engine (page 665).
See Adjusting Firewall System Parameters (page 416), and Adjusting Firewall
Advanced
Traffic Handling Parameters (page 418).
Editing Single Firewall Properties 333

Editing Firewall Cluster Properties
If you are creating a new Firewall Cluster, proceed as explained in Creating a New Firewall
Cluster Element (page 314).
Table 26.4 Tasks to Do in Firewall Cluster Properties Dialog
Tab Tasks
For defining the basic properties, see Creating a New Firewall Cluster Element
(page 314).
(page 62).
For selecting an SNMP Agent, see Activating the SNMP Agent on Engines
Cluster (page 435).
(page 53).
To add a node to the cluster, se Adding a Node to a Firewall or Sensor Cluster
(page 330).
For adding or modifying interfaces, see Firewall Interface Configuration

(page 343).
For defining interface options, see Setting Firewall Interface Options (page 361).
Interfaces
(page 387).
For configuring multicast routing, see Routing Multicast Traffic (page 447).

Aliases See Getting Started with Alias Translations (page 412).
See Adjusting Firewall System Parameters (page 416), and Adjusting Firewall
Advanced
Traffic Handling Parameters (page 418).

Editing SOHO Firewall Properties
If you are creating a new SOHO Firewall, proceed as explained in Creating One New SOHO
Firewall Element (page 315) or Creating Multiple New SOHO Firewall Elements (page 316).
Table 26.5 Tasks to Do in SOHO Firewall Properties Dialog
Tab Tasks
For defining the basic properties, see Creating One New SOHO Firewall Element
(page 315).
For information on defining Locations, see Configuring System Communications
General (page 59).
(page 53).
For defining the properties of the External interface, see Defining External
External
Interfaces for SOHO Firewalls (page 366).
For defining the properties of the Corporate interface, see Defining Corporate
Corporate
For defining the properties of the optional Guest interface(s), see Defining Guest
Guest
See Defining Wireless Channel Settings for SOHO Firewalls (page 375).
Wireless Channel For additional wireless LAN settings, also see Defining Wireless Security Settings
for SOHO Firewalls (page 374).

Related Tasks
 Adjusting SOHO Firewall Management Connection (page 430)
Editing SOHO Firewall Properties 335

Editing Analyzer Properties
If you are creating a new Analyzer, proceed as explained in Creating a New Analyzer Element
(page 318).
Table 26.6 Tasks to Do in Analyzer Properties Dialog
Tab Tasks
For defining the basic properties, see Creating a New Analyzer Element
(page 318).
(page 62).
(page 435).
(page 53).
For adding or modifying interfaces, see Sensor and Analyzer Interface

Configuration (page 377).
For defining interface options, see Setting Interface Options for IPS Engines
Interfaces
(page 385).
(page 387).

Aliases See Defining Alias Translation Values (page 412).
To define to which Firewalls the Analyzer sends blacklist requests, see Defining
Blacklisting
Destination Interfaces for Automatic Blacklisting (page 681).
Advanced See Adjusting Analyzer Advanced Settings (page 427).

Editing Single Sensor Properties
If you are creating a new Single Sensor, proceed as explained in Creating a New Single Sensor
Element (page 319).
Table 26.7 Tasks to Do in Single Sensor Properties Dialog
Tab Tasks
For defining the basic properties, see Creating a New Single Sensor Element
(page 319).
(page 62).
(page 435).
(page 53).

Interfaces
(page 385).
(page 387).

Advanced See Adjusting Sensor Advanced Settings (page 428).
Editing Single Sensor Properties 337

Editing Sensor Cluster Properties
If you are creating a new Sensor Cluster, proceed as explained in Creating a New Sensor Cluster
Element (page 320).
Table 26.8 Tasks to Do in Sensor Cluster Properties Dialog
Tab Tasks
For defining the basic properties, see Creating a New Sensor Cluster Element
(page 320).
(page 62).
For selecting an SNMP Agent, see Activating the SNMP Agent on Engines
Cluster (page 435).
(page 53).
To add a node to the cluster, see Adding a Node to a Firewall or Sensor Cluster
(page 330).

Interfaces
(page 385).
(page 387).

Advanced See Adjusting Sensor Advanced Settings (page 428).

Editing Combined Sensor-Analyzer Properties
If you are creating a new Combined Sensor-Analyzer, proceed as explained in Creating a New
Combined Sensor-Analyzer Element (page 321)
Table 26.9 Tasks to Do in Combined Sensor-Analyzer Properties Dialog
Tab Tasks
For defining the basic properties, see Creating a New Combined Sensor-Analyzer
Element (page 321).
(page 62).
(page 435).
(page 53).

Interfaces
(page 385).
(page 387).

To define to which Firewalls the Analyzer sends blacklist requests, see Defining
Blacklisting
Destination Interfaces for Automatic Blacklisting (page 681).
Advanced See Adjusting Sensor-Analyzer Advanced Settings (page 427).
Editing Combined Sensor-Analyzer Properties 339

About Engine Time Synchronization
Prerequisites: None
Only SOHO firewalls contact NTP (Network Time Protocol) servers directly. Otherwise, engine
times are automatically synchronized to match the time of the Management Server. If you want
to use an NTP server to synchronize engine times, you must set the computer on which you
have installed the Management Server to synchronize its time with the NTP server. If the Log
Server runs on a different computer, set it to use the same NTP server.
If the Management Server, Log Server, and the engines do not have the same time, there may
be problems with logging and monitoring. Also, make sure that the computer you use for
Management Client access has the time and time zone set correctly to avoid time
synchronization problems when you view statistics or logs, generate reports, or schedule
automatic maintenance tasks.

C HAPT ER 27
NETWORK INTERFACE CONFIGURATION
The network interface configuration for all engines is stored on the Management Server in the
properties of Single Firewall, Firewall Cluster, SOHO Firewall, Sensor, Sensor Cluster, Analyzer,
and Sensor-Analyzer elements.
Getting Started with Interface Configuration (page 342)

Firewall Interface Configuration (page 343)
SOHO Firewall Interface Configuration (page 364)
Sensor and Analyzer Interface Configuration (page 377)
Configuring Manual ARP Settings (page 387)
Activating the Internal DHCP Server on a Firewall Interface (page 388)
341
Getting Started with Interface Configuration
Prerequisites: Creating New Engine Elements / Modifying Existing Engine Elements
The Interface configuration is done using the Management Client.

What the Interface Configuration Includes
The interface configuration stored on the Management Server contains all settings related to all
supported types of network interfaces except the network card driver selection, the mapping of
the operating system port numbers to the numbers used in the Management Client, and the
network card speed/duplex settings.
The configuration transferred from the Management Server overwrites the settings that can be
defined through the engine command line (the details for initial contact to the Management
Server to establish a trusted communications channel).
Limitations
• Clusters cannot have dynamic IP addresses.
• IPv6 addresses are supported only on single firewalls. Only IPv4 addresses are supported in
the following interface configurations:
• As system communications interfaces.
• In Manual ARP Entries.
• For DHCP relay.
• For VRRP.
• As dynamic IP addresses on the firewall’s interfaces.
• An ADSL Interface is only supported on single firewall engines that run on specific pre-
installed StoneGate appliances that have an ADSL network interface card.
• SOHO firewalls, Modem interfaces, and ADSL interfaces do not support VLAN tagging.
The interface configuration of engine components proceeds as follows:
1. Add the network interfaces you want to use on the engine.
2. Define the VLANs.
3. Define the IP address settings.
4. Configure additional related settings depending on the features you want to use.
What’s Next?
 Firewall Interface Configuration (page 343)
 Selecting SOHO Firewall Interface Types (page 364).
 Sensor and Analyzer Interface Configuration (page 377).
Related Tasks
 Configuring Manual ARP Settings (page 387)
 Activating the Internal DHCP Server on a Firewall Interface (page 388)
342 Chapter 27 Network Interface Configuration

Firewall Interface Configuration
The interface configuration for StoneGate Firewall/VPN consists of the following main steps:
1. Add the required number of network connections:
• Define Ethernet links as explained in Defining Physical Interfaces for Firewall Engines
(page 344).
• (Single Firewalls only) Define integrated ADSL modems as explained in Adding ADSL
Interfaces for Single Firewalls (page 348).
• (Single Firewalls only) Define integrated 3G modems as explained in Defining Modem
Interfaces for Single Firewalls (page 358).
2. (Physical Interfaces only) Add the required number of VLANs as explained in Adding VLAN
Interfaces for Firewall Engines (page 346).
3. (Not applicable to Modem interfaces) Configure the IP address settings as explained in
Configuring Single Firewall IP Addresses (page 351) or Configuring Firewall Cluster IP
4. Select the interfaces that are used for system communications as explained in Setting
Firewall Interface Options (page 361).
Related Tasks
 SOHO Firewall Interface Configuration (page 364)
 Routing Multicast Traffic (page 447)
Firewall Interface Configuration 343

Defining Physical Interfaces for Firewall Engines
The Physical Interface element activates a network port on the firewall. By default, the
numbering of the Physical Interfaces in the Management Client corresponds to the operating
system interface numbering on the engine (that is, Interface ID 0 is mapped to eth0, ID 1 to
eth1, etc.). However, the mapping is not fixed and you can change it freely through the engine
command line.
For settings on the DHCP tab, see Activating the Internal DHCP Server on a Firewall Interface
(page 388) or (for DHCP relay) Routing DHCP Messages (page 445).
For settings on the Advanced tab, see Configuring Advanced Interface Properties for Firewalls
(page 349).
 To define a Physical Interface

1. In the properties dialog for the firewall, switch to the Interfaces tab.
2. Right-click the empty space and select NewPhysical Interface or New Physical
Interface. The Physical Interface Properties dialog opens.
Illustration 27.1 Physical Interface Properties (Firewall Cluster)
3. Define the Physical Interface properties as explained in the table below.
Options Explanation
The Interface ID automatically maps to a physical interface of
the same number during the initial configuration of the
Interface ID
engine, but the mapping can be changed as necessary
through the engine’s command line interface.

Options Explanation
Corresponds to a single network interface on the firewall
Normal Interface
engine.
Represents two interfaces on the firewall engine. Only the first

interface in the aggregated link is actively used. The second
Aggregated Link in interface becomes active only if the first interface fails.
High-Availability
If you configure an Aggregated Link in High-Availability mode,
Mode
connect the first interface to one switch and the second
interface to another switch.
Type Represents two interfaces on the firewall engine. Both
interfaces in the aggregated link are actively used and
connections are automatically balanced between the two
interfaces.
Aggregated Link in
Load-Balancing Link aggregation in the load-balancing mode is implemented
Mode based on the IEEE 802.3ad Link Aggregation standard. If you
configure an Aggregated Link in Load-Balancing Mode,
connect both interfaces to a single switch. Make sure that the
switch supports the Link Aggregation Control Protocol (LACP)
and that LACP is configured on the switch.
Second Interface ID
(Only if interface type is Aggregated The second interface in the aggregated link.
Link)
CVI Mode Unless you have a specific reason to use some other setting,
use the default Packet Dispatch setting. The Packet Dispatch
(Optional,
mode is the best choice in most environments. See the
Firewall Clusters only) Firewall/VPN Reference Guide for more information.
The MAC address for the Cluster Virtual IP Address. Do not

use the MAC address of any actual network card on any of the
nodes.
Packet Dispatch and Unicast MAC modes: enter a unicast MAC
MAC Address address (even number as the first octet).
Multicast MAC mode: enter a multicast MAC address (odd
(Firewall Clusters only)
number as the first octet).
Multicast MAC with IGMP: enter a Multicast Address, that is,
an IP address from the range 224.0.0.0-239.255.255.255.
The address is used for automatically calculating a MAC
address.
QoS Policy The QoS Policy for the link on the interface. For more
(Optional) information, see Getting Started with QoS (page 616).

Options Explanation
The throughput for the link on this interface.
The throughput is for uplink speed (outgoing traffic) and
typically must correspond to the speed of an Internet link
(such as an ADSL line), or the combined speeds of several
such links when they are connected to a single physical
interface).
Throughput The throughput as kilobits per second (for example, type
(Optional, 300). You can also use the shorthands M or G to enter the
only if QoS Policy is selected) value in megabits or gigabits respectively (for example, type
3M for three megabits.
Caution! Make sure you set the Interface speed correctly.
When the bandwidth is set, the firewall always scales the total
amount of traffic on this interface to the bandwidth you
defined. This happens even if there are no bandwidth limits or
guarantees defined for any traffic.
The MTU (maximum transmission unit) size on the connected

link. Either type in a value between 400-65535 or select a
common MTU value from the list.
MTU
The default value (also the maximum standard MTU in
(Optional)
Ethernet) is 1500. Do not set a value larger than the standard
MTU unless you know that all the devices along the
communications path support it.
4. Click OK. The Physical Interface is added to the interface list.

5. Repeat from Step 2 to add more Physical Interfaces.
What’s Next?
 Adding VLAN Interfaces for Firewall Engines (page 346).
 Configuring Single Firewall IP Addresses (page 351).
 Configuring Firewall Cluster IP Addresses (page 356).
Related Tasks
 For DHCP relay, see Routing DHCP Messages (page 445).
 Configuring Advanced Interface Properties for Firewalls (page 349)
Adding VLAN Interfaces for Firewall Engines

VLANs divide a single physical network link into several virtual links. VLANs can be defined for
both single and clustered firewalls. The maximum number of VLANs for a single Physical
Interface is 4094. The VLANs must be defined also in the configuration of the switch/router to
which the interface is connected.
Note that you can drag and drop VLAN tags to a different Physical Interfaces if necessary.
For settings on the DHCP tab, see Activating the Internal DHCP Server on a Firewall Interface
(page 388) or (for DHCP relay) Routing DHCP Messages (page 445).

(page 349).
 To add a VLAN Interface for a single or clustered firewall

2. Right-click a Physical Interface and select NewVLAN Interface. The VLAN Interface
Illustration 27.2 VLAN Interface Properties
3. Define the VLAN interface properties as explained in the table below.
Option Explanation
Enter the VLAN ID (1-4094). The VLAN IDs you add must be the same as the VLAN
VLAN ID
IDs that are used in the switch at the other end of the VLAN trunk.
QoS Policy The QoS Policy for the link on the interface. For more information, see Getting Started
(Optional) with QoS (page 616).
The throughput for the link on this interface.

The throughput is for uplink speed (outgoing traffic) and typically must correspond to
the speed of an Internet link (such as an ADSL line), or the combined speeds of
Throughput several such links when they are connected to a single Physical Interface.
(Optional, Enter the throughput as kilobits per second (for example, type 300). You can also use
only if QoS the shorthands M or G to enter the value in megabits or gigabits respectively (for
Policy is example, type 3M for three megabits.
selected) Caution! Make sure you set the interface speed correctly. When the bandwidth is set,
the firewall always scales the total amount of traffic on this interface to the
bandwidth you defined. This happens even if there are no bandwidth limits or
guarantees defined for any traffic.
The MTU (maximum transmission unit) size on the connected link. Either type in a
value between 400-65535 or select a common MTU value from the list.
MTU
The default value (also the maximum standard MTU in Ethernet) is 1500. Do not set
(Optional)
a value larger than the standard MTU unless you know that all the devices along the
4. Click OK. The specified VLAN ID is added to the Physical Interface.

5. Repeat from Step 2 to add further VLANs on the same or other Physical Interfaces.

Each VLAN interface is identified as Interface-ID.VLAN-ID, for example 2.100 for Interface ID
2 and VLAN ID 100.
What’s Next?
 Configuring Single Firewall IP Addresses (page 351).
 Configuring Firewall Cluster IP Addresses (page 356).
Related Tasks
 For DHCP relay, see Routing DHCP Messages (page 445)
 Configuring Advanced Interface Properties for Firewalls (page 349).
Adding ADSL Interfaces for Single Firewalls

You can configure one ADSL Interface on a single firewall. The supported ADSL standards are
ANSI T1.413 i2, G. Lite, and Annex A. ADSL is only supported on specific StoneGate appliances
that have an integrated ADSL network interface card. ADSL Interfaces are not supported on
firewall clusters.
(page 349).
 To define an ADSL Interface

2. Right-click the empty space and select NewADSL Interface. The ADSL Interface
Illustration 27.3 ADSL Interface Properties
3. Define the ADSL Interface properties as explained in the table below.
Option Explanation
Select the number of the ADSL port on the appliance as the Interface ID. It
Interface ID automatically maps to the ADSL port on the engine’s ADSL card during the initial
configuration of the engine.

Option Explanation
Click Select for Service Provider and select your service provider from the list. The
ISP that you use for the ADSL line must support Ethernet over ATM as the
encapsulation method.
Service If your provider is not listed, create a new ISP element through the New icon at the
Provider top. Apart from the element name and country (which are only for your reference), you
must request the correct settings to use from your service provider. If the service
provider requires the use of PPPoE, you can enable PPPoE in the IP address
properties of the ADSL Interface (see Configuring PPPoE Settings for Single Firewalls
(page 354).
The MTU (maximum transmission unit) size on the connected link. Either type in a
value between 400-65535 or select a common MTU value from the list.
MTU
The default value (also the maximum standard MTU in Ethernet) is 1500. Do not set
(Optional)
a value larger than the standard MTU unless you know that all the devices along the
4. Click OK. The ADSL Interface is added to the interface list.
What’s Next?
 Configuring Single Firewall IP Addresses (page 351)
Related Tasks
 Configuring Advanced Interface Properties for Firewalls (page 349).
Configuring Advanced Interface Properties for Firewalls

Advanced settings allow you to configure SYN Flood Protection and Log Compression on the
interfaces. Log Compression is useful when the routing configuration generates a lot of
antispoofing logs or the number of Discard logs becomes high (for example, as a result of a SYN
flood attack).
The SYN Flood Protection and Log Compression settings in the interface properties override the
firewall’s general SYN Flood Protection and Log Compression settings that are defined on the
Advanced tab in the Firewall or Firewall Cluster properties. See Configuring Default SYN Flood
Protection for a Firewall (page 425) and Configuring Log Handling Settings (page 426).
 To configure advanced interface properties for firewalls

2. Right-click a Physical Interface (Interface...), a VLAN, or an ADSL Interface and select Edit
Physical Interface, Edit VLAN Interface, or Edit ADSL Interface. The properties dialog for
the interface opens.
3. Switch to the Advanced tab.

Illustration 27.4 Physical Interface/ VLAN Interface/ADSL Interface Properties - Advanced Tab
4. Select Override Firewall’s Default Settings. The options for SYN Flood Protection and Log
Compression are enabled.
5. Define the SYN Flood Protection Mode
Option Explanation
The interface uses the SYN Flood Protection settings defined on the Advanced tab in
Default the firewall properties (see Configuring Default SYN Flood Protection for a Firewall
(page 425).
Off SYN Flood Protection is disabled on the interface.
This is the recommended mode if you want to override the general SYN Flood
Protection settings defined in the firewall properties. The firewall automatically
Automatic
calculates the number of Allowed SYNs per Second and the Burst Size for the
interface based on the engine’s capacity and memory size.
Enter the desired values for Allowed SYNs per Second (the number of allowed SYN
packets per second) and Burst Size (the number of allowed SYNs before the firewall
starts limiting the SYN rate). We recommend that Burst Size be at least one tenth of
Custom
the Allowed SYNs per Second value. If Burst Size is too small, SYN Flood Protection
does not work. For example, if the value for Allowed SYNs per Second is 10000, the
Burst Size must be at least 1000.
Caution – The recommended values for the SYN Flood Settings depend on your network
environment. If the Custom settings are not carefully configured, the capacity of the
firewall engine may suffer or SYN Flood Protection may not work correctly.

6. (Optional) Enable/Disable Log Compression and enter the desired values for the
Antispoofing entries and (optionally) for Discard entries.
Option Explanation
Log Rate The maximum number of entries per second. The default value for antispoofing
(Entries/s) entries is 100 entries/s. By default, Discard log entries are not compressed.
The maximum number of matching entries in a single burst. The default value for
Burst Size
antispoofing entries is 1000 entries. By default, Discard log entries are not
(Entries)
compressed.
• Do not enable Log Compression if you want all the antispoofing and Discard entries to be
logged as separate log entries (for example, for reporting purposes or for firewall
statistics).
• By default, each generated Antispoofing and Discard log entry is logged separately and
displayed as a separate entry in the Logs view. Log Compression settings allow you to
define the maximum number of separately logged entries. When the defined limit is
reached, a single antispoofing log entry or Discard log entry is logged. The single entry
contains information on the total number of the generated Antispoofing log entries or
Discard log entries. After this, the logging returns to normal and all the generated entries
are once more logged and displayed separately.
7. Click OK.
What’s Next?
 Close the firewall’s Properties dialog and refresh the firewall’s policy to transfer the
configuration changes.
Configuring Single Firewall IP Addresses

The Physical Interfaces, VLAN Interfaces, and ADSL Interface of a single firewall can have one or
more static or dynamic IP addresses. Only IPv4 addresses are supported as dynamic IP
addresses. A Physical Interface can have multiple dynamic IP addresses only if you add VLAN
Interfaces on the Physical Interface and the VLAN Interfaces have dynamic IP addresses.
Otherwise, a Physical Interface can only have a single dynamic IP address. A Modem Interface
always has a dynamic IP address that is assigned automatically by a PPP daemon.
You may need to define a contact address if you enter a private static address and NAT is used
to translate it to a different external IP address. The external IP address must be configured
as the contact address if other StoneGate components need to use the external IP address to
contact this firewall or if the IP address is used as a VPN end-point. Only IPv4 addresses are
used in system communications. Refer to Defining Contact IP Addresses (page 62) for more
information.
What’s Next?
 To add an IPv4 address to a Physical Interface, VLAN interface, or an ADSL Interface,
proceed to Adding an IPv4 Address for a Single Firewall (page 352).
 To add an IPv6 address to a Physical or VLAN Interface, proceed to Adding an IPv6
Address for a Single Firewall (page 355).

Adding an IPv4 Address for a Single Firewall
 To add an IPv4 address for a single firewall
2. Right-click a Physical Interface or a VLAN Interface and select NewIPv4 Address, or right-
click an ADSL Interface and select NewIPv4 Address. The IP Address Properties dialog
opens.
Illustration 27.5 IPv4 Address Properties
3. Configure the IP address information:

• Enter the IPv4 Address and Netmask to define a static IP address.
• Select the Dynamic option (top right) and the DHCP index if the interface gets its IP
address from a DHCP server. The DHCP Index is an arbitrary number of your choice that
distinguishes different DHCP interfaces from one another.
4. If necessary, define the contact address information (see Defining Contact Addresses for a
Single Firewall or a Cluster Virtual IP Address (page 63) for detailed instructions).
• Enter the Default contact address or select Dynamic (next to the Default field) if the
interface has a dynamic contact address. The Default contact address is used by default
whenever a component that belongs to another Location connects to this interface.
• If components from some Locations cannot use the Default contact address, click
Exceptions to define Location-specific contact addresses.
5. (Optional) Configure additional features for this interface:
• (Static IP address only) If you want to use VRRP on the Physical Interface or VLAN
Interface, proceed to Configuring VRRP Settings for Single Firewalls (page 353).
• (Dynamic IP address only) If the interface requires PPPoE support, proceed to Configuring
PPPoE Settings for Single Firewalls (page 354).
6. Click OK.

7. Repeat from Step 2 to add further IP addresses to the same or other interface.
What’s Next?
 To add IPv6 addresses to a Physical Interface or VLAN Interface, proceed to Adding an
IPv6 Address for a Single Firewall (page 355).
 To define Modem Interfaces, proceed to Defining Modem Interfaces for Single Firewalls
(page 358).
 If you are creating a new firewall, or if you want to change the roles the different
interfaces have in the configuration, proceed to Setting Firewall Interface Options
(page 361).
 Otherwise, close the firewall’s Properties dialog and refresh the firewall’s policy to
transfer the configuration changes.
Related Tasks
 About Using a Dynamic IP Address on a Firewall Interface (page 362)
Configuring VRRP Settings for Single Firewalls

Virtual Router Redundancy Protocol (VRRP) allows high-availability router configurations. VRRP
support is only available on Physical Interfaces and VLAN Interfaces of single firewalls. One
virtual router can be configured per Physical Interface or VLAN Interface. The virtual router can
have either backup or active status. The virtual router configured for one interface does not take
into account the status of possible virtual routers configured on other interfaces.
Only IPv4 addresses can be used for VRRP.
 To set up VRRP
1. Click the VRRP Settings button in the IP Address properties. The VRRP Settings dialog
opens.
Illustration 27.6 VRRP Settings
2. Select Enable VRRP.

3. Enter the ID, Priority, and IPv4 Address according to the configuration of the virtual router.
4. Click OK to close the VRRP Settings dialog.

What’s Next?
 To add further IP addresses on the same or a different interface, repeat the steps in
Adding an IPv4 Address for a Single Firewall (page 352) or Adding an IPv6 Address for a
Single Firewall (page 355).
(page 358).
 If you are adding a new firewall, or if you want to change the roles the different
(page 361).
Configuring PPPoE Settings for Single Firewalls

Point-to-Point Protocol over Ethernet (PPPoE) support in StoneGate simplifies the installation of
a firewall appliance when PPPoE is used (usually for an ADSL Internet connection). Activating the
PPPoE client on the firewall allows connecting the firewall to an external ADSL modem without
having to configure routing and NAT settings on the ADSL modem (the modem is in transparent
bridge mode). You must activate the PPPoE client on the firewall also if you have a specific
firewall appliance that has an ADSL port and the ISP for the ADSL connection requires PPPoE.
The PPPoE client is supported only for IPv4 addresses on single firewalls.
 To configure the PPPoE client settings

1. Click the PPPoE Settings button in the IP Address properties. The PPPoE Settings dialog
opens.
Illustration 27.7 PPPoE Settings
2. Select Enable PPPoE.

3. Enter the User Name and Password, and optionally the Service Name, according to the
local PPPoE configuration, and deselect Hide if you want to view the Password in cleartext
in the dialog.
4. Click OK to close the PPPoE Settings dialog.

What’s Next?
 To add further IP addresses on a different interface, repeat the steps in Adding an IPv4
Address for a Single Firewall (page 352).
(page 358).
 If you are configuring a new firewall, or if you want to change the roles the different
(page 361).
Adding an IPv6 Address for a Single Firewall

IPv6 addresses are only supported on Physical Interfaces and VLAN Interfaces.
 To add an IPv6 address for a single firewall

2. Right-click a Physical Interface or a VLAN and select NewIPv6 Address. The Interface
Illustration 27.8 IPv6 Address Properties
3. Enter the IPv6 Address and the Prefix Length (0-128).

4. Click OK.

5. Repeat from Step 2 to add further IPv6 addresses to the same or other Physical or VLAN
Interface.
What’s Next?
(page 358).
 If you are creating a new firewall, or if you want to change the roles the different
(page 361).
Related Tasks
 Adding Routes for IPS Components (page 453)
 Adding an IPv4 Address for a Single Firewall (page 352)
Configuring Firewall Cluster IP Addresses

You can configure several IP addresses on each Physical Interface of a firewall cluster. Only IPv4
addresses are supported on firewall clusters.
When you add an IP address to a Physical Interface, you must also select the purpose of the IP
address. There are two types of IP addresses on firewall cluster interfaces:
• A Cluster Virtual IP Address (CVI) is a common IP address for all the nodes in the cluster. It is
used for handling all of the general network traffic (traffic you want to filter with the firewall)
routed from/to the cluster.
• A Node Dedicated IP Address (NDI) is for handling traffic that is originating from or destined to
a node in the cluster (for example, for the heartbeat connections between the nodes). Each
node has a unique IP address that is used as the Node Dedicated IP Address.
You may also need to define a contact address if the Cluster Virtual IP Address or Node
Dedicated IP Address is private and NAT is used to translate the IP address to a different
external IP address. The external IP address must be configured as the contact address if
other StoneGate components need to use the external IP address to contact this firewall
(Node Dedicated IP Address) or if this IP address is a VPN end-point (Cluster Virtual IP
Address). Refer to Defining Contact IP Addresses (page 62) for more information and
configuration instructions for all components.
What’s Next?
 Adding IPv4 Addresses for a Firewall Cluster (page 357)

Adding IPv4 Addresses for a Firewall Cluster
 To add IPv4 addresses for a firewall cluster
2. Right-click a Physical interface or a VLAN and select NewIPv4 Address or New IPv4
Address. The IP Address Properties dialog opens.
Illustration 27.9 Cluster IP Address Properties
3. Select the types of IP addresses that you want to add using the Cluster Virtual IP Address
and Node Dedicated IP Address options. By default, both are selected.
• If the interface does not receive or send traffic that the firewall examines, there is no
need to define a Cluster Virtual IP Address.
• We recommend that you add a Node Dedicated IP Address for each (sub)network that is
located behind the physical interface.
4. If you are adding a Cluster Virtual IP Address, enter the IPv4 Address that is used as the
Cluster Virtual IP Address.
5. If you are adding a Node Dedicated IP Address for the nodes, set the IPv4 Address for each
node by double-clicking the field.
6. Check the automatically filled-in Netmask and adjust it as necessary.
7. If necessary, define the contact address(es) for the Cluster Virtual IP Address (see Defining
Contact Addresses for a Single Firewall or a Cluster Virtual IP Address (page 63) for
detailed instructions):
• Enter the Default contact address or select Dynamic if the interface has a dynamic
default contact address. The default contact address is used by default whenever a
component that belongs to another Location connects to this interface.
• If components from some Locations cannot use the Default contact address, click
Exceptions to define Location-specific contact addresses.
8. If necessary, define the IP contact address for each node in the Node Dedicated IP Address
table by double-clicking the Contact Address cell. The Exceptions dialog opens (see

Defining Contact Addresses for Node Dedicated IP Addresses (page 65) for detailed
instructions).
• Enter the Default contact address at the top of the dialog. The Default contact address is
interface.
• If components from some Locations cannot use the Default contact address, click Add to
define Location-specific contact addresses.
9. Click OK.
10.Repeat from Step 2 to add further IPv4 addresses to the same or other interface.
What’s Next?
(page 361).
Related Tasks
 Configuring Single Firewall IP Addresses (page 351)
Defining Modem Interfaces for Single Firewalls

A Modem Interface defines the settings of a 3G modem that provides a wireless outbound link
for a Single Firewall. The numbering of a Modem Interface in the Management Client (the
modem number) is mapped to the modem’s IMEI (international mobile equipment identity)
number, and each modem is assigned a unique ID when you connect the modem to the engine.
You can change the mapping between the modem’s IMEI number and the modem ID through the
engine command line, if necessary.
 To define a Modem Interface

2. Right-click the empty space and select NewModem Interface. The Modem Interface

Illustration 27.10 Modem Interface Properties
3. Define the basic Modem Interface properties as explained in the table below.
Option Explanation
Modem
Select the Modem Number to represent the modem in the configuration.
Number
Select the DHCP Index. It is an arbitrary number of your choice that distinguishes
DHCP Index
different DHCP Interfaces from one another.
Enter the PIN code if it is needed for the modem’s SIM card.
PIN Code If the PIN code is included in the configuration and you change the 3G modem’s SIM
(Optional) card after configuring the firewall, you must change the PIN code as described in
Changing/Removing the PIN Code of a Modem Interface (page 360).
Phone Number
Enter the modem’s Phone Number if it differs from the default phone number.
(Optional)
4. Enter the rest of the information (Access Point Name, Username and Password, and
Service Name) according to the instructions that you have received from your service
provider.

5. Click OK.
What’s Next?
(page 361).
 Otherwise, close the firewall’s Properties dialog and adjust the routing configuration as
necessary as explained in Adding Routes for Firewalls (page 441).
Related Tasks
 Changing/Removing the PIN Code of a Modem Interface (page 360)
Changing/Removing the PIN Code of a Modem Interface

If you change the SIM card of a 3G modem that is connected to a single firewall and the PIN
code is enabled on the new SIM card, you must change the PIN code information on the related
Modem Interface. You must remove the PIN code if the PIN code was enabled on the old SIM
card but the PIN code is not enabled on the new SIM card.
You must also change the PIN code if you have received the message “PIN code differs from
initial contact settings” at policy installation after you have finished configuring the firewall. This
message means that the PIN code in the Modem Interface properties does not match the PIN
code that you have entered for the 3G modem in the engine’s command line interface. If there
are other problems with the PIN code, you can check through the engine’s command line
interface the PIN code used in the initial configuration and change the PIN code information if
necessary.
 To change or remove the PIN code of a modem interface

1. Run the sg-reconfigure tool on the command line and change the 3G modem’s PIN code
information in the engine’s command line interface. See the Firewall Installation Guide for
more information.
2. Open the properties of the single firewall in the Management Client and switch to the
Interfaces tab.
3. Right-click the Modem Interface and select Properties. The Modem Interface Properties
dialog opens.
4. Change the PIN code information and click OK.
What’s Next?
Related Tasks
 Defining Modem Interfaces for Single Firewalls (page 358)

Setting Firewall Interface Options
The Interface Options dialog contains the settings for selecting which IP addresses are used in
particular roles in system communications (for example, in communications between the firewall
and the Management Server). Only IPv4 addresses are used in system communications.
 To set the interface options

2. Click Options. The Interface Options dialog opens.
Illustration 27.11 Firewall Cluster Interface Options
3. Select the interface options as explained in the table below.
Option Explanation
Select the Primary Control Interface for Management Server contact. This
interface is used for communications with the Management Server
Control Interface
(Optional) Select a Backup Control Interface that is used if the Primary
interface is not available.
Select the Node-Initiated contact to Management Server option if the

firewall is behind a device that applies dynamic NAT to the inbound
management connections or blocks them.
This option is always used with a dynamic control IP address, so it is always
Node-Initiated contact
fixed to the selected state if the IP address is dynamic.
to Management Server
(Single Firewalls only) When this option is selected, the engine opens a connection to the
Management Server and maintains connectivity.
If the connection is not open when you command the engine through the
Management Client, the command is left pending until the engine opens the
connection again.

Option Explanation
Select the Primary Heartbeat Interface for communications between the
nodes. We recommend that you use a Physical Interface, not a VLAN
Interface. We strongly recommend that you do not direct any other traffic
through this interface. A dedicated network helps ensure reliable and
secure operation.
Caution! Primary and Backup Heartbeat networks exchange confidential
information. If dedicated networks are not possible, configure the cluster to
encrypt the exchanged information. See Adjusting General Clustering
Options (page 419).
Heartbeat Interface
(Firewall Clusters only) Select a Backup Heartbeat Interface that is used if the Primary Heartbeat
Interface is unavailable. It is not mandatory to configure a backup
heartbeat, but we strongly recommend it. If heartbeat traffic is not
delivered, the cluster cannot operate and traffic will be disturbed. We
strongly recommend that you use a dedicated interface for the backup
heartbeat as well.
Caution! Primary and Backup Heartbeat networks exchange confidential
information. If dedicated networks are not possible, configure the cluster to
encrypt the exchanged information. See Adjusting General Clustering
Options (page 419).
The IP address of the selected interface is used when an engine contacts

an external authentication server and it is also displayed (by default) to end-
Identity for users in Telnet-based authentication.
Authentication
This option does not affect the routing of the connection with the
Requests
authentication server. The IP address is used only as a parameter inside
the authentication request payload to give a name to the request sender.
This option defines the IP address that the nodes use if they have to initiate
Default IP for Outgoing
connections (system communications, ping, etc.) through an interface that
Traffic
has no Node Dedicated IP Address. You must select an interface that has
(Firewall Clusters only) an IP address defined for all nodes.
4. Click OK.
What’s Next?
 If this is a new firewall, close the Firewall Properties dialog. Configure the routing as
explained in Adding Routes for Firewalls (page 441), and initialize the engines as
explained in Saving an Initial Configuration for Firewall or IPS Engines (page 393).
About Using a Dynamic IP Address on a Firewall Interface

You can set up a single firewall to receive its IPv4 address through DHCP. Only dynamic IPv4
addresses are supported. Typically, the dynamic address is assigned by the ISP’s DHCP service.
Modem Interfaces always have dynamic IP addresses that are provided through PPPoE (see
Defining Modem Interfaces for Single Firewalls (page 358)).

Since the dynamic IP address assignment includes the next-hop gateway address, the routing
for interfaces with a dynamic address is defined using special dynamic Router and NetLink
elements. See Adding Routes for Firewalls (page 441).
Dynamic addresses affect system communications: if the address the engine uses for system
communications is dynamic, the engine opens a communications channel to the Management
Server and the Management Server never attempts to contact the engine outside this
connection. Any commands given when the connection is unavailable are left pending on the
Management Server until the engine opens the connection.
Dynamic IPv4 addresses also affect VPNs: other VPN gateways cannot open VPN connections to
the gateway if the address is dynamic. Instead, the gateway with the dynamic end-point must
always initiate the VPN, after which the VPN can be used normally in both directions.
If the management traffic flows through an interface that has a dynamic address, you can adjust
timeouts and other settings related to these communications on the Advanced tab in the Single
Firewall element’s properties (see Adjusting Single Firewall’s Contact Policy (page 423)).
There are default Alias elements in the system that can be used in the firewall’s policy to
represent its own dynamic addresses. These elements are distinguished from each other by the
DHCP index number in their name. For each dynamic address interface there are four 4 Alias
elements (X = the selected DHCP index):
• $$ DHCP Interface X.ip: the current dynamic IP address allocated to this interface.
• $$ DHCP Interface X.gateways: the received IP address for the default router.
• $$ DHCP Interface X.dns: the received IP address of the DNS server.
• $$ DHCP Interface X.net: the network behind the dynamic interface.
Note – These Aliases are meant for use in the policies of the firewall that has the dynamic
IP address. They are translated to the values of the firewall the policy is installed on, so
they cannot be used in the policies of other components.
Changing ISP Settings for ADSL Interface

You can usually change all the settings related to the ADSL interface of a single firewall directly
through the Management Client. However, if you use the ADSL interface as the management
interface, and you need to modify the Virtual Path ID (VPID) and Virtual Channel ID (VCID)
settings of the ISP that provides the ADSL connection, you cannot change the settings directly
through the Management Client. You must instead complete the following steps. Otherwise, the
firewall engine may lose the management connection and roll back to the previously installed
policy.
Note – If the ADSL Interface is not the management interface, you can change all the ISP
settings for the ADSL Interface directly through the Management Client.
 To change the VPID and VCID settings for ADSL interface

1. Run the sg-reconfigure tool on the command line and change the VPID and VCID settings
in the engine’s command line interface. See the Appliance Installation Guide for the firewall
appliance for more information.
2. Open the properties of the single firewall in the Management Client and switch to the
Interfaces tab.

3. Right-click the ADSL Interface and select Edit. The ADSL Interface Properties dialog opens.
4. Right-click the Service Provider information and select Properties. The Properties dialog
for the service provider opens.
5. Modify the Virtual Path ID (VPID) and Virtual Channel ID (VCID) settings as instructed by
your service provider.
• Apart from the element name and country (which are only for your reference), you must
request the correct ISP settings to use from your service provider.
6. Click OK.
What’s Next?
SOHO Firewall Interface Configuration

Prerequisites: Creating One New SOHO Firewall Element / Creating Multiple New SOHO Firewall Elements
In the interface configuration for SOHO firewalls, you select the intended use for each physical
interface, define the correct IP address settings per interface type, and optionally activate
wireless LAN for internal and/or visitor access. Only IPv4 addresses are supported on SOHO
Firewalls.
What’s Next?
 If you are creating new SOHO firewalls, proceed to Selecting SOHO Firewall Interface
Types (page 364).
 See the links below if you are editing a previously created element.
Related Tasks
 Defining External Interfaces for SOHO Firewalls (page 366)
 Defining Corporate Interfaces for SOHO Firewalls (page 370)
 Defining Guest Interfaces for SOHO Firewalls (page 372)
 Defining Wireless Settings for SOHO Firewalls (page 373)
Selecting SOHO Firewall Interface Types

The interface type definitions allocate the LAN ports, define what kinds of traffic is allowed to/
from the interfaces, and how the allowed traffic is routed.
A minimum configuration comprises an interface for Internet access (External). All of the other
interfaces can be disabled if necessary.
 To select the interface types

1. Open the properties of the SOHO Firewall element.

Illustration 27.12 SOHO Firewall Properties - General Tab
2. Select the External interface using the radio button: either ADSL or one of the Ethernet
interfaces. You can have only one external interface: Multi-Link is not supported on SOHO
Firewalls.
• We recommend that you do not designate Interface 1 as External. The External interface
does not allows incoming connections, and the local Web-based administration interface
is accessed through this port. Access to this interface may sometimes help in
troubleshooting and correcting problems.
3. Click the Mode column to select the correct interface mode for the other interfaces.
• A Corporate interface is for internal protected hosts. You must have at least one
Corporate interface. Corporate interfaces allow connections to/from the VPN and local
traffic to/from the other Corporate interfaces. Direct Internet access (outgoing
connections only) can be enabled and disabled as required.
• A Guest interface provides direct Internet access (outgoing connections only). It is not
mandatory to define any Guest interfaces.
• You can also allow wireless access through a Corporate or Guest interface without
allocating a physical interface for this purpose on the appliance. In that case, do not
select the Corporate or Guest mode for any interface.
• You can also mark an interface as Disabled if you do not want to provide any access
through it.
What’s Next?
 If you are creating one or more new SOHO Firewall elements, proceed to Defining
External Interfaces for SOHO Firewalls (page 366).
 If you are finished editing the properties of a SOHO Firewall element that has been
created earlier, click OK. Remember to apply the configuration changes through the
engine’s right-click menu.
SOHO Firewall Interface Configuration 365

Defining External Interfaces for SOHO Firewalls
The External interface is used for traffic to the Internet and is thus also the end-point for VPN
communications. The External interface does not allow any other incoming connections except
VPN connections to the network behind the Corporate interfaces.
The SOHO Firewall has a built-in ADSL modem that you can use, or you can attach one of the
Ethernet ports to an external modem. If the external modem is in transparent bridge mode,
PPPoE can be activated on the SOHO firewall so that it can communicate with the ISP
equipment.
The external connection can also be a standard Ethernet connection, for example, if the SOHO
firewall is connected to an ADSL router that is set up to maintain the ADSL connectivity
independently.
The options on the External tab depend on what type of configuration you select for the External
interface.
What’s Next?
 If your External interface is one of the Ethernet ports, proceed to Defining Ethernet
External Interface Properties on SOHO Firewalls (page 366).
 If you External interface is the ADSL port or an Ethernet port that uses PPPoE, proceed
to Defining ADSL or PPPoE Interface Properties on SOHO Firewalls (page 367).
Defining Ethernet External Interface Properties on SOHO Firewalls

 To configure IP address settings for the External interface
1. Open the properties of the SOHO firewall and switch to the External tab.
Illustration 27.13 SOHO Firewall Properties - External Tab with a Static IP Address
2. Select the Configuration for the IP address:

• Select DHCP for normal dynamic IP address and proceed to Step 5.
• Select Static for a static IP address.
• For PPP over Ethernet, see Defining ADSL or PPPoE Interface Properties on SOHO
Firewalls (page 367).
3. (Static IP address only) Enter the IP Address for the SOHO firewall and the associated
Netmask. This setting is not available in the Create Multiple SOHO Firewalls wizard.

4. (Static IP address only) Click Select for Gateway and select the correct Router element for
the default gateway. This setting is not available in the Create Multiple SOHO Firewalls
wizard.
• You can add a new Router element to the list through the New icon at the top of the dialog
that opens.
5. (Optional) If you want to set a specific maximum packet size (MTU), select Manual and type
in the MTU.
• The maximum standard MTU in Ethernet is 1500.
• In Automatic mode, the MTU is detected dynamically based on fragmentation-related
ICMP messages.
6. (Optional) Select the Static DNS settings:
• If the Static DNS option is disabled, the DNS requests are handled according to the local
network configuration.
• If you want to define the DNS servers yourself, select at least a primary DNS server. You
can optionally add a secondary DNS server according to your needs. If you have not
defined the External DNS Server element(s) required, you can create them through the
New icon in the Select Element dialog. Enter a Name and an IP Address for the External
DNS Server element(s).
• The DNS settings defined on the External tab are used by default for all the SOHO
interfaces (External, Corporate, and Guest interfaces). However, you can alternatively
define DNS settings separately for the Corporate interface on the Corporate tab.
What’s Next?
 If you are creating one or more new SOHO Firewall elements, continue by Defining
Corporate Interfaces for SOHO Firewalls (page 370).
Defining ADSL or PPPoE Interface Properties on SOHO Firewalls

The ADSL settings are identical regardless of whether the ADSL connection is direct or through
PPPoE. Some Internet service providers require a username and password, which can be
entered in the configuration on the Management Server or directly through the SOHO Firewalls’
Web interface during the initial setup of the appliance.
When you create multiple SOHO Firewalls simultaneously using the wizard, you cannot enter the
username and password information. Enter the information in the properties of each SOHO
Firewall element after they have been created or during the initial configuration of the
appliances.
 To configure ADSL Settings

1. Open the properties of the SOHO firewall and switch to the External tab.
2. If you are configuring a PPPoE interface, select PPPoE over Ethernet as the Configuration.

Illustration 27.14 SOHO Firewall Properties - External Tab for ADSL
3. Click Select for Service Provider and select your service provider from the list.
• If your provider is not listed, first create a new ISP element through the New icon at the
top.
• Apart from the element name and country (which are only for your reference), you must
request the correct settings to use from your service provider.
4. (Optional) Enter the Username and Password for ADSL access if your ISP has provided
these. Use the Hide option to prevent the Password from being displayed in cleartext in the
SOHO firewall properties.
• If the details are required, but not available yet, you can amend this information later
when installing and initializing the SOHO appliance.
defined the External DNS Server element(s) required, you can create them through the
New icon in the Select Element dialog. Enter a Name and an IP Address for the External
DNS Server element(s).
What’s Next?
Advanced ADSL Settings for SOHO Firewalls (page 368).
Defining Advanced ADSL Settings for SOHO Firewalls

Advanced ADSL settings provide options related to establishing ADSL connections. The default
settings work well in most installations, but we recommend that you still check these options
following the instructions below.

 To define advanced ADSL settings
1. Open the properties of the SOHO Firewall and switch to the External tab.
Illustration 27.15 SOHO Firewall Properties - External Tab - Advanced ADSL Settings
2. Click Advanced ADSL Settings. The advanced settings appear.

3. Define the Advanced ADSL Settings (including the authentication protocol for authenticating
the SOHO firewall for ADSL connections is username and password are used) as explained
in the table below.
Options Explanation
Password Authentication Protocol: if a password is
PAP
used, it is transferred in unencrypted form.
Challenge Handshake Authentication Protocol: if a

CHAP password is used, it is transferred in encrypted
form.
PPP Authentication
PAP/CHAP CHAP is primarily used, but also PAP may be used.
(Only if username/
password are used) Microsoft Challenge Handshake Authentication
MS-CHAPv1
Protocol: only MS-CHAPv1 is used.
CHAP is primarily used. MS-CHAPv1 or MS-CHAPv2

PAP/CHAP/MS-CHAP
may also be used.
MS-CHAPv2 Only MS-CHAPv2 is used.
Enter the length of the wait time before a new

attempt is made to connect to the gateway after a
Block After Connection Failure for
connection has failed. The default wait time is 60
seconds.

Options Explanation
If the option is enabled, the SOHO Firewall initiates
DNS negotiations and the IP addresses of the DNS
server(s) are received from the service provider.
DNS Negotiation
If the option is disabled, the static DNS server
configuration (defined below the ADSL settings) is
used.
If the option is enabled, TCP downloads are favored

Prioritize TCP/ACK Packets
over TCP uploads.
If the option is enabled, LCP echo requests are sent

LCP/Alive Check to the service provider to check the availability of the
service.

defined the External DNS Server elements required, you can create them through the New
icon in the Select Element dialog. You only need to enter a Name and an IP Address for
the External DNS Server elements.
What’s Next?
Corporate Interfaces for SOHO Firewalls (page 370).
Defining Corporate Interfaces for SOHO Firewalls

There is no separation between the networks behind the different Corporate interfaces; they are
treated as a single network. The SOHO firewall can have only one IP address for the Corporate
network, no matter how many of the ports are used for Corporate access.
The SOHO Firewall can establish a VPN with a StoneGate Firewall/VPN gateway to allow
connections between the network behind the Corporate interface(s) and the internal networks at
a central site. A SOHO Gateway Group element is used to represent one or more SOHO firewall
engines in the VPN. When you create a SOHO Firewall element, you must select in which SOHO
Gateway Group it is included. For more information on configuring VPNs, see Configuring IPsec
VPNs (page 715).
You can allow wireless access through a Corporate interface without allocating any physical
interface for this purpose on the appliance. In that case, do not select the Corporate mode for
any interface on the General tab (see Selecting SOHO Firewall Interface Types (page 364)).

If you want to add wireless settings to an otherwise configured interface, see Defining Wireless
Settings for SOHO Firewalls (page 373).
 To define Corporate interfaces

1. Open the properties of the SOHO Firewall and switch to the Corporate tab.
Illustration 27.16 SOHO Firewall Properties - Corporate Tab
2. Enter the Local IP Address and Netmask of the SOHO Firewall in the Corporate network. If
you are creating multiple SOHO Firewalls using the wizard, you cannot enter the local IP
address information here, because these IP addresses are defined on the first screen of
the wizard (click Previous to view the information for the various SOHO Firewall elements).
3. (Optional) Click Select for SOHO Gateway Group and choose the correct SOHO Gateway
Group element. You can create a new element using the New button at the top of the dialog
if there is no suitable SOHO Gateway Group element (see Defining Security Gateways
(page 720) for more details).
4. Check the Pre-Shared Key used for the VPN.
• You can use the pre-shared key provided automatically in the Pre-Shared Key field,
manually enter a different pre-shared key, or click Generate to create a new pre-shared
key automatically.
• Enable/disable the Hide option to define if the Pre-Shared Key is displayed in cleartext in
the SOHO Firewall properties.
Caution – The pre-shared key must be long and random to provide a secure VPN. Change
the pre-shared key periodically (for example, monthly). Make sure that it is not possible for
outsiders to obtain the key.

5. (Optional) Select the Keep-alive VPN tunnel option if you want the SOHO firewall to keep
the VPN tunnels to the central site open even when there is no traffic. This allows two-way
connection opening through the VPN even if the SOHO firewall has a dynamic IP address,
which prevents tunnels from being opened from the central site to the SOHO firewall.
6. If you want the SOHO Firewall to act as a DHCP server for the internal network, select
DHCP Service and fill in the address range for distributing IP addresses. If you are creating
multiple SOHO Firewalls using the wizard, you cannot enter the IP address information here,
because these IP address ranges are defined on the first screen of the wizard (click
Previous to view the information for the various SOHO Firewall elements).
7. (Optional) Select the DNS Server settings:
• By default, the SOHO Firewall uses the DNS server settings defined on the External tab
for all its interfaces. If the Static DNS option is disabled on the External tab, the DNS
requests are handled according to the local network configuration.
• You can alternatively define the DNS servers separately for the Corporate interface. If you
want to use the DNS settings from the local (ISP) DNS servers as the first choice, leave
the Corporate Primary DNS Server field to its default value. Otherwise, click Select for
at least the Corporate Primary DNS Server and choose the correct External DNS Server
element. If you have not defined the External DNS Server element(s) required, you can
create them through the New icon in the Select Element dialog. You only need to enter a
Name and an IP Address for the External DNS Server elements.
8. (Optional) Under Security Policy (below the wireless settings), select Allow Only Traffic to
VPN if you want to prevent the hosts in the Corporate network from opening direct
connections to the Internet (incoming connections from the Internet are not allowed in
either case). This allows either preventing Internet connections altogether or routing the
connections through a central location, for example, to utilize content screening available
at the central location.
What’s Next?
 If you are creating one or more new SOHO Firewall elements that have a Guest interface
configured, proceed to Defining Guest Interfaces for SOHO Firewalls (page 372).
 Otherwise, if you want to configure wireless access with the Corporate interface access
policy, proceed to Defining Wireless Security Settings for SOHO Firewalls (page 374).
 Otherwise, if you are creating one or more new SOHO Firewall elements, proceed to
Completing the SOHO Firewall Configuration (page 376), or Completing the “Create
Multiple SOHO Firewalls” Wizard (page 376).
Defining Guest Interfaces for SOHO Firewalls

Guest interfaces are optional. They are meant for allowing visitors access to the Internet. Guest
interfaces allow only connections from the Guest interface to the Internet; they do not allow
incoming connections from the Internet, connections to/from the Corporate interface(s), nor
connections to/from the VPN.
You can allow wireless access through a Guest interface without allocating any physical
interface for this purpose on the appliance. In that case, do not select the Guest mode for any
interface on the General tab (see Selecting SOHO Firewall Interface Types (page 364)).

If you want to add wireless settings to an otherwise configured interface, see Defining Wireless
Settings for SOHO Firewalls (page 373).
 To define Guest interfaces

1. Open the properties of the SOHO Firewall and switch to the Guest tab.
Illustration 27.17 SOHO Firewall Properties - Guest Tab
2. Enter the Local IP Address of the SOHO firewall in the Guest network and the Netmask.
3. If you want the SOHO Firewall to act as a DHCP server for the Guest network, select DHCP
Service and fill in the address range for distributing IP addresses.
What’s Next?
 If you want to set or change settings for wireless access, proceed to Defining Wireless
Security Settings for SOHO Firewalls (page 374).
 Otherwise, if you are creating one or more new SOHO Firewall elements, proceed to
Completing the SOHO Firewall Configuration (page 376), or Completing the “Create
Multiple SOHO Firewalls” Wizard (page 376).
Defining Wireless Settings for SOHO Firewalls

You can allow wireless access to the Corporate network, the VPN, and the Internet through a
Corporate interface and to the Internet through a Guest interface. Both access profiles can be
active at the same time and you can define different wireless security settings for the Corporate
and Guest interfaces.
What’s Next?
 Start by Defining Wireless Security Settings for SOHO Firewalls (page 374).
Related Tasks
 Defining Wireless Channel Settings for SOHO Firewalls (page 375)

Defining Wireless Security Settings for SOHO Firewalls
Wireless security settings are defined separately for Corporate and Guest interface profiles, but
the options available are identical and therefore explained here together.
 To define security settings for wireless access

1. Open the properties of the SOHO Firewall and switch to the Corporate or Guest tab.
2. Select Wireless. The options for wireless connections are enabled.
3. Define the Wireless Network Name (SSID) settings as explained in the table below.
Options Explanation
Enter the Wireless Network Name (SSID). This identifies the
Wireless Network Name (SSID) network to the end-users. Note that the name can be easily read by
anyone within range.
End-users (and anyone else in range) can see the Wireless Network
Enabled Name (SSID) in their list of available networks without further
action.
Wireless SSID The end-users have to type in the Wireless Network Name (SSID) to
Broadcast connect.
Disabled Even if you disable SSID broadcast, anyone within range can easily
discover your wireless network with detection tools widely available
on the Internet.
4. Select the Security Mode. When you select the security mode, the options particular for
that mode are enabled below. We recommend using one of the WPA security modes,
especially for Corporate access.
Option Explanation
Wireless traffic is not encrypted. Anyone within range can freely use this wireless
Disabled
network. We do not recommend using this setting.
Wireless traffic is encrypted with a 40-bit key using the WEP protocol. We do not
WEP 40 recommend using this setting, unless it is necessary to do so for compatibility
reasons.
Wireless traffic is encrypted with a 104-bit key using the WEP protocol. If you
WEP 104
cannot use WPA for compatibility reasons, we recommend you select this setting.
Wireless traffic is encrypted using the WPA or WPA2 protocol. Two modes are
WPA-PSK available for WPA. The WPA mode uses TKIP encryption and the WPA2 mode
uses AES Encryption. WPA2 is the more secure mode.
Same as above, but an external RADIUS server is used to authenticate the users.
WPA Enterprise This is the most secure option offered, and is recommended for Corporate
access if an external RADIUS service is available.
• For more information on the Security modes and their options, see the Firewall/VPN
Reference Guide.

5. Fill in the options for the selected security mode
• For WEP, select the Default Key and enter 1 to 4 encryption keys. WEP 40 requires 5-
character keys, WEP 104 requires 13-character keys.
• For WPA-PSK, select the WPA Mode and enter a Pre-Shared Key of 8 to 64 ASCII
characters.
• For WPA Enterprise, select the WPA Mode and click Select to choose the RADIUS Server
that authenticates the users (see Defining an Authentication Server (page 635) for more
information).
If you want to configure wireless access for both the Corporate and Guest profiles, configure the
settings on both tabs as explained above.
What’s Next?
 Continue by Defining Wireless Channel Settings for SOHO Firewalls (page 375).
Defining Wireless Channel Settings for SOHO Firewalls

The Wireless Channel settings are used for both Corporate and Guest access.
 To define general wireless settings

1. Open the properties of the SOHO Firewall and switch to the Wireless Channel tab.
Illustration 27.18 SOHO Firewall Properties - Wireless Channel Tab
2. Select the Usage Area according to where your users will be. This affects how the signal is
transmitted and affects signal quality. Note that this is not a security measure and
selecting the Indoor option alone cannot prevent the signal from escaping outside.
3. Select the Channel. If there are other wireless access points nearby, use channels that are
as far apart as possible to avoid interference.
4. Select the Transmit Power for the signal. Selecting the correct transmit power may require
some experimentation on location. Setting the transmit power lower reduces the
possibilities for unauthorized access and eavesdropping and may alleviate issues of
interference between access points.

5. Select the Wireless Mode according to the capabilities of the connecting clients.
• 802 11b: 11 Mbit wireless-b only mode.
• 802 11g: 54 Mbit wireless-g only mode.
• 802 11 mixed: wireless-b/g mixed mode with short preamble (same as below).
• 802 11 mixed short: same as above.
• 802 11 mixed long: wireless-b/g mixed mode with long preamble.
What’s Next?
 If you are creating one or more new SOHO Firewall elements, proceed to Completing the
SOHO Firewall Configuration (page 376), or Completing the “Create Multiple SOHO
Firewalls” Wizard (page 376).
Completing the SOHO Firewall Configuration

The procedure outlined below is for creating a single SOHO Firewall element. If you are creating
several SOHO Firewalls simultaneously, see Completing the “Create Multiple SOHO Firewalls”
Wizard (page 376).
 To complete the SOHO Firewall configuration

1. (Optional) Switch to the Permissions tab to add the SOHO Firewall element on a custom
Access Control List you have created and to give individual administrators permissions to
this element.
• By default, SOHO Firewalls belong to an Access Control List called ALL SOHO Firewalls
(in addition to ALL Elements).
• See Getting Started with Administrator Accounts (page 214) for more information on
administrator permissions.
2. Click OK.
What’s Next?
 If you want to offer VPN connectivity right after importing the configuration, configure the
VPN between a central site and the SOHO firewalls first. See Getting Started With IPsec
VPNs (page 716).
 Otherwise, connect the SOHO firewall engine to the Management Server. See Saving an
Initial Configuration for SOHO Firewall Engines (page 395).
Completing the “Create Multiple SOHO Firewalls” Wizard

After configuring the interfaces, you are ready to continue onwards in the wizard.
 To complete multiple SOHO firewalls’ configuration

1. Click Next. A summary page with details of the new elements is displayed.
2. Check the information and click Create to add the elements to your system.

3. Double-click one of the newly created elements and complete its configuration:
• If you selected a static IP address for the External interface, you must enter the IP
address and the default gateway for each individual SOHO Firewall (see Defining External
Interfaces for SOHO Firewalls (page 366)).
• If your ISP requires a username and password, you can enter the information now or
through the local SOHO Firewall Web interface when you install the appliance (see
Defining External Interfaces for SOHO Firewalls (page 366)).
• (Optional) Switch to the Permissions tab to add the SOHO Firewall element on a custom
Access Control List you have created and to give individual administrators permissions to
this element (see Completing the SOHO Firewall Configuration (page 376)). By default,
SOHO Firewalls belong to an Access Control List called ALL SOHO Firewalls (in addition
to ALL Elements).
4. Click OK. Repeat from Step 3 to complete the configuration of each created element.
What’s Next?
 If you want to offer VPN connectivity right after importing the configuration, configure the
VPN between a central site and the SOHO firewalls first. See Getting Started With IPsec
VPNs (page 716).
 Otherwise, connect the SOHO firewall engines to the Management Server. See Saving
an Initial Configuration for SOHO Firewall Engines (page 395).
Sensor and Analyzer Interface Configuration

The interface configuration for StoneGate IPS consists of defining the required number of
Physical Interfaces, adding the required number of VLANs (if any), and adding IP addresses or a
traffic inspection role to the interface. IP addresses are required for interfaces that are used for
system communications. The interfaces that have a traffic inspection role work transparently in
the network and do not have IP addresses.
A Physical Interface element is used to activate a network port on the IPS engine. By default, the
numbering of the Physical Interfaces in the Management Client corresponds to the operating
system interface numbering on the engine (that is, Interface ID 0 is mapped to eth0, ID 1 to
eth1, etc.). However, the mapping is not fixed and you can change it through the engine
command line.
Before changing the sensor and analyzer interface configuration, we recommend making a
backup of the Management Server. See Creating Backups (page 795) for more information.
What’s Next?
 Start by Defining System Communication Interfaces for IPS Engines (page 378).
Related Tasks
 Defining Traffic Inspection Interfaces for Sensors (page 379)
 Setting Interface Options for IPS Engines (page 385)
Sensor and Analyzer Interface Configuration 377

Defining System Communication Interfaces for IPS Engines
Each IPS engine needs at least one interface for communicating with other system components.
You can define more than one system communication interface if it is necessary in your network
environment.
 To define a system communication interface for IPS engines

1. Open the properties of the IPS engine and switch to the Interfaces tab.
2. Right-click the empty space and select New Physical Interface. The Physical Interface
Illustration 27.19 Physical Interface Properties
3. Select an Interface ID. It automatically maps to a physical interface of the same number
during the initial configuration of the engine, but the mapping can be changed as necessary
4. (Not applicable to Analyzers) Select Normal Interface as the interface Type.
5. Click OK. The physical interface is added to the interface list.
6. (Not applicable to Analyzers) If the system communications must use a particular VLAN on
the directly connected network segment:
6a. Right-click the Physical Interface you just added and select NewVLAN Interface. The
VLAN Interface Properties dialog opens.
6b. Type in the correct VLAN ID (1-4094) and click OK.
7. Right-click the Physical Interface or VLAN you just added and select NewIPv4 Address or
NewIPv4 Address. The IP Address Properties dialog opens.
8. Double-click the IPv4 Address cell in the table and enter the IP address. Repeat for each
node if this is a Sensor Cluster element.
9. If necessary, define the contact address for the interface or for each node if this is a
Sensor cluster element by double-clicking the Contact Address cell. The Exceptions dialog
opens (see Defining Contact Addresses for an IPS Engine (page 66) for detailed
instructions).
• Enter the Default contact address at the top of the dialog. The Default contact address is
interface.
• II components from some Locations cannot use the Default contact address, click Add to
define Location-specific contact addresses.
10.Click OK to close the IP Address Properties dialog.

11.Repeat the steps above as necessary to add more Physical Interfaces, or more VLANs and/
or IP addresses to the same Physical Interface.
What’s Next?
 If you are defining a new Sensor element, proceed to Defining Traffic Inspection
Interfaces for Sensors (page 379).
 If you are defining an Analyzer element or editing an existing Sensor element, proceed
to Setting Interface Options for IPS Engines (page 385).
Defining Traffic Inspection Interfaces for Sensors

In StoneGate IPS, sensors are the components that pick up traffic from the network for
inspection. The sensor can be installed either in an IDS-like configuration in which the traffic is
only captured for inspection (by the way of mirroring) or in a full IPS configuration where the
sensor is installed inline, directly on the traffic path so that traffic must always pass through the
sensor to reach its destination. Only traffic that attempts to pass through Inline Interfaces can
be actively filtered. However, connections picked up through Capture Interfaces can be reset
through specially set up Reset Interfaces. Both Capture and Inline Interfaces can be defined on
the same sensor and used simultaneously.
Which interface the traffic uses to enter the sensor is often relevant to traffic inspection and
handling, so it may be necessary to make the sensor aware of the network segment in which the
traffic appeared. Also, Capture and Inline Interfaces must be distinguished from each other in
the configuration due to their different roles. Logical Interface elements allow you to group
interfaces together according to network segment and interface type. You can then use the
Logical Interface elements as matching criteria when you edit the rules in your IPS policies.
What’s Next?
 One Logical Interface (called Default) is in the system by default. If you want to create
both Capture and Inline Interfaces on the same sensor, you must add at least one more
Logical Interface: proceed to Defining Logical Interfaces for Sensors (page 380).
 To define a Capture Interface, you must have a Reset interface for it, see Defining Reset
Interfaces for Sensors (page 381).
 Defining Capture Interfaces for Sensors (page 381).
 Defining Inline Interfaces for Sensors (page 383).

Defining Logical Interfaces for Sensors
A Logical Interface is used in the IPS policies and in the traffic inspection process to represent a
network segment. They help limit the scope of your IPS rules. The same Logical Interface cannot
be used to represent both Capture Interfaces and Inline Interfaces on the same sensor.
Otherwise, a Logical Interface can represent any combination of interfaces. All rules in the
default IPS policy template match all Logical Interfaces.
 To define a new Logical Interface element

opens.
• If you are currently creating a new Sensor element, leave the Sensor Properties dialog
open in the background.
2. Expand the Other Elements branch in the IPS tree.
3. Right-click Logical Interfaces and select New Logical Interface. The Logical Interface
Illustration 27.20 Logical Interface Properties
4. Type a Name for the new element.

5. (Optional) If VLAN tagging is used on Capture Interfaces, you can select the View interface
as one LAN option to make StoneGate treat the associated VLANs as a single LAN. This
avoids the sensor seeing a single connection as multiple connections when a switch
passes traffic between different VLANs and all traffic is mirrored to the sensor through a
SPAN port.
6. Click OK.
What’s Next?
 Defining Reset Interfaces for Sensors (page 381).
 Defining Capture Interfaces for Sensors (page 381).

Defining Reset Interfaces for Sensors
Reset Interfaces can deliver TCP resets and ICMP “destination unreachable” messages to
interrupt communications picked up through Capture Interfaces when the communications
trigger a response.
The resets are sent using the source and destination addresses and MAC addresses of the
communicating hosts, so an IP address is not mandatory for a Reset Interface. You can add an
IP address if you want to use this interface also for system communications.
VLANs are supported for sending resets, but the correct VLAN is selected automatically and an
interface you want to use as the Reset Interface must not have any manually added VLAN
configuration.
You can also use a system communications interface for sending resets if the resets are routed
correctly through that interface (see Defining System Communication Interfaces for IPS Engines
(page 378)) and if there are no VLANs on the interface.
 To add a Reset Interface

1. Open the properties of the Sensor element and switch to the Interfaces tab.
3. Select an Interface ID. It automatically maps to a physical interface of the same number
during the initial configuration of the engine, but the mapping can be changed as necessary
4. Select Normal Interface as the interface Type.
5. Click OK. The Physical Interface is added to the interface list.
This interface can now be used as a Reset Interface. When you set up the physical network,
ensure that the Reset Interface connects to the same network(s) as the Capture interface(s).
What’s Next?
 Set up the Capture Interfaces that use this Reset Interface as explained in Defining
Capture Interfaces for Sensors (page 381).
Defining Capture Interfaces for Sensors

Capture Interfaces listen to traffic that is not routed through the Sensor. You can have as many
Capture Interfaces as there are available physical ports on the sensor (there are no license
restrictions regarding this interface type). External equipment must be set up to mirror traffic to
the Capture Interface.
 To define a Capture Interface


Illustration 27.21 Physical Interface Properties - Capture Interface
3. Define the interface properties as explained in the table below.
Option Explanation
Select an Interface ID. It automatically maps to a physical interface of the same
Interface ID number during the initial configuration of the engine, but the mapping can be
changed as necessary through the engine’s command line interface.
Type Select Capture Interface as the interface Type.
Reset Select the Reset Interface to specify the interface through which TCP connection
Interface resets are sent when Reset responses are used in your IPS policy. For more
(Optional) information, see Defining Reset Interfaces for Sensors (page 381).
Select the Logical Interface. For more information, see Defining Logical Interfaces
Logical for Sensors (page 380).
Interface You cannot use the same Logical Interface element for both Inline and Capture
Interfaces on the same Sensor.
Inspect
Unspecified Deselect this option to make the sensor ignore traffic from VLANs that are not
VLANs included in the sensor’s interface configuration. We recommend that you keep this
option selected if you do not have a specific reason to deselect it.
(Optional)
4. Click OK to save the interface settings.
What’s Next?
 Adding VLAN Interfaces for Sensors (page 384).
 If you are creating a new element or you added IP addresses to an existing element,
proceed to Setting Interface Options for IPS Engines (page 385).
 If you added a new Interface to an existing element, click OK and refresh the sensor’s
policy to activate the new interface configuration.

Defining Inline Interfaces for Sensors
The Inline Interfaces allow traffic to flow through the Sensor, so that traffic that is deemed
harmful can be actively filtered out. The number of Inline Interfaces you can configure is limited
by the sensor’s license.
An Inline Interface differs from the other interfaces: it consists of two different Physical
Interfaces. This way, the sensor can inspect the traffic coming from an interface and either stop
the traffic or send it out through the other interface. The two interfaces are equal in the
configuration and traffic that is allowed through is always forwarded from one interface to the
other (there is no routing decision involved in this).
Note – Fail-open network cards have fixed pairs of ports. Take particular care to map these
ports correctly. Otherwise, the network cards do not correctly fail open when the sensor is
offline.
 To define an Inline Interface

Illustration 27.22 Physical Interface Properties - Inline Interface
Option Explanation
Select an Interface ID. It automatically maps to a physical interface of the same
Interface ID number during the initial configuration of the engine, but the mapping can be
changed as necessary through the engine’s command line interface.
Type Select Inline Interface as the interface Type.
Second Select a Second Interface ID. It automatically maps to a physical interface during the
Interface ID initial configuration of the engine.
Select the Logical Interface. For more information, see Defining Logical Interfaces for
Logical Sensors (page 380).
Interface You cannot use the same Logical Interface element for both Inline and Capture
Interfaces on the same Sensor.

Option Explanation
Inspect
Deselect this option to make the sensor ignore traffic from VLANs that are not
Unspecified
included in the sensor’s interface configuration. We recommend that you keep this
VLANs
option selected if you do not have a specific reason to deselect it.
(Optional)
4. Click OK to save the interface settings.
What’s Next?
 Adding VLAN Interfaces for Sensors (page 384).
proceed to Setting Interface Options for IPS Engines (page 385).
 If you added a new Interface to an existing element, click OK and refresh the sensor’s
policy to activate the new interface configuration.
Adding VLAN Interfaces for Sensors

VLANs divide a single physical network link into several virtual links. VLANs cannot be defined
for analyzers (this includes analyzers that are part of a combined sensor-analyzer). On sensors,
up to 4094 VLANs can be configured per interface.
Traffic picked up from a VLAN tagged interface can be inspected without configuring VLAN
tagging on the sensor. However, you must configure the VLANs on the sensor if you want to
create different traffic inspection rules for different VLANs. Even then, all VLANs do not
necessarily have to be specified on the sensor. VLANs can optionally be used also for sending
the sensor’s management and logging connections through a directly connected VLAN segment.
The VLAN identifiers you configure on the sensor must match the switch/router configuration.
If the sensor encounters unknown VLANs, it may or may not inspect the traffic; this is controlled
by the “Inspect Unspecified VLANs” option in the Inline and Capture Interface definitions (by
default, the option is set so that all traffic is inspected).
Caution – Do not add any manual VLAN definitions to an interface you want to use for
sending resets. Adding VLANs prevents selecting the interface as a Reset Interface and
also removes the Reset Interface from any existing selections. The sensor automatically
uses the correct VLAN when sending resets.
 To define a VLAN Interface

1. Open the Sensor element’s properties and switch to the Interfaces tab.
2. Right-click a Physical Interface and select NewVLAN Interface. The VLAN Interface
Illustration 27.23 VLAN Interface Properties

3. Enter the VLAN ID (1-4094). This is used on both interfaces in the inline pair.
Note – The VLAN ID must be the same as the ID that is used in the switches that form the
VLAN trunk.
4. Click OK. The specified VLAN ID is added to the Physical Interface.

5. Repeat from Step 2 to add further VLANs (up to 4094 according to the configuration of the
device at the other end of the link).
A VLAN Interface is now ready. The VLAN Interface is identified as Interface-ID.VLAN-ID, for
example 2.100 for Interface ID 2 and VLAN ID 100.
What’s Next?
proceed to Setting Interface Options for IPS Engines.
 Otherwise, the new Inline Interface definition is finished. Click OK and refresh the
sensor’s policy to activate the new interface configuration.
Setting Interface Options for IPS Engines

Interface options allow you to select which interfaces are used for which types of system
communications.
 To set the interface options

1. Open the IPS engine’s properties and switch to the Interfaces tab.
2. Click the Options button below the interface table. The Interface Options dialog opens.
Illustration 27.24 Interface Options (Sensor Cluster)

Option Explanation
Primary
Select the Primary Control Interface. Control Interfaces are used for
(Control communications with the Management Server.
Interface)
Backup
(Control Select a Backup Control Interface that is used if the Primary interface is not
Interface) available.
(Optional)
Select the Primary Heartbeat Interface for communications between the nodes in
Primary
the cluster. This must not be a VLAN Interface.
(Heartbeat
Interface) A dedicated network (without other traffic) is strongly recommended for security and
reliability of heartbeat communications.
(Sensor Clusters
only) In a two-node cluster, a crossover cable without additional intermediary devices is
recommended for the heartbeat link.
Backup
(Heartbeat Select a Backup Heartbeat Interface that is used if the Primary Heartbeat Interface
Interface) is unavailable. It is not mandatory to configure a backup interface for heartbeat
(Sensor Clusters traffic, but we strongly recommend it. If heartbeat traffic is not delivered, the cluster
only, may operate incorrectly.
optional)
Log/Analyzer On Sensors, this is for relaying information about the processed traffic to the
Communication Analyzer for further processing.
Source IP On Analyzers and Sensor-Analyzers, this is for relaying logs and alerts to the Log
Address Server.
4. Click OK.
What’s Next?
 If you are creating a new element, configure the routing as explained in Adding Routes
for IPS Components (page 453), and connect the engine to the Management Server as
explained in Saving an Initial Configuration for Firewall or IPS Engines (page 393).
 Otherwise, click OK and refresh the sensor’s policy to activate the new interface
configuration.

Configuring Manual ARP Settings
Prerequisites: See Creating and Modifying Engine Elements and Network Interface Configuration for overviews
ARP entries are normally managed automatically based on the routing configuration. It is
unnecessary to add manual ARP entries unless there are ARP-related problems (such as
devices that do not respond to gratuitous ARP requests, or that impose a significant delay on
such operations). Only IPv4 addresses are supported in ARP entries.
You can define static and proxy ARP (Address Resolution Protocol) entries that are generated by
the firewall or IPS engines regardless of the policy installed on the nodes. Manually added ARP
entries can be edited or removed in the Properties dialog for the engine elements.
 To add or suppress an ARP entry

1. Right-click the engine and select Properties. The Properties dialog for that element opens.
2. Switch to the Interfaces tab.
3. Click the ARP Entries button below the interface table. The ARP Entry Properties dialog
opens.
Illustration 27.25 ARP Entry Properties (Firewall)
4. Modify the ARP entries:

• To suppress an entry, select the entry and click Remove ARP Entry.
• To add an entry, click the Add Entry button. A new entry is added in the table.
5. (Firewalls only) Click the Type cell for the new entry and select the type of ARP entry you
want to add:
• A Static ARP entry gives the engine a permanent reference to an IP address/MAC
address pair. All entries are of this type on IPS engines.
• A Proxy ARP entry gives a firewall engine a reference to an IP address/MAC address pair
that the firewall should perform proxy ARP for. Proxy ARP is possible only to hosts located
in networks directly connected to the firewall.
6. (Firewalls only) Select the Interface ID for the interface on which you want to apply this ARP
entry.
7. Double-click the cell to enter the IP Address. Only IPv4 addresses are supported.
8. Double-click the cell to enter the MAC Address.
9. Click OK.
What’s Next?
 Refresh the policy to transfer the new configuration to the engines.
Configuring Manual ARP Settings 387

Activating the Internal DHCP Server on a Firewall Interface
Prerequisites: See Getting Started with Interface Configuration
Single Firewalls and Firewall Clusters have an integrated DHCP server that can be set up
independently on several Physical Interfaces and VLANs. When VLANs are configured, the DHCP
server must be set up separately for each VLAN. Only IPv4 addresses are supported. To use this
feature, the firewall interface must have at least one IPv4 address.
Note – You cannot use the internal DHCP server to provide IP addresses to the VPN client
Virtual Adapter.
 To activate the internal DHCP server on a firewall interface

1. Right-click the Single Firewall or Firewall Cluster element and select Properties. The
Properties dialog for the firewall opens.
3. Right-click a Physical Interface or a VLAN and select Edit Physical Interface or Edit VLAN
Interface. The Properties dialog opens.
4. Switch to the DHCP tab.
Illustration 27.26 Physical Interface Properties - DHCP Server Tab
10
5. Select DHCP Server as the DHCP Mode. The DHCP Server options appear.
6. Enter the beginning and the end addresses of the DHCP Address Range that the firewall
assigns to clients. On Firewall Clusters, the DHCP Address range is automatically divided
between the nodes.
Note – The DHCP address range must be in the same network space defined for the
Physical Interface. The DHCP must not contain the firewall’s NDI/CVI addresses or
broadcast IP addresses of networks behind the firewall.
7. (Optional) Enter the Primary DNS Server and Secondary DNS Server IP address that
clients use to resolve domain names.
8. (Optional) Enter the Primary WINS Server and Secondary WINS Server IP address that
clients use to resolve NetBIOS computer names.
9. Enter the IP address of the Default Gateway through which traffic from clients is routed.

10.(Optional, clusters only) Select Override DHCP Ranges per Node and enter the DHCP
Address Range for each node.
Caution – Enter unique ranges for each node. Overlapping ranges can cause IP address
duplication.
11.Click OK and repeat the steps for all interfaces on which you want to enable the DHCP
server.
12.Allow the DHCP-related traffic in the firewall’s IPv4 Access rules:
• Allow DHCP broadcast messages. Use the BOOTPS (UDP) Service element.
• Allow messages from the DHCP address range defined in Step 6 to the IP address(es)
that the firewall uses towards the clients. Use the BOOTPS (UDP) Service element.
• Allow messages from the IP address(es) that the firewall uses towards the clients to the
DHCP address range defined in Step 6. Use the BOOTPC (UDP) Service element.
What’s Next?
 Refresh the policy to transfer the new configuration to the engines.
Related Tasks
 To relay clients’ DHCP messages to/from an external DHCP server, see Routing DHCP
Messages (page 445).
Activating the Internal DHCP Server on a Firewall Interface 389

C HAPT ER 28
CONNECTING ENGINES TO THE

STONEGATE MANAGEMENT CENTER
To maintain the security of your system, the engines establish an authenticated and
encrypted connection with Log Servers and Management Servers.
Getting Started with Connecting Engines to the SMC (page 392)

Saving an Initial Configuration for Firewall or IPS Engines (page 393)
Saving an Initial Configuration for SOHO Firewall Engines (page 395)
Connecting SSL VPN Gateways to the SMC (page 396)
391
Getting Started with Connecting Engines to the SMC
Prerequisites: See Getting Started with Engine Elements
What Connecting Engines to the SMC Does

When you connect the engines to the SMC, the engines contact the Management Server
according to a special initial contact procedure, during which they receive a certificate. The
certificate allows the engine to authenticate itself to other components in all further
communications. When components contact each other, they check if the other component’s
certificate is signed by the same internal certificate authority as their own certificate. The
certificate authority runs on the Management Server, but is separate from the Management
Server itself. The initial contact procedure is secured using a one-time password.
If the certificate of the engine is lost or expires, the initial contact procedure must be repeated
to reconnect the engine to the other components.
Limitations
Engine certificates expire in three years from the date that they are issued. If the automatic
certificate renewal option is active for the engine, the certificate is renewed automatically before
it expires. Automatic certificate renewal is not supported for SOHO Firewalls.
The internal certificate authority that signs the engine certificates is valid for ten years. The
internal certificate authority is automatically renewed six months before the expiration date and
new certificates signed by the new internal certificate authority are automatically created for the
engines. If the automatic certificate renewal fails, you must perform the initial contact again to
the Management Server so that the engine receives a new certificate.
1. Save an initial configuration for the engine on the Management Server. This triggers the
creation of a one-time password that the engine can use to log in to the Management
Server.
2. Make the engine contact the Management Server.
• For Firewall/VPN or IPS engines, see Reconfiguring Basic Engine Settings (page 203).
• For SOHO Firewalls, see the Appliance Installation Guide delivered with the appliance.
• For SSL VPN gateways, see Connecting SSL VPN Gateways to the SMC (page 396).
3. (Not applicable to SSL VPN gateways) Install a policy on the engine to transfer the full
working configuration from the Management Server to the engine.
• For Firewall/VPN or IPS engines, see Installing Policies (page 501).
• For SOHO Firewalls, see the Appliance Installation Guide delivered with the appliance.
What’s Next?
 Saving an Initial Configuration for Firewall or IPS Engines (page 393)
 Saving an Initial Configuration for SOHO Firewall Engines (page 395)
 Connecting SSL VPN Gateways to the SMC (page 396)
392 Chapter 28 Connecting Engines to the StoneGate Management Center

Saving an Initial Configuration for Firewall or IPS Engines
This operation allows you to establish a management connection for new engines for the first
time. It also allows you to reconnect previously configured engines that have lost the connection
due to a missing or expired certificate or because the internal certificate authority that signs the
engine certificates has been renewed and the engines have not yet received a new certificate
signed by the new internal certificate authority.
If you are installing a new engine or want to replace the engine’s previous working configuration,
this operation also allows you to save relevant parts of the configuration on a floppy disk or a
USB memory stick and import it during the firewall engine installation.
What’s Next?
 Start by Creating One-Time Passwords.
Creating One-Time Passwords

The one-time password that is created is specific to each engine. Keep track of which engine
has which password. If you mix them up or lose them, you can repeat the procedure and create
new initial configurations for those engines.
 To create a one-time password

 Save the initial configuration information:
• For an individual engine: right-click the bottom-level node element and select Save Initial
Configuration.
• For all engines in a cluster: right-click the top-level cluster element and select
ConfigurationSave Initial Configuration.
Illustration 28.1 Initial Configuration Dialog
Fingerprint of
Management Server’s
internal certificate
authority
One-time password for
each included node
Saving an Initial Configuration for Firewall or IPS Engines 393

The Management SSL Fingerprint and the One-Time Generated Password are displayed. The
one-time password is mandatory and is used to authenticate the engine to the Management
Server. The fingerprint can be optionally used to make also the engine verify the identity of the
Management Server.
Note – If there is a firewall between the engine and the Management Server, you must
allow the connection in the firewall’s IPv4 Access rules. If there is a NAT device between
the engine and the Management Server, you must also configure NAT rules for the
connection. Otherwise, the engine cannot contact the Management Server.
What’s Next?
 If you want to manually enter details in the engine Configuration Wizard or if the engine
already has the correct configuration, take note of the one-time password and use it for
initial contact from the engine (you can copy the password through the right-click menu).
 If you want to perform an automatic USB stick installation or import intial configuration
details into the engine Configuration Wizard, continue by Saving Initial Configuration
Details.
Saving Initial Configuration Details

Saving the initial configuration details on a USB stick allows automatic configuration by booting
the appliance with the USB stick inserted.
You can alternatively import the details from a USB stick or a floppy disk in the manual
Configuration Wizard.
Caution – Because the initial configuration files include the one-time password for
establishing the trust relationship between the Management Server and the engine, the
information must be handled securely.
 To save initial configuration details

1. (Optional) Select Enable SSH Daemon to allow remote access to the engine command line.
SSH may be helpful for remote troubleshooting.
• You can enable and disable remote command line access to the engine at any time after
management contact is established through the right-click menu of the engine. We
recommend that you disable SSH access whenever it is not needed and that you make
sure your Access rules allow SSH access to the engines from the administrators’ IP
addresses only.
• The Default policy template does not allow these connections, but the temporary policy
activated right after the engine’s initial configuration (in force until you install the working
policy) allows SSH access from the Management Server’s IP address.
Caution – If you enable SSH, set the password for command line access after the initial
configuration either through the Management Client or by logging in to the command line.
When the password is not set, anyone with SSH access to the engine can set the
password.
2. (Optional) Select the Local Time Zone and the Keyboard Layout for use on the command
line. Note that the time zone setting is only for displaying the time on the local console; the

engines always use UTC (GMT) time internally. The clock is automatically synchronized to
match the Management Server’s time.
3. Save the configuration information:
• Click Save As to save the password directly as a text file.
• Select Copy to Clipboard or write down the password to manually enter the password
during the engine configuration.
4. Click Close.
What’s Next?
 Initialize the node: either power on the engine with a USB stick inserted or power on the
engine and import the configuration into the wizard. See Reconfiguring Basic Engine
Settings (page 203) for detailed instructions.
Saving an Initial Configuration for SOHO Firewall Engines

You must transfer the interface configuration of a SOHO Firewall element to the engine when you
have created a new SOHO firewall or edited the properties of an existing SOHO firewall.
 To create an initial configuration file for a SOHO firewall

1. Right-click the SOHO Firewall element and select Create Initial Configuration. The Save
Initial Configuration dialog opens.
2. Select where you want to save the Initial Configuration File.
3. Enter a password for administrator access to the SOHO Firewall in both fields.
4. (Optional) Protect the configuration by adding a Configuration Encryption Password either
by typing or by clicking the Generate button.
5. Click Save. The configuration is written to a file.
Note – If there is a firewall between the SOHO Firewall and the Management Server, you
must allow the connection in the firewall’s IPv4 Access rules. If there is a NAT device
between the SOHO Firewall and the Management Server, you must also configure NAT
rules for the connection. Otherwise, the SOHO Firewall cannot contact the Management
Server.
6. Import the configuration file in the SOHO Firewall’s Web interface as instructed in the
Appliance Installation Guide delivered with the appliance.
Saving an Initial Configuration for SOHO Firewall Engines 395

Connecting SSL VPN Gateways to the SMC
Prerequisites: Creating a New SSL VPN Gateway Element
 To connect an SSL VPN Gateway to the SMC

1. Right-click the SSL VPN Gateway element and select ConfigurationSave Initial
Configuration. The Initial Configuration dialog opens and the Management SSL
Fingerprint and the One-Time Generated Password (one for each node in a mirrored pair)
are displayed.
• The one-time password is mandatory and is used to authenticate the engine to the
Management Server.
• The fingerprint can be optionally used to make also the engine verify the identity of the
Management Server.
2. Take note of the one-time password (you can also copy the password by right-clicking it and
selecting Copy).
3. Log in to the SSL VPN Web Console and use the one-time password to perform initial
contact through SystemInitial Contact. In the case of a mirrored pair, do this for both
nodes (using different passwords).
Note – If there is a firewall between the SSL VPN gateway and the Management Server,
you must allow the connection in the firewall’s IPv4 Access rules. If there is a NAT device
between the SSL VPN gateway and the Management Server, you must also configure NAT
rules for the connection. Otherwise, the SSL VPN gateway cannot contact the Management
Server.
The SSL VPN gateway is now configured for monitoring through the Management Client and you
can view its status right away. However, you must configure the SSL VPN appliance separately to
send syslog messages to the Log Server to be able to view logs from the SSL VPN appliance.

C HAPT ER 29
CONFIGURING THE ENGINE TESTER
The tester runs various checks on the engines and initiates responses based on the success
or failure of these tests.
Getting Started with the Engine Tester

Specifying Global Engine Tester Settings (page 399)
Adding Engine Tests (page 400)
Checking Configured Tests (page 404)
Removing Engine Tests (page 405)
Disabling/Enabling Configured Engine Tests (page 406)
397
Getting Started with the Engine Tester
The engines can be configured with periodical self-tests to ensure proper functioning of each
Firewall, Sensor, and Analyzer engine. SOHO Firewalls do not have a configurable tester.
What the Tester Does
The tester performs checks at certain intervals depending on the state of the engine (online/
offline). Depending on the result, the basic actions the tester can perform are turning the engine
online/offline and/or sending alerts and/or SNMP traps.
Limitations
The tester on the engines also runs internal system tests that cannot be edited or disabled.
These are meant for recognizing certain configuration problems and internal error conditions,
such as nodes in the cluster having different policies.
1. Configure the global tester settings that are common for all tests. See Specifying Global
Engine Tester Settings (page 399).
2. Configure the test entries (settings for running individual tests). See Adding Engine Tests
(page 400).
What’s Next?
 Proceed to Specifying Global Engine Tester Settings (page 399).
Related Tasks
 Removing Engine Tests (page 405)
 Disabling/Enabling Configured Engine Tests (page 406)
398 Chapter 29 Configuring the Engine Tester

Specifying Global Engine Tester Settings
Prerequisites: None
The global settings of the tester have default values that you can override to meet your needs.
 To configure the global tester settings

1. Right-click the Firewall, Sensor, or Analyzer element, and select Properties from the menu.
The Properties dialog for the selected element opens.
Illustration 29.1 Firewall Cluster Properties - Tester Tab
2. Switch to the Tester tab. The global settings of the tester and the currently configured test
entries are displayed.
3. (Optional) Adjust the Alert Interval to specify how long the system will wait before sending
a new alert when the same test keeps failing repeatedly.
• If the interval is too short, the alerts can potentially overload the system or the alert
recipient.
• The default value is 60 minutes.
4. (Optional) Configure Delay After values in seconds. This is the time the engine waits before
it resumes running the tests after the listed events. The delays prevent false test failures
that can occur due to variations in how quickly different processes and subsystems can
start and stop.
• Boot: the default is 30 seconds (maximum: 1800 s)
• Reconfiguration: the default is 5 seconds (maximum: 1800 s)
• Status Change: the default is 5 seconds (maximum: 1800 s)
5. (Optional) Select whether to activate or deactivate Auto Recovery. This determines if the
engine automatically goes back online when a previously failed test completes
successfully. Make sure to run the test in both online and offline states if you activate this
option.
6. (Optional) Select whether to activate or deactivate Boot Recovery. This determines whether
the engine automatically goes back online after a reboot (or events such as a power failure
or system crash) if all offline tests report a success.
What’s Next?
 Configure the test entry settings as explained in Adding Engine Tests (page 400).
Specifying Global Engine Tester Settings 399

Adding Engine Tests
Prerequisites: Specifying Global Engine Tester Settings
Some settings are nearly identical for all tests. These common settings are explained below.
Some tests have test-specific settings in addition to the common settings, which are explained
separately for each test (see listing below the steps).
The following tests are available:
• The External test runs a custom script stored on the engine. If the script returns the code
zero (0), the test is considered successful, otherwise the test is considered failed.
• The File System Space tests the free disk space on a hard disk partition.
• The Firewall Policy test (firewalls only) checks if a new policy is activated on the engine. It is
mainly intended for sending SNMP notifications.
• The Free Swap Space test checks the available swap space on the hard disk.
• The Link Status test checks whether a network port reports the link as up or down.
• The link of a Modem Interface (single firewalls only) is up if a modem reports that a call is
in progress.
• The link of an ADSL interface (single firewalls only) is up when the ADSL modem is
connected to a Digital Subscriber Line Access Multiplexer (DSLM), and the ADSL modem
reports that the connection is working.
• The status of Aggregated Links (firewalls only) depends on the link mode. An Aggregated
Link in High-Availability Mode is up if one of the interfaces that belong to the Aggregated
Link is up. An Aggregated Link in Load-Balancing Mode is up if both the interfaces that
belong to the Aggregated Link are up.
• The Multiping test sends out a series of ping requests to determine whether there is
connectivity through a network link. Only IPv4 addresses are supported as target addresses
for the Multiping test.
• The Inline Pair Link Speed test (inline sensors only) checks if the network settings (speed/
duplex) match on the two ports that form the inline pair and can force both ports to use the
same settings.
Test failures can be notified to administrators as Alerts or as SNMP traps (requires that SNMP
is configured as explained in Getting Started with SNMP Configuration (page 432)). Additionally,
a test can switch nodes offline/online based on the result.
 To determine the common settings

1. Open the properties dialog of the engine and switch to the Tester tab.
2. Click the Add button under the Test Entries table. The Test Entry Settings dialog opens.

Illustration 29.2 Test Entry Settings
3. Select the type of Test you want to configure (see the introduction above for more
information). The settings that apply to the selected test are activated.
Note – Do not select the File System Space or Free Swap Space tests for those StoneGate
appliances that use a flash card instead of a hard disk.
4. (Clusters only) Select the Node ID on which the test is run:

• ALL nodes.
• A single node.
5. Specify the status of the nodes to be tested. You can use one or more of the status
options:
• Online: test is run when node is online.
• Offline: test is run when node is offline.
• Standby (clusters only): test is run when node is in the Standby state.
6. Enter the Test Interval as time in seconds to specify how often the test is executed.
• The minimum interval is 4 seconds and the maximum 86,400 seconds (one day).
• Running a test too frequently can increase overhead.
7. In the Failure section on the right-hand side of the dialog, select the Action initiated by the
tester in case of test failure (selection may vary by test):
• None: no state transition is performed.
• Offline: the test switches the node offline. However, the tester does not turn offline the
last active node in a cluster or nodes that are in the Locked Online state.
• Force Offline: the node is forced to an offline state, even if it is the last node online in a
cluster or if it is in the Locked Online state. Use in cases in which a complete cut in traffic
is a better option than a partially working firewall.
• Force Speed (Inline Pair Link Speed test only): if the test finds that the pair of inline ports
have different speed/duplex settings, the speed/duplex on the higher speed/full duplex
link is set to match the lower speed/half duplex setting on the other port. Correct and
reliable operation requires identical settings.
Adding Engine Tests 401

8. (Optional, recommended) Select the Notification methods you want to use to let
administrators know that a test has failed.
• Alert: test failure triggers an alert.
• SNMP: an SNMP trap is sent. To use SNMP notification, SNMP must be configured for
this engine (see Getting Started with SNMP Configuration (page 432)).
What’s Next?
 If you are configuring an External test, configure Additional Settings for the External Test
(page 402).
 If you are configuring a System Space test, configure Additional Settings for the File
System Space Test (page 403).
 If you are configuring a Swap Space test, configure Additional Settings for the Free Swap
Space Test (page 403).
 If you are configuring a Link Status test, configure Additional Settings for the Link Status
Test (page 403).
 If you are configuring a Multiping test, configure Additional Settings for the Multiping
Test (page 404).
 Otherwise, click OK and refresh the policy to transfer the new configuration to the
engine(s).
Configuring Additional Test-Specific Settings

Additional Settings for the External Test
 To define settings for the External test
1. To configure the number of times the Tester will try to execute the test, enter the number of
testing attempts in the Retry Count field. We recommend you always set the retry count to
more than 1 to avoid creating overly sensitive tests that burden the system unnecessarily.
2. Enter the timeout for the test in seconds in the Test Timeout field. If the test being run
does not return a response in the time specified in this field, the test is considered to have
failed. Avoid overly short timeout values. 500 - 1000 ms is usually a working timeout, but
naturally this depends on what is being tested.
3. Enter the script path in the Command Line field.
Example /usr/local/bin/connectivity.sh
4. Click OK.
Note – The external script has to return an exit code of 0 (zero) if it succeeds. Any non-zero
return value is considered a failure.
What’s Next?
 Refresh the policy to transfer the new configuration to the engine(s).

Additional Settings for the File System Space Test
 To define settings for the File System Space test
1. Enter the minimum amount of free hard disk space in kilobytes in the Free Space field.
When the amount of free space drops below the amount you have set, the engine executes
the chosen action.
2. Specify the partition in the Partition field.
3. Click OK.
What’s Next?
Additional Settings for the Free Swap Space Test

 To define settings for the Free Swap Space test
1. Enter the minimum amount of free hard disk space in kilobytes in the Free Space field.
When the amount of free space drops below the amount you have set, the engine executes
the chosen action.
2. Click OK.
What’s Next?
Additional Settings for the Link Status Test

 To define settings for the Link Status test
1. Select the Interface on which the test is run:
• ALL Physical Interfaces, Modem Interfaces (single firewalls only), and ADSL Interfaces
(single firewalls only).
• (Clusters only) ALL with CVI.
• A single Physical Interface, a Modem Interface (single firewalls only), or an ADSL Interface
(single firewalls only).
Note – (Firewalls only) Only the first interface that belongs to an Aggregated Link is shown
in the list of interfaces. However, the Link Status test checks the status of both interfaces
in the Aggregated Link.
2. Click OK.
What’s Next?
Adding Engine Tests 403

Additional Settings for the Multiping Test
 To define settings for the Multiping test
1. Select the Source Address for the test:
• DEFAULT: no source address is forced on the test. The source IP address is selected
automatically based on the standard routing rules.
On a cluster, if the Physical Interface that routes the ping packet out has an NDI (Node
Dedicated IP Address), this address is used as the source address. Otherwise, the NDI
selected as Default IP for Outgoing Traffic is used.
• A single Physical Interface, a Modem Interface (single firewalls only), or an ADSL Interface
(single firewalls only). If the Node ID selection is ALL, each node uses the IP address of
the selected Physical Interface or the ADLS Interface (single firewalls only), or the dynamic
IP address of the selected Modem Interface (single firewalls only) as the source IP
address for the test. If a single node is selected in Node ID on a cluster, the source
address and the multiping test itself apply to that node only.
2. Set the number of times the Tester will try to execute the test by entering a number in the
Retry Count field. We recommend you always set the value to at least more than 1 to avoid
overly sensitive tests that burden the system unnecessarily.
3. Enter the timeout of the test in seconds in the Test Timeout field. If the test being run does
not return a response in the time specified in this field, the test is considered to have
failed. Avoid overly short timeout values.
4. Specify the target addresses of ICMP echo requests in the Target Addresses field. Only
IPv4 addresses are supported as target addresses.
• You can add or remove target addresses with the corresponding buttons.
• The test is considered as failed if none of the target addresses responds.
5. Click OK.
What’s Next?
Checking Configured Tests

Prerequisites: Adding Engine Tests
The test entries that you have configured with the tester are displayed in the Test Entries table
in the engine properties. You can deactivate, activate, and remove tests directly in the Test Entry
table.
 To check configured tests

1. Right-click the Firewall, Sensor, or Analyzer element and select Properties from the menu.
The Properties dialog for that element opens.

2. Switch to the Tester tab. All the configured test entries are displayed in the Test Entries
table. The selected states and actions for the tests are indicated with letters as
summarized in the table below.
Table 29.1 Test Entry Display of Selected Actions and States
Types Table Display Description

N Online
States to test O Offline
S Standby
A Alert
O+A Offline + Alert
FO+A Force Offline + Alert

Action on failure
A+S Alert + SNMP
O+A+S Offline + Alert + SNMP
FO+A+S Force Offline + Alert + SNMP
What’s Next?
 If you want to remove a test permanently, proceed to Removing Engine Tests
(page 405).
 If you only want to activate or reactivate a test, proceed to Disabling/Enabling
Configured Engine Tests (page 406).
 Otherwise, click OK to close the engine properties.
Removing Engine Tests

Prerequisites: None
Removing a test permanently removes the test settings from the selected engine. If you want to
stop a test from running without removing it, see Disabling/Enabling Configured Engine Tests
(page 406).
 To remove a test
2. Switch to the Tester tab.
3. Select the test entry you want to remove in the Test Entries list.
4. Click the Remove button. The test is permanently removed from the selected engine.
5. Click OK.
What’s Next?
Removing Engine Tests 405

Disabling/Enabling Configured Engine Tests
Prerequisites: There are one or more enabled/disabled user-configurable tests configured
All test entries that you configure are automatically activated and available to the tester after a
policy refresh or install. You can decide to disable any individual test in the Test Entries table or
all of the tests that are applied on a specified node.
What’s Next?
 Disabling/Enabling Individual Engine Tests (page 406)
 Disabling/Enabling All Custom Engine Tests (page 406)
Disabling/Enabling Individual Engine Tests

 To disable or enable an individual test
3. Find the test you want to disable/enable in the Test Entries table and deselect/select the
option in the Active column to disable/enable the test.
4. Click OK.
What’s Next?
Disabling/Enabling All Custom Engine Tests

 To disable or enable all customized tests on a specific node
3. In the Global Settings section, deselect/select the option in the Test column of the node(s)
for which you want to disable/enable testing.
4. Click OK.
What’s Next?

C HAPT ER 30
ENGINE PERMISSIONS
Permissions control can be used to restrict the administration of the engine.
Getting Started with Engine Permissions (page 408)

Defining an Engine’s Administrator Permissions (page 408)
Selecting Permitted Policies for an Engine (page 409)
407
Getting Started with Engine Permissions
Prerequisites: Your administrator account must have editing privileges to the engine element
What Engine Permission Control Does

Engine permissions control can be used in two ways:
• To prevent some administrators from editing and viewing an engine’s properties to prevent
unauthorized modifications and protect confidential details.
• To restrict the policies that can be installed on the engine to prevent service outages caused
by the wrong policy being installed on the engine by accident.
See Getting Started with Administrator Accounts (page 214) for more information on access
control in StoneGate.
1. Define which administrators are allowed to edit and view the element. See Defining an
Engine’s Administrator Permissions (page 408).
2. Define which policies can be installed on the engine. See Selecting Permitted Policies for
an Engine (page 409).
Defining an Engine’s Administrator Permissions

You can either add an Access Control List or an individual Administrator-Administrator Role pair
as permitted on the engine. The rights that the Access Control List grants to the administrators
are defined in the properties of the administrator accounts (defined with Administrator
elements).
An administrator with a restricted account can refresh or upload a policy on an engine only if
both the engine and the policy have the administrator on the list of permitted administrators.
The engines may not accept all policies. This can be adjusted as explained in Selecting
Permitted Policies for an Engine (page 409).
 To add or modify an engine’s administrator permissions

1. Right-click the engine or policy and select Properties to open its properties. Switch to the
Permissions tab.
2. To add a permission, click the Add Permission button under Permissions. A new row
appears on the administrator list.
3. Click the Administrator cell and select the Administrator.
4. Right-click the Administrator Role cell and select Edit Administrator Role. The Select
Element(s) dialog opens.
5. Select a role and click Add.
6. Click OK to close the Select Element(s) dialog.
7. If necessary, repeat from Step 2 to define other administrator permissions.
408 Chapter 30 Engine Permissions

8. Click OK.
Note – Changes to administrator permissions are immediately distributed and taken into
account in all related elements.
Related Tasks
 Defining Administrator Roles and Access Control Lists (page 215)
Selecting Permitted Policies for an Engine

By default, any policy can be installed on any component as long as the policy is of appropriate
type for the type of engine. To prevent accidental installations of the wrong policy, you can select
the allowed policy for each Firewall, Analyzer, Sensor, or Sensor-Analyzer in the corresponding
element’s properties. The policy selection is enforced regardless of the administrator privileges
that the installing administrator has.
 To grant a policy to be installed on an engine

1. Right-click the correct Firewall, Analyzer, Sensor, or Sensor-Analyzer element and select
Properties from the menu. The properties dialog for the element opens.
2. Switch to the Permissions tab.
3. In the Policies section at the bottom, select the Policy:
• To allow the installation of any policy, click Set to Any.
• Otherwise, click Add. The Select Element dialog opens.
4. Select the correct Policy or Template Policy.
• If you select a Template Policy, any policy based on the template can be installed.
5. Click OK.
Selecting Permitted Policies for an Engine 409

410 Chapter 30 Engine Permissions
C HAPT ER 31
ALIAS TRANSLATIONS FOR ENGINES
Aliases can be used to represent other network elements in configurations. The value an Alias
takes in a configuration can be different on each engine where the Alias is used.
Getting Started with Alias Translations (page 412)

Defining Alias Translation Values (page 412)
411
Getting Started with Alias Translations
What Aliases Do
You can use Alias elements in your policies to represent IP addresses. Aliases differ from Group
elements in that they do not represent all the elements at once. The Alias elements do not
contain any IP address information themselves. The values that the Aliases receive when they
are encountered in a policy depend on the translation value you set for each Alias in the engine
elements’ properties. This way, the same policy can be used on several engines, and the IP
address information is filled in correctly according to the translation values for each engine.
Alias elements are especially useful in policy templates and sub-policies.
Aliases are configured for firewalls and sensors. The analyzer configuration is constructed
based on the translated values you configure for the sensors that send data to the analyzer.
There are some predefined Aliases provided by the system and you can also create new Aliases.
The names of the unmodifiable system Aliases start with two $$ symbols, whereas the user-
modifiable and user-created Aliases start with one $ symbol. For a listing of default Aliases
available in the system, see Predefined Aliases (page 943). The unmodifiable system Aliases
receive their translation values automatically based on the engine’s configuration. User-
modifiable default Aliases do not receive their translation values automatically.
What’s Next?
 Defining Alias Translation Values
Defining Alias Translation Values

Alias translation values are set for each engine. You can edit the translation values through the
engine properties (as explained here) or in the properties of the Alias element itself.
What’s Next?
 Adding Alias Translation Values (page 413)
 Removing Alias Translation Values (page 413)
412 Chapter 31 Alias Translations for Engines

Adding Alias Translation Values
 To add elements to Alias translation values
1. Right-click an engine element and select Properties. The Properties dialog opens.
2. Switch to the Aliases tab. The table with Aliases and their values opens.
3. Select the Alias whose value you want to edit.
4. Define the value for the Alias:
• If you want the Alias to match any IP address on this engine, right-click the Value cell for
the Alias and select Set to Any. Skip to Step 8.
• Otherwise, right-click the Value cell and select Edit Value. The Alias Value Properties
dialog opens.
5. Browse in the Resources panel for an element you want to use as the translation value on
this engine.
• If the element does not exist yet, you can create a new one through the right-click menu
for the correct element type.
6. Select the correct element(s) and click Add. The element(s) are added to the Alias Value
panel.
7. Click OK to close the Alias Value Properties dialog.
8. Click OK to close the engine properties.
Removing Alias Translation Values

If there are no translation values for a particular Alias for an engine, the Translation Value is
None. If Aliases with the value None are used alone as matching criteria in a rule in a Firewall or
IPS Policy, the rule never matches any traffic.
 To remove Alias translation values

1. Right-click an engine element and select Properties. The Properties dialog opens.
2. Switch to the Aliases tab. The table with Aliases and their values opens.
3. Right-click the Value cell of the Alias whose value you want to modify and select Edit Value.
The Alias Value Properties dialog opens.
4. Select the element(s) to be removed in the Alias Value panel and click Remove.
5. Click OK to close the Alias Value Properties dialog.
6. Click OK to close the engine properties.
Defining Alias Translation Values 413

414 Chapter 31 Alias Translations for Engines
C HAPT ER 32
ADVANCED ENGINE SETTINGS
This section explains the settings on the Advanced tab in the properties of Firewall/VPN and
IPS engine elements, and how to adjust the management connection for SOHO Firewalls.
Getting Started with Advanced Engine Settings (page 416)

Adjusting Firewall System Parameters (page 416)
Adjusting Firewall Traffic Handling Parameters (page 418)
Adjusting Firewall Clustering Options (page 419)
Adjusting Single Firewall’s Contact Policy (page 423)
Configuring Anti-Virus Settings (page 424)
Configuring Default SYN Flood Protection for a Firewall (page 425)
Configuring Log Handling Settings (page 426)
Adjusting Sensor-Analyzer Advanced Settings (page 427)
Adjusting Analyzer Advanced Settings (page 427)
Adjusting Sensor Advanced Settings (page 428)
Adjusting SOHO Firewall Management Connection (page 430)
415
Getting Started with Advanced Engine Settings
“Advanced settings” cover various system parameters related to different features. These
parameters generally have default values that are appropriate for most installations without any
need for adjustments, or values that can be overridden in policies rule-by-rule when exceptions
are needed.
Caution – Improper adjustments to some of the advanced settings may seriously degrade
the performance of the system.
 To open the advanced settings

1. Right-click an engine element and select Properties. The Properties dialog for that element
opens.
2. Switch to the Advanced tab and adjust the settings as explained in the sections listed
below.
• Adjusting Firewall System Parameters (page 416)
• Adjusting Firewall Traffic Handling Parameters (page 418)
• Adjusting Firewall Clustering Options (page 419)
• Adjusting Single Firewall’s Contact Policy (page 423)
• Configuring Anti-Virus Settings (page 424)
• Configuring Default SYN Flood Protection for a Firewall (page 425)
• Configuring Log Handling Settings (page 426)
• Adjusting Sensor-Analyzer Advanced Settings (page 427)
• Adjusting Analyzer Advanced Settings (page 427)
• Adjusting Sensor Advanced Settings (page 428)
Related Tasks
 Adjusting SOHO Firewall Management Connection (page 430)
Adjusting Firewall System Parameters

Prerequisites: See Getting Started with Advanced Engine Settings
The System Parameters section on a Firewall element’s Advanced Settings tab contain settings
that relate to how the single or clustered firewall behaves under certain conditions. The table
below explains the available settings.
Table 32.1 Firewall Advanced Settings - System Parameters Section
Setting Description Notes

Used when opening any kind of communication
Setting the timeout value too short
between the Management Server and the firewall
Contact Node or too long may delay or prevent
engines. A consistently slow network connection may
Timeout contact between the Management
require increasing this value. The default value is 60
Server and the engines.
seconds.
416 Chapter 32 Advanced Engine Settings

Table 32.1 Firewall Advanced Settings - System Parameters Section (Continued)

Used when a non-recoverable error situation is
Automatic Reboot
detected to automatically reboot the engine. The Set to 0 to disable.
Timeout
default value is 10 seconds.
When the policy handshake feature is on, the nodes

We recommend adjusting the
automatically roll back to using the previously installed
timeout (next setting below) rather
policy if connectivity is lost after installing a new policy.
Policy Handshake than disabling this feature
Without this feature, you must switch to the previous completely if there is a need to
configuration manually through the boot menu on the make changes.
engine.
The time the engine waits for a management

connection before it rolls back to the previously
Rollback Timeout
installed policy when the Policy Handshake option is
active. The default value is 60 seconds.
Encrypt The configuration of the firewall is by default stored in

Configuration an encrypted format. The encryption can be disabled if
Data you have a specific need to do so.
With the option selected, the engine’s certificate for Does not renew VPN certificates.
system communications is automatically renewed Automatic certificate renewal for
Automated Node before it expires. Otherwise, the certificate must be internally signed VPN certificates is
Certificate renewed manually. set separately in the Internal
Renewal Each certificate for system communications is valid for Security Gateway element
three years. If the certificate expires, other properties. See Defining Security
components refuse to communicate with the engine. Gateways (page 720).
FIPS-Compatible Activates a mode that is compliant with the Federal See the Common Criteria User’s
Operating Mode Information Processing Standard FIPS 140-2. Guide for more information.
Separate the IP addresses with a

The DNS server(s) that the engine uses to resolve the comma if you want to enter several
DNS IP Address virus signature mirrors and web filtering categorization DNS server addresses. Only IPv4
services (which are defined as URLs). addresses are supported in this
field.
Settings related to the integrated anti-virus (separately

Anti-Virus
licensed feature). See Configuring Anti-Virus Settings
Settings
(page 424).
You can configure SYN Flood

Settings for configuring protection against SYN Flood Protection also for specific
SYN Flood
attacks. See Configuring Default SYN Flood Protection interfaces. See Configuring
Protection
for a Firewall (page 425). Advanced Interface Properties for
Firewalls (page 349).
Adjusting Firewall System Parameters 417

Table 32.1 Firewall Advanced Settings - System Parameters Section (Continued)

You can adjust the logging of
Settings related to adjusting logging when the log
Antispoofing and Discard logs also
spool on the engines fills up or when the number of
Log Handling for specific interfaces. See
Antispoofing and Discard logs grows too high. See
Configuring Advanced Interface
Configuring Log Handling Settings (page 426).
Properties for Firewalls (page 349).
Adjusting Firewall Traffic Handling Parameters

The Traffic Handling Parameters section on a Firewall element’s Advanced tab contain settings
that relate to how the single or clustered firewall treats certain traffic conditions. The table
below explains the available settings.
Table 32.2 Firewall Advanced Settings - Traffic Handling Parameters Section

This option is always active when
the firewall is in FIPS-compliant
operating mode.
When selected, the firewall does not permit TCP traffic
You can override this general
Strict Connection to pass through before a complete, valid TCP
setting and configure connection
Tracking handshake is performed. Leave this setting deselected
tracking for TCP, UDP, and ICMP
unless you have a specific need to enable it.
traffic in Access rules. See
Defining Firewall “Allow” Action
Options (page 523).
When the firewall receives fragmented packets, it

defragments the packets for inspection. The original
fragments are held at the firewall until the inspection is
finished. This setting defines how the fragmented
Virtual packets are sent onwards after inspection if the
Defragmenting packets are allowed. If this option is selected, the
fragmented packets are sent onwards using the same
fragmentation as when they arrived at the firewall. If
the option is not selected, the packets are sent
onwards as if they had arrived unfragmented.
Settings related to the communications between

Clustering
cluster members and load-balancing between the
(Firewall Clusters nodes. See Adjusting Firewall Clustering Options
only) (page 419).
Settings related to adjusting IPsec VPNs performance-

wise (see Advanced VPN Tuning (page 774)), and
VPN Settings
settings related to managing VPN client addresses
(see Managing VPN Client IP Addresses (page 785)).
Policy routing settings. See Defining Policy Routing

Policy Routing
(page 451).

Table 32.2 Firewall Advanced Settings - Traffic Handling Parameters Section (Continued)

Settings for how a firewall with a reversed
Firewall Contact
management connection (channel is always opened
Policy
from the node to the Management Server) contacts the
(Single Firewalls Management Server. See Adjusting Single Firewall’s
only) Contact Policy (page 423).
Sets general timeouts for removing idle connections

from the state table, including non-TCP
communications that are handled like connections.
The timeout prevents wasting firewall resources on Setting excessive timeouts for a
storing information about abandoned connections. large number of connections
Timeouts are a normal way to clear traffic information strains resources excessively and
with protocols that have no closing mechanism. may disturb the operation of the
Idle Timeouts Timeouts can be set by protocol and by TCP connection firewall.
state. Idle timeouts set in Access rules override these The communicating client and
global settings. server also have timeouts for
Timeouts do not affect active connections. The closing inactive connections.
connections are kept in the state table as long as the
interval of packets within a connection is shorter than
the timeouts set.
Adjusting Firewall Clustering Options

You can check and adjust some of the settings related to how the firewall cluster behaves and
exchanges information from node to node as explained in Adjusting General Clustering Options
(page 419).
If you are an advanced user, it is also possible to tune settings related to how the traffic load is
balanced between several online nodes as explained in Tuning the Firewall Load Balancing Filter
(page 421). However, we strongly discourage you from modifying the load balancing settings
unless Stonesoft’s technical support instructs you to make particular changes.
Adjusting General Clustering Options

A firewall cluster has the following general clustering settings:
• The cluster mode determines whether the clustered engines are all online balancing the
traffic or whether one node is online at a time and the other engines are used as backups.
• Heartbeat settings are used to relay the status between the nodes so that other nodes can,
for example, determine when a node has failed.
• The Node synchronization settings determine how the nodes exchange information about the
traffic that they process.
 To adjust basic clustering settings

1. Right-click a Firewall Cluster element and select Properties. The Properties dialog for the
firewall cluster opens.
Adjusting Firewall Clustering Options 419

2. Switch to the Advanced tab and click the Clustering button. The Clustering Properties
dialog opens on the Cluster tab.
3. Select the Cluster Mode you want to use:
• Balancing: Several nodes are simultaneosly online providing high availability and
enhanced performance in case of node failure and enhanced firewall performance.
Balancing is the default mode.
• Standby: Only one node can be online at a time. It is recommended to have at least one
other node on standby to allow automatic takeover in case of failure. Several nodes can
be on standby at a time. A randomly selected standby node is turned online when the
online node fails.
4. (Optional) Adjust the Heartbeat Message Period to set how often clustered engines send
heartbeat messages to each other (notifying that they are up and running). Enter the value
in milliseconds. The default value is 1000 milliseconds (i.e., one second).
5. (Optional) Adjust the Heartbeat Failover Time to set the time from the previous heartbeat
message after which a node is considered as failed. Enter the value in milliseconds. The
failover time must be at least twice as long as the Heartbeat Message Period. The default
value is 5000 milliseconds.
Caution – Setting the Heartbeat values too low may result in unnecessary heartbeat
failures. Setting the values too high may cause unnecessary service outages when a failure
occurs.
6. (Optional) Click State Sync and select the synchronization type:

• All: Both full and incremental synchronization messages are sent (default, recommended
setting). This allows frequent updates without consuming resorces excessively. Regular
full synchronization ensures that all nodes stay synchronized even if some incremental
messages are not delivered.
• Full Only: Only full synchronization messages are sent. Incremental updates are not sent
in between, so nodes may not have the same information on connections, unless the full
sync interval is significantly reduced (not recommended).
Note – We strongly recommend using Access rule options to disable state synchronization
for specific traffic rather than adjusting the State Sync settings for the cluster. See Defining
Access Rule Action Options (page 522) for more information.
7. (Optional) Adjust the Full Sync Interval and Incr Sync Interval to determine how frequently
the full synchronizations and incremental synchronizations are done. Do not set the values
much higher or lower than their defaults (5000 ms for full, 50 ms for incremental)
Caution – Adjusting the Sync Intervals has significant impact on the cluster’s performance.
Inappropriate settings seriously degrade the firewall’s performance.
8. Select the Sync Security Level:

• None: no security features. Do not select this options unless the channel is dedicated
and physically separate from any other traffic. This option offers a slight performance
benefit over the other options.
• Sign (default): transmissions are authenticated to prevent outside injections of
connection state information.
• Encrypt and Sign: transmissions are authenticated and encrypted. This option increases
the overhead compared to the default option, but is strongly recommended if the node-to-

node communications are relayed through insecure networks (for example, if the backup
heartbeat is configured on an interface that handles other traffic).
9. (Optional) If you want to change the multicast IP addresses used for node-to-node
communications, fill in an IP address between 224.0.0.0 and 239.255.255.255 in the
Heartbeat IP (default: 225.1.1.1) or Synchronization IP (default: 225.1.1.2) cells. This
multicast IP address must not be used for other purposes on any of the network interfaces.
What’s Next?
 If your cluster is in load-balancing mode and you want to change settings related to how
traffic is balanced, see Tuning the Firewall Load Balancing Filter (page 421).
 Otherwise, refresh the firewall’s policy to transfer the changes.
Tuning the Firewall Load Balancing Filter
Caution – Do not manually tune the load balancing filter unless you are absolutely certain
it is necessary. Normally, there is no need to tune the load balancing filter, because
StoneGate generates all required entries automatically. Unnecessary tuning may adversely
affect the operation of the filter.
The load balancing filter of the firewall cluster can be tuned by adjusting some parameters and
filter entries. You can define the connections where packets are passed or blocked by the filter.
You can select certain connections to be passed on one node while they would be blocked on
another node. You can also configure the port numbers to be ignored in load balancing. The
filter entries are specified in the Filter Entries table. Only IPv4 addresses are supported in load
balancing filters.
What’s Next?
 Manually Tuning the Load Balancing Filter
Manually Tuning the Load Balancing Filter

 To tune the load balancing filter manually
1. Right-click a firewall cluster and select Properties. The Properties dialog for the firewall
cluster opens.
2. Switch to the Advanced tab and click the Clustering button. The Clustering Properties
dialog opens.
3. Switch to the Manual LB Filters tab.
4. Select the Filter Mode:
• Static: packet ownership (i.e., to which node the connection/packet belongs) may change
only when nodes are added or removed from the cluster, or when they switch from an
offline state to an online state or vice versa.
• Dynamic: traffic is balanced to avoid node overloads and existing connections are moved
between nodes whenever overload is detected.
Adjusting Firewall Clustering Options 421

5. (Optional) Select the Load Balancing Filter Uses Ports option to include a port value for
selecting between all nodes.
• This setting decreases the granularity of VPN load balancing, and increases the
granularity of other traffic load balancing. In typical networks, traffic is balanced based on
IP information only. If there is a dominating pair of communication IP addresses, apply the
Use Ports option in the load balancing filter entry only to their traffic and not globally.
Caution – Enabling the “Load Balancing Filter Uses Ports” option is not compatible with
some features, such as client-to-gateway VPNs.
What’s Next?
 If required, continue with the definition of filter entries in Adding Load Balancing Filter
Entries.
Adding Load Balancing Filter Entries

 To define load balancing filter entries
1. Click Add to generate a new filter entry row.
2. Double-click the IP Address field. The Load-Balancing Filter IP Entry dialog opens.
3. Select whether you want to filter either a Single IP address or a Range of IP addresses.
4. Enter the IP address or address range and the netmask and click OK. The Load-Balancing
Filter IP Entry dialog closes.
5. Click the Action cell and select one of the following actions:
• None: no action is performed for the IP address specified in this entry (used with the
Replacement IP, Use Ports, NAT Enforce, Use IPsec, or Ignore Other options).
• Replace by: the original IP address is replaced by the IP address in the Replacement IP
cell. This is the default action.
• Pass on All Nodes: the filter entry allows packets to all nodes.
• Block on All Nodes: the filter entry blocks packets to all nodes.
• Pass on Node [n]: the filter entry forces the node [n] (where n is the node ID number) to
handle all the packets belonging to the connection specified in this entry.
6. If you selected Replace by as the action, click the Replacement IP field and enter the
replacement IP address.
7. (Optional) Select Use Ports to override the global Load Balancing Filter Uses Ports option.
• If two hosts send the bulk of all traffic through the firewall, you can set the Use Port
option to one of them to divide the traffic between the cluster nodes, thus improving
granularity.
• Using this option for IP addresses in a VPN site can reduce the granularity of VPN load
balancing and prevent VPN client connections regarding those IP addresses.
8. (Optional) Select NAT Enforce for the current filter entry if required. Tuning this option is not
recommended without advice from Stonesoft technical support as the option enables a
specific NAT-related process in the load balancing filter.
9. (Optional) Select Use IPsec for the current filter entry to specify addresses receiving IPsec
traffic on the node itself. Tuning this option is not recommended without advice from
Stonesoft technical support as the option enables a specific load-balancing process for all
IPsec traffic directed to the IP address specified in the filter entry.

10.(Optional) Select Ignore Other for the current filter entry to enforce packet handling. This
option can be used to force the handling of packets by one node at a time to and from the
specified IP address.
11.Click OK.
What’s Next?
 Refresh the firewall’s policy to transfer the changes.
Adjusting Single Firewall’s Contact Policy

Prerequisites: A single firewall with a dynamic Control IP Address
Communication between the Management Center and a single firewall can be reversed so that
the firewall opens a connection to the Management Server and maintains it open waiting for any
commands. This can be necessary if the firewall does not have a static IP address that the
Management Server can contact (dynamic IP address on the interface of intermediate dynamic
NAT) or if the Management Server’s connections are blocked because of a traffic filtering device
in between the components. The frequency of the contacts and the timeouts used are set in the
firewall's properties.
 To define contact policy settings for single firewall

1. Right-click a single firewall and select Properties. The Single Firewall Properties dialog
opens.
2. Switch to the Advanced tab and click the Firewall Contact Policy button in the Traffic
Handling Parameters section on the right. The Firewall Contact Policy dialog opens.
3. Modify the time settings for the contact policy as desired:
• Initial Delay: Time (in seconds) to wait after initialization before the first connection
attempt to the Management Server. The default value is 10 seconds.
• Connection Interval: Time (in seconds) to wait before connecting again to the
Management Server after a successful connection. The default value is 600 seconds (10
minutes).
• Retry interval: Time (in seconds) to wait before connecting again to the Management
Server after a failed connection attempt. The default value is 600 seconds (10 minutes).
• Idle timeout: Time (in seconds) before an idle connection is closed. The default value is
300 seconds (5 minutes).
4. Click OK.
What’s Next?
Related Tasks
 For the option for changing the management contact direction, see Setting Firewall
Interface Options (page 361).
Adjusting Single Firewall’s Contact Policy 423

Configuring Anti-Virus Settings
Anti-virus is available as a separately licensed feature on selected platforms. The Firewall

Policy’s IPv4 Access rules define which traffic is inspected against the virus signature database
(see Editing Access Rules (page 518)). We recommended you to use the Default Inspection
rules in the Firewall Policy when anti-virus is used.
 To configure anti-virus settings

1. Right-click a Firewall element and select Properties. The Properties dialog for the firewall
opens.
3. Enter at least one DNS IP Address in the System Parameters section on the left. Engines
query the DNS servers to resolve the virus signature mirrors, which are defined as URLs.
Separate the addresses with commas if you want to enter several. Only IPv4 addresses are
supported.
4. Click the Anti-Virus button in the same section. The Anti-Virus Settings dialog opens.
5. Select Enable to activate the anti-virus options.
6. (Optional) Enter the addresses of the Virus Signature Mirrors that you want to use. The
engines contact the mirrors to update their virus signatures. Separate the addresses with
commas if you want to enter several.
7. Select the Virus Log Level according to what type of notification you want to receive when a
virus is found. The log levels are the same as in Access rules (see Defining Access Rule
Logging Options (page 528)).
8. (Optional) If you selected Alert as the Virus log level, click Select to select the Alert
element associated with the alert. The Alert elements can be used as matching criteria in
alert escalation policies.
9. Click OK.
What’s Next?
 If you have not yet defined which traffic is selected for anti-virus inspection, modify the
IPv4 Access rules in the Firewall Policy. Proceed to Editing Access Rules (page 518).

Configuring Default SYN Flood Protection for a Firewall
You can configure SYN Flood Protection to protect the firewall from SYN flood attacks.
The global SYN Flood Protection settings that you define in the firewall properties as explained
below are applied as default settings on all interfaces. You can also define SYN Flood Protection
and override the global settings in each interface’s properties (see Configuring Advanced
Interface Properties for Firewalls (page 349)).
 To configure default SYN Flood Protection settings

opens.
3. Click the SYN Flood Protection button in the System Parameters section on the left. The
Default SYN Flood Protection Settings dialog opens.
4. Select the SYN Flood Protection Mode:
• Off: SYN Flood Protection is disabled by default.
• Automatic: This is the recommended mode. The firewall automatically calculates the
number of Allowed SYNs per Second and the Burst Size for the interface based on the
engine’s capacity and memory size.
• Custom: Enter the desired values for Allowed SYNs per Second (the number of allowed
SYN packets per second) and Burst Size (the number of allowed SYNs before the firewall
starts limiting the SYN rate). We recommend that Burst Size be at least one tenth of the
Allowed SYNs per Second value. If Burst Size is too small, SYN Flood Protection does
not work. For example, if the value for Allowed SYNs per Second is 10000, the Burst Size
must be at least 1000.
Caution – The recommended values for the SYN Flood Settings depend on your network
environment. If the Custom settings are not carefully configured, the capacity of the
firewall engine may suffer or SYN Flood Protection may not work correctly.
5. Click OK.
What’s Next?
Related Tasks
 Configuring Log Handling Settings
Configuring Default SYN Flood Protection for a Firewall 425

Configuring Log Handling Settings
Log Handling settings allow you to adjusts logging when the log spool on the engines fills up.
Logs are spooled locally when the Log Server is not available.
You can also configure Log Compression to save resources on the engine. This is useful in
situations in which the routing configuration generates a lot of antispoofing logs or the number
of Discard logs becomes high (for example, as a result of a SYN flood attack).
The general Log Compression settings you define in the firewall properties are applied as
default settings on all interfaces. You can also define Log Compression and override the global
settings in each interface’s properties (see Configuring Advanced Interface Properties for
Firewalls (page 349)).
 To configure Log Handling settings

opens.
3. Click Log Handling in the System Parameters section on the left. The Log Handling Settings
dialog opens.
4. Select the Log Spooling Policy to define what happens when the engine’s log spool
becomes full:
• Stop Traffic: The node goes offline. If the node is part of a firewall cluster, the other
nodes of the cluster take over the connections.
• Discard Log: Log entries are discarded in four stages, according to available space.
Monitoring data is discarded first, followed by log entries marked as Transient and Stored,
and finally log entries marked as Essential. All the while, the engine keeps processing
traffic. This is the default option.
5. (Optional) Define Log Compression and enter the desired values for the Antispoofing
entries and (optionally) for the Discard entries.
• Do not enable Log Compression if you want all the antispoofing and Discard entries to be
logged as separate log entries (for example, for reporting purposes or for firewall
statistics).
• By default, each generated antispoofing and Discard log entry is logged separately and
displayed as a separate entry in the Logs view. Log Compression settings allow you to
define the maximum number of separately logged entries. When the defined limit is
reached, a single antispoofing log entry or Discard log entry is logged. The single entry
contains information on the total number of the generated antispoofing log entries or
Discard log entries. After this, the logging returns to normal and all the generated entries
are once more logged and displayed separately.
• Log Rate (Entries/s): the maximum number of entries per second. The default value for
antispoofing entries is 100 entries/s. By default, Discard log entries are not compressed.
• Burst Size (Entries): the maximum number of matching entries in a single burst. The
default value for antispoofing entries is 1000 entries. By default, Discard log entries are
not compressed.
6. Click OK.
What’s Next?

Related Tasks
 Configuring Default SYN Flood Protection for a Firewall (page 425)
Adjusting Sensor-Analyzer Advanced Settings

The Advanced Settings for Sensor-Analyzers are a combination of the settings found in the
properties of Analyzer and Sensor elements. Follow the steps for those components in the
relevant parts.
Adjusting Analyzer Advanced Settings

The table below explains the available settings on the Advanced tab of Analyzer Properties.
Table 32.3 Analyzer Advanced Settings

With the option selected, the engine’s certificate for
system communications is automatically renewed
Automated Node before it expires. Otherwise, the certificate must be
Certificate renewed manually.
Renewal Each certificate for system communications is valid for
three years. If the certificate expires, other components
refuse to communicate with the engine.
Defines how quickly sensors switch over to the backup Sensors do store data locally if
analyzer if this analyzer fails to respond. The default the analyzer does not respond,
value is 120 seconds. and send it to the backup
Timeout for
Make sure the failover time is appropriate for your analyzer after the failover.
Failover to Backup
environment. Analyzers do not synchronize data However, as the traffic flows,
Analyzer
between each other, so a failover causes a momentary commands such as blacklisting
lapse in the event correlation process, and you do not traffic may then be triggered very
want failovers to occur unnecessarily. late.
Adjusting Sensor-Analyzer Advanced Settings 427

Adjusting Sensor Advanced Settings
The table below explains the available settings on the Advanced tab of Sensor and Sensor
Cluster Properties.
Table 32.4 Sensor Advanced Settings

“Terminate and log connection” stops matching
connections if they are travelling through an Inline
interface. This is the default. This setting works like a normal
First Continue
“Just log termination could have occurred” does not Continue rule, so any individual
Rule for
stop matching connections, but creates a special log rules and Continue rules in the
Connection
entry Terminate (passive), which allows you to filter the IPS Policy can override this
Termination
logs to see which type of connections are dropped when setting.
you change the option to actually stop traffic. This is
useful for testing purposes.
With the option selected, the engine’s certificate for

system communications is automatically renewed
Automated Node before it expires. Otherwise, the certificate must be
Certificate renewed manually.
Renewal Each certificate for system communications is valid for
three years. If the certificate expires, other components
refuse to communicate with the engine.
Duplicate log entries may be generated when inline

Sensors are connected to a Firewall Cluster. Select this
option if you want only the first log event to be displayed
in the Logs view when duplicate log events are
Silent Drop for generated.
Duplicate Log If several inline Sensors are used with a Firewall Cluster
Events and you want the duplicate log events to be dropped,
you must select the same Analyzer for all the Sensors in
the Sensor properties.
If this option is not selected, all duplicate events are
displayed in the Logs view.
This option maintains connectivity when an inline

sensor is near the limits of its performance. When the
option is selected, the sensor dynamically reduces the
number of inspected connections if the load is too high.
Some traffic may pass through without any access
control and inspection if this option is selected.
Bypass Traffic on
Bypassed traffic is not counted when a possible license
Overload
throughput limit is enforced. The bypass does not affect
traffic subject to HTTPS inspection.
If this option is not selected, the sensor inspects all
connections. Some connections may not get through If
the inline sensor gets overloaded. This is the default
setting.

Table 32.4 Sensor Advanced Settings (Continued)

If a Sensor inspects traffic that is tunneled using IP over
IP or Generic Routing Encapsulation (GRE), the contents
of the tunneling packet can be checked against the IPv6
Access rules and/or IPv4 Access rules several times
according to the number and type of layers in the
Limit for
tunnel.
Rematching
Tunneled Traffic This setting defines how many times the contents of
tunneled packets can be rematched against the IPv6
Access rules and/or IPv4 Access rules when several
layers of tunneling is encountered. The default is 1.
When the limit is reached, the action defined in the next
setting below is taken.
Determine whether remaining encapsulated packets

inside the tunneling packet are allowed without further
Action if Limit is
inspection or discarded. The default is to discard the
Exceeded
remaining packets. When this action is triggered, you
are notified according to the next setting below.
Defines if you are notified through a normal (stored) log

entry or an Alert when the limit for rematching tunneled
Log Level traffic is reached. If you selected Alert as the Log Level,
choose the Alert element that is used. The Alert
elements can be used for matching in Alert Policies.
Separate the IP addresses with a

The DNS server(s) that the engine uses to resolve the comma if you want to enter
DNS IP Address web filtering categorization services (which are defined several DNS server addresses.
as URLs). Only IPv4 addresses are
supported in this field.
Settings for adjusting how a Sensor Cluster behaves.

Clustering Only shown for Sensor Clusters.
See Adjusting Sensor Clustering Options (page 429).
Adjusting Sensor Clustering Options

StoneGate Sensor clusters operate by default in load balancing mode. This means that all the
configured sensors are online simultaneously and the traffic is distributed among the
operational nodes. The load balancing aims to keep the traffic load as evenly distributed as
possible.
Alternatively, the cluster can run in standby mode. In that case, only one Sensor node at a time
is online and processing traffic, while the others are standby. Only in case the online node fails,
one of the standby nodes will instantly step in and take over the work of the failed node.
 To set the cluster mode of the Sensor cluster

1. Right-click a Sensor Cluster element and select Properties. The Properties dialog opens.
3. Click the Clustering button. The Clustering Properties dialog opens.
Adjusting Sensor Advanced Settings 429

4. Select the Cluster Mode:
• Balancing: several nodes are simultaneosly online providing high availability and
enhanced performance in case of node failure and enhanced Sensor performance.
Balancing is the default value.
• Standby: only one node can be online at a time. It is recommended to have at least one
other node on standby for taking over in case of failure. Several nodes can be on standby
at a time. In this situation, one of the standby nodes is turned online when the online
node fails.
5. Select the Filter Mode:
• Static: packet ownership (i.e., to which node the connection/packet belongs) may change
only when nodes are added or removed from the cluster, or when they switch from an
offline state to an online state or vice versa.
• Dynamic: traffic is balanced to avoid node overloads and existing connections are moved
between nodes whenever overload is detected.
6. Click OK to confirm your selection and close the dialog.
What’s Next?
 Refresh the sensor’s policy to transfert the configuration changes.
Adjusting SOHO Firewall Management Connection

By default, the connection between a SOHO firewall engine and the Management Server is
always open. The SOHO firewall reopens the connection immediately if the connection is cut.
Alternatively, you can choose to have the connection automatically closed after a period of
inactivity and have the SOHO firewall periodically check if the Management Server has any
pending commands for it.
If the connection is closed at the time commands are issued, the commands are left pending in
a queue on the Management Server. When the SOHO Firewall reconnects to the Management
Server the next time, the Management Server issues the pending commands. After the
commands are issued, the connection between the SOHO Firewall and the Management Server
is closed again.
 To set the delay for reopening management connection

1. Select ConfigurationConfigurationFirewall. The Firewall Configuration view opens.
2. Browse to Network ElementsSOHO Firewalls.
3. Right-click SOHO Firewalls and select Configure SOHO Firewalls. The Configure SOHO
Firewalls dialog opens.
4. Select the Reopen Delay option if you want to allow the Management Server connection to
be closed without immediate reopening.
5. Enter the delay time in hours in the field provided to define the time between reopening a
connection to the Management Server after successful contact.
6. Click OK.
What’s Next?
 Apply the configuration change on the SOHO firewalls through their right-click menu.

C HAPT ER 33
SETTING UP SNMP FOR ENGINES
SNMP is a standard protocol that different equipment can use to send network management
related information to each other. StoneGate engines can be set up to send out SNMP traps
to external equipment.
Getting Started with SNMP Configuration (page 432)

Configuring SNMP Version 1 or 2c (page 432)
Configuring SNMP Version 3 (page 433)
Configuring What Triggers SNMP Traps (page 434)
Activating the SNMP Agent on Engines (page 435)
431
Getting Started with SNMP Configuration
Prerequisites: None
StoneGate firewall and IPS engines can send SNMP traps on system events such as when a
test fails (depending on their configuration), for example, to a central network monitoring
system. An SNMP Agent element is a reusable container for the settings according to which the
engines send SNMP trap messages to compatible external software. A single SNMP Agent can
be created once and used on multiple engines by selecting the correct SNMP Agent in the
engine’s properties.
What Do I Need To Know Before I Begin?
StoneGate’s SNMP agent supports SNMPv1 (RFC1157), SNMPv2c (RFCs 1901 and 3416), and
SNMPv3 (RFC 3414). Check the documentation of the receiving software for information on
which version to use.
The StoneGate MIBs are included on the Management Center CD-ROM. For more information on
the traps StoneGate sends, see SNMP Traps and MIBs (page 961)
Limitations
SNMP traps cannot be configured for SOHO firewalls.
What’s Next?
 Configuring SNMP Version 1 or 2c
 Configuring SNMP Version 3 (page 433)
Configuring SNMP Version 1 or 2c

Prerequisites: None
If you want to use SNMPv3, configure the agent as explained in Configuring SNMP Version 3
(page 433). Otherwise, follow the directions below.
 To configure the monitoring settings for SNMPv1 and v2c

2. Browse to Other ElementsFirewall PropertiesSNMP Agents or
Other ElementsIPS PropertiesSNMP Agents.
3. Right-click SNMP Agents and select New SNMP Agent. The SNMP Agent Properties dialog
opens.
4. Enter a unique Name for the SNMP Agent and select v1 or v2 as the Version.
5. (Optional) Click Add in the Monitoring section and enter the community string in the dialog
that opens. The community string is used for authentication in monitoring.
6. (Optional) Enter the UDP port number that the SNMP agent listens to in the Listening Port
field. The default setting is port 161.
432 Chapter 33 Setting up SNMP for Engines

7. Enter the Contact information for the person responsible for the engines. This string is
returned to queries from the SNMPv2-MIB object.
What’s Next?
 Configuring What Triggers SNMP Traps (page 434)
Configuring SNMP Version 3

Prerequisites: None
SNMP v3 uses different authentication than v1 and v2c.
 To configure the monitoring settings for SNMPv3

2. Browse to Other ElementsFirewall PropertiesSNMP Agents or
Other ElementsIPS PropertiesSNMP Agents.
3. Right-click SNMP Agents and select New SNMP Agent. The SNMP Agent Properties dialog
opens.
4. Enter a unique Name for the SNMP Agent and select v3 as the Version.
5. Click Add in the User Names section to add a user. The SNMP User Properties dialog
opens.
6. Enter the User Name, select the Authentication and Privacy options according to the
desired configuration, and click OK.
7. Repeat from Step 5 to add more users as necessary.
8. Click Add in the Monitoring section and select the user for monitoring in the dialog that
opens. Repeat as necessary to select more users for monitoring.
9. (Optional) Enter the UDP port number that the SNMP agent listens to in the Listening Port
field. The default setting is port 161.
10.Enter the Contact information for the person responsible for the engines. This string is
returned to queries from the SNMPv2-MIB sysContact object.
What’s Next?
 Configuring What Triggers SNMP Traps (page 434)
Configuring SNMP Version 3 433

Configuring What Triggers SNMP Traps
Prerequisites: Configuring SNMP Version 1 or 2c / Configuring SNMP Version 3
The trap parameters control where and how SNMP traps are sent. The Destinations field is
important. If it is left empty, no traps are sent, and the other trap parameters are ignored. If the
Destinations field has a value, the rest of the trap parameters must also have a value.
 To activate a specific trap

1. Specify a community or user name in the Traps section:
• In SNMPv1 or SNMPv2c, enter the Community string.
• In SNMPv3, select a User Name.
2. Click Add in the Traps section and enter the IP address and UDP port where the traps are
sent. The default port setting is 162.
3. Select the events for which you want to set a trap in the Active Traps section. The possible
events are:
• Boot (for example, startup of the agent process by minit)
• Shutdown
• Going Online
• Going Offline
• Policy Applied
• User Login (via console or with SSH)
• Hardware Alerts (for StoneGate appliances that support hardware monitoring).
4. Click OK. The SNMP Agent is created.
In addition to these general events, the Tester on each engine can send SNMP traps when a
test fails.
What’s Next?
 Activating the SNMP Agent on Engines (page 435)

Activating the SNMP Agent on Engines
Prerequisites: See Getting Started with SNMP Configuration
The SNMP Agent is responsible for SNMP-related tasks on the engines.
 To activate the SNMP Agent

1. Open the properties of the Firewall, Sensor, or Analyzer element.
2. On the first tab, select the SNMP Agent you want to activate.
3. Define the string that is returned on queries to the SNMPv2-MIB or SNMPv2-MIB-
sysLocation object in the SNMP Location field.
4. Click OK.
What’s Next?
 If you want to create a Test Entry that sends a notice using the SNMP Agent, proceed to
Adding Engine Tests (page 400).
 Otherwise, refresh the engine’s policy to transfer the changes. For more information on
the traps StoneGate sends, see SNMP Traps and MIBs (page 961).
Activating the SNMP Agent on Engines 435

R OUTING
In this section:
Configuring Routing - 439
Outbound Traffic Management - 459
Inbound Traffic Management - 467
437
438
C HAPT ER 34
CONFIGURING ROUTING
Routing and the related antispoofing configuration is done entirely in the Management Client.
For the most part, this information is automatically filled in according to the interfaces defined
for each engine.
Getting Started with Routing (page 440)

Adding Routes for Firewalls (page 441)
Adding Routes for IPS Components (page 453)
Removing Routes (page 454)
Modifying Antispoofing for Firewalls (page 454)
Checking Routes (page 456)
439
Getting Started with Routing
Prerequisites: None
How Routing Works

Routing is configured entirely through the Management Client, mainly in the tree displayed in the
Routing view. Basic routing information for directly connected networks is added automatically to
both routing and antispoofing based on IP addresses you have defined for the engines’
interfaces. IPS components do not route traffic. You may need to define a default route for IPS
components if other system components are not located on a directly connected network.
Antispoofing is used only on the firewall. Antispoofing configuration is added and updated
automatically based on the routing configuration. Firewalls always enforce antispoofing, which
by default allows a connection to originate only from the interface that has a routing entry for the
connection’s source IP address.
Limitations
• Selection of which traffic is routed through VPNs is not determined by the basic routing
configuration; routing is checked after VPN traffic is encapsulated inside encrypted packets
with different source and destination IP address information.
• IPv6 addresses are only supported on single firewalls. IPv6 addresses are not supported in
DHCP relay, multicast routing, and policy routing.
1. Add the default route. See Adding Routes for Firewalls (page 441) or Adding Routes for
IPS Components (page 453).
2. Add routes to networks that are not directly connected, but require a next-hop gateway.
See Adding Routes for Firewalls (page 441).
Related Tasks
 To configure the firewall to relay DHCP messages, proceed to Routing DHCP Messages
(page 445).
 To define a route for multicast traffic, proceed to Routing Multicast Traffic (page 447).
 To define a route that sends connections to different destinations based on both source
and destination, proceed to Defining Policy Routing (page 451).
440 Chapter 34 Configuring Routing

Adding Routes for Firewalls
Prerequisites: None
Firewalls route network traffic. You must add a default route and any routes through next-hop
gateways to networks that are not directly connected to the firewalls. On firewall clusters, the
routing information is configured simultaneously for all cluster nodes and all nodes always have
identical routing tables.
What’s Next?
 To define only one route to the same destination or to define a single route for
interfaces that belong to an aggregated link, proceed to Defining a Single-Link Route for
a Firewall.
 To define two or more alternative routes to the same destination, proceed to Defining a
Multi-Link Route for a Firewall (page 442).
Defining a Single-Link Route for a Firewall

You can follow these same instructions for adding a default route or static routes to a particular
network. If there are two or more alternative routes to the same destination, create a Multi-Link
route instead. See Defining a Multi-Link Route for a Firewall (page 442).
Routing decisions are made per packet by matching from the most specific route definition to
the most general. However, any policy routing entries you define override the other routing
information. For packets subject to address translation, routing is always done after NAT using
the translated addresses.
 To define a single-link route

1. Select ConfigurationRouting from the menu. The Routing view opens.
2. Select the firewall for which you want to configure routing from the list above the Routing
tree.
3. Expand the tree of the correct interface so that the Network element is displayed below the
correct interface.
4. Add a Router to the Network element.
• If the Router element you want to add already exists, drag and drop it from the Resources
panel onto the Network in the Routing tree.
• If the Router element does not exist, create a new Router element by right-clicking the
Network element under the correct interface in the Routing tree and selecting
NewRouter. The Router element for dynamic interfaces is marked as “DHCP
Assigned”.
Adding Routes for Firewalls 441

5. Add the element that contains the IP addresses that are routed through this interface:
• To add a default route, right-click the Router element you just added in the Routing tree
and select NewAny Network. The (existing) default Any Network element is added
below the Router in the Routing tree.
• To add a route using some element that is already configured, drag and drop the element
from the Resources panel.
• To create a new Host or Network element, use the right-click menu for the Router element
you just added in the routing tree.
Note – Placing the Any network element behind two different basic router elements does
not create true router redundancy and load balancing. Use NetLink elements instead. See
Defining a Multi-Link Route for a Firewall.
What’s Next?
 Install the policy to transfer the changed configuration to the firewall.
Defining a Multi-Link Route for a Firewall

When you use Multi-Link routing, traffic is routed through different network connections
(NetLinks) according to traffic conditions, the availability of the different links, and explicitly
configured preferences you set. Most often, Multi-Link is used for Internet connections, but
Multi-Link can be used to provide alternative routes to any other network as well.
1. Create a NetLink for each alternative route as instructed in Creating NetLinks (page 443).
2. Add Networks below the NetLink(s) in the Routing tree to define a route as explained in
Adding a Multi-Link Route (page 444).
What’s Next?
 Creating NetLinks (page 443)

Creating NetLinks
NetLink elements are used to represent alternative routes that lead to the same destination IP
addresses. NetLinks usually represent Internet connections, but can be used for other
communications links as well.
Although the Management Client may not require all settings to be filled in at this point, we
recommend that you fill in all settings as instructed here to achieve a fully functional
configuration and to avoid having to readjust the settings later. To monitor the status of the
network links, you must define the probe IP addresses in the NetLink properties.
Note – Only NetLinks that are using in an Outbound Multi-Link element are probed. Status
monitoring is not available for NetLinks that are only used in Routing. See Getting Started
with Outbound Traffic Management (page 460) for more information about Outbound Multi-
Link configuration.
 To define a NetLink element

tree.
3. Expand the tree under the interface under which you want to create the NetLink.
4. Right-click the network to which the NetLink belongs and select NewStatic NetLink or
NewDynamic NetLink. The NetLink Properties dialog opens.
Illustration 34.1 NetLink Element Properties
5. Give the NetLink a unique Name.

6. (Static NetLink only) Select the next-hop Gateway the NetLink uses.
• The Select button opens a dialog that allows you to create a new element if needed.
• The Gateway is usually added as a Router element, but you can also choose another
StoneGate Firewall according to your network configuration.
7. (Static NetLink only) Define the public addresses (assigned by your ISP) that are included in
the NetLink (and thus routed to the Internet provider’s router) using the Select button next
to the Network field.
8. (Optional) Enter the Provider Name of your ISP.
9. (Optional) Enter or adjust the Probing Settings:
Setting Description
Enter an IP address and click Add. The IP addresses that are probed with ICMP echo
requests (ping) to determine if the link is up. Repeat this for each IP address you want
IP Address
to add. We recommend entering more than one address to avoid excluding the link in
case the host that is probed goes down.
Define how often the NetLink is probed when it is in Active/Standby mode. Leave the
setting for Standby Mode as 0 if you prefer not to test this link when it is on standby
Period
(this is meant to minimize costs for links that are charged based on use rather than at
a fixed rate).
Define how long the firewall waits before it considers the probe failed. Change the
Timeout
setting for Standby Mode to 0 if you prefer not to test this link when it is on standby.
Note – Select IP addresses that give reliable results of end-to-end connectivity to

destinations that need to be reached through the link (such as a remote server across the
internet instead of an internal router or server of your ISP in the case of an Internet
connection).
10.(Optional) If you plan to use the ratio-based load balancing method, fill in the Input Speed
and Output Speed based on the real-life bandwidth this network connection provides.
These values are used to calculate how much traffic each link receives in relation to the
other links.
11.Click OK.
What’s Next?
 Repeat these steps to add any other NetLinks to the Routing tree.
 If you are finished adding NetLinks, define a route through the NetLinks as explained in
Adding a Multi-Link Route (page 444).
Adding a Multi-Link Route
Note – The network interfaces for the NetLinks must have a Node Dedicated IP Address
defined for all nodes in clusters. Otherwise, the IP address of the interface marked as the
default IP address for outgoing connections is used, which may lead to incorrect load
balancing. See Configuring Firewall Cluster IP Addresses (page 356).

 To add a Multi-Link route
tree.
3. Browse to the NetLink through which you want to route traffic in the Routing Tree.
• To add a default route, right-click the NetLink element you just added in the Routing tree
below the NetLink in the Routing tree.
• To create a new Host or Network element, use the right-click menu for the NetLink
element you just added in the Routing tree.
Caution – If you use Multi-Link with IGMP proxy multicast routing, make sure that you do
not create routing loops. If you add a NetLink to the upstream interface, do not add a
NetLink to any downstream interface.
What’s Next?
 Repeat these steps for any additional NetLinks.
 Otherwise, the Multi-link Routing configuration is complete.
Related Tasks
 To use Multi-Link to balance outbound traffic, see Getting Started with Outbound Traffic
Management (page 460)
Routing DHCP Messages

The firewall can relay DHCP messages. If DHCP messages are routed through the firewall (from
a network segment to some other, isolated segment), you must enable DHCP relay on the
firewall interface properties for the interface where the DHCP requests are originating from
(client’s network).
Only IPv4 addresses are supported in DHCP relay. You can enable DHCP relay only on firewall
interfaces that have at least one IPv4 address.
This DHCP relay configuration does not relay DHCP messages from the VPN Client. See
Managing VPN Client IP Addresses (page 785).
What’s Next?
 If you have already configured the DHCP server that you want to use for relaying DHCP
messages, start by Enabling DHCP Relay (page 447).
 Otherwise, start by Defining a DHCP Server.

Defining a DHCP Server
A DHCP Server dynamically assigns IP addresses.
 To define a DHCP Server element

View opens.
2. Browse to Network Elements in the Firewall tree.
3. Right-click Servers and select NewDHCP Server. The DHCP Server Properties dialog
opens.
Illustration 34.2 DHCP Server
4. Enter a unique Name and IP Address.
Note – Only IPv4 addresses are supported for DHCP relay in the Management Center.
5. A Location and Contact Address is needed if there is a NAT device between a firewall and
the server, so that the firewall cannot connect directly to the IP address defined for the
interface. See Defining Locations (page 61) and Defining Contact IP Addresses (page 62)
for more information.
6. Click OK to apply the changes to the DHCP Server properties.
What’s Next?
 Configure the firewall to relay DHCP messages as explained in Enabling DHCP Relay
(page 447).
Related Tasks
 To use the DHCP server to assign virtual IP addresses to VPN clients, see Configuring the
Gateway for Virtual IP Address Clients (page 787).

Enabling DHCP Relay
You must select which firewall interfaces perform DHCP relay. Enable DCHP relay on the firewall
interface towards the DHCP clients as explained in Activating the Internal DHCP Server on a
Firewall Interface (page 388).
What’s Next?
 To allow DHCP relay in the Access rules, proceed to Activating the DHCP Relay Sub-
policy (page 447).
Activating the DHCP Relay Sub-policy

DHCP relay is not allowed in the default template. However, there is a ready-made DHCP relay
sub-policy that you can refer to from your own firewall policy.
Note – The sub-policy contains rules for both local DHCP relay between internal networks
and the DHCP relay for VPN clients. If just one of these DHCP relay features is active, the
rules for the other feature are invalid and ignored when the policy is installed.
 To activate the DHCP relay sub-policy

1. Open the policy or firewall template policy for editing.
2. Add a new IPv4 Access rule with the following properties:
Source Destination Service Action

BOOTPC (UDP)
ANY ANY Jump DHCP Relay
BOOTPS (UDP)
What’s Next?
 Refresh the policies of all affected engines to transfer the changed configuration.
Related Tasks
 To monitor the DHCP relay more closely during testing, you can activate DHCP relay
diagnostic logging on the firewall. See Enabling/Disabling Firewall/VPN Diagnostics
(page 193).
Routing Multicast Traffic

StoneGate supports static multicast and IGMP-based multicast forwarding (IGMP proxying).
IGMP-based multicast forwarding is only supported in tree topology networks. Only IPv4
addresses are supported in multicast routing.
Static multicast allows you to configure static routes for multicast traffic between a source IP
address and firewall interface pair, and a destination (multicast) IP address and firewall
interface pair. Static multicast is often used for enduring configurations, such as mutually
agreed multicast traffic between organizations (for example, multicast news feeds and video
conferences).

In IGMP-based multicast forwarding, the firewall maintains a list of hosts that are subscribed to
the multicast host group. It forwards the traffic sent to the multicast IP address only to the
currently subscribed hosts.
Note – In addition to configuring StoneGate, routers and other network devices must be
configured to allow IP multicasting along the path to the client machines.
What’s Next?
 To define static IP multicast entries, continue by Defining Static Multicast (page 448).
 To configure IGMP Proxy multicast routing, continue by Defining IGMP-Based Multicast
Forwarding (page 449).
Defining Static Multicast
Note – Make sure your IPv4 Access rules allow the static multicast traffic to pass through
the firewall (see Editing Access Rules (page 518)).
 To define static multicast

1. Open the Properties for the Firewall element for which you want to define static multicast
routing.
3. Click the Multicast Routing button below the interface table. The Multicast Routing
4. Select Static as the Multicast Routing Mode. The options for the mode are enabled.
Illustration 34.3 Static Multicast Routing
5. Click Add. A new entry appears in the table.

6. Configure the values for the entry:
Cell How to Configure

Source Interface Select the Firewall interface to use for multicast routing.

Cell How to Configure
Source IP Address Enter the unicast IP address of the multicast source.
Enter the multicast destination IP address. The destination address must be

Destination IP Address
within the multicast range of 224.0.0.0 to 239.255.255.255.
Right-click Destination Interface and select Edit Destination Interface to

Destination Interface
select the interface(s) where you want this multicast traffic forwarded.
7. Repeat from Step 5 to define any additional static IP multicast entries.

8. Click OK.
What’s Next?
Defining IGMP-Based Multicast Forwarding

IGMP-based multicast forwarding (IGMP proxying) is implemented in StoneGate based on RFC
4605. IGMP-based multicast forwarding is only supported in tree topology networks. RFC 4605
includes support for source-specific multicast (SSM) with IGMP version 3. SSM is not supported
in StoneGate. However, you can configure Access rules that filter multicast traffic based on the
source.
The firewall maintains a membership database of the subscriptions from the downstream
networks and sends unsolicited reports or leaves on the upstream interface when the
subscription database changes. It also sends IGMP membership reports when queried on the
upstream interface.
 To define IGMP-based multicast forwarding

1. Right-click the Firewall element for which you want to define IGMP-based multicast
forwarding and select Properties. The Properties dialog opens.
3. Click the Multicast Routing button below the interface table. The Multicast Routing
4. Select IGMP Proxy as the Multicast Routing Mode. The options for the mode are enabled.

Illustration 34.4 IGMP Proxy Multicasting
5. (Optional) Select the Upstream Interface and the IGMP Version for it.
• If the multicast servers and the hosts are in the local networks, or if you want to limit the
multicast to the local networks, it is not necessary to define the Upstream Interface. In
that case, leave Not Set selected for Upstream Interface.
• (Firewall Clusters only) You can only select as the Upstream Interface an interface that has
a Cluster Virtual IP Address (CVI). You cannot select a Heartbeat Interface as the
Upstream Interface.
• The default IGMP version is version 3. You may need to select another IGMP version, for
example, to troubleshoot multicast accessibility on hosts, or if some hosts use a lower
IGMP version.
6. Click Add to define Downstream Interfaces. A new entry appears in the table.
• The firewall periodically queries the downstream networks for hosts that want to join or
leave the multicast host group.
7. Click the Interface cell and select the Downstream Interface from the list.
• You can use the same Physical Interface, VLAN Interface, or (single firewalls only) Modem
Interface only once in the IGMP proxy configuration.
• (Firewall Clusters only) The interface that you select as a Downstream Interface must have
Node Dedicated IP Addresses (NDIs). It cannot be a Heartbeat Interface. It is
recommended that the Node Dedicated IP Addresses increase in the same order on each
node: for example, 192.168.1.10 and 192.168.2.10 for node A, and 192.168.1.11 and
192.168.2.11 for node B.
Note – The downstream interfaces must have the lowest IP addresses among all the IGMP
queriers in the local networks.
8. Click the IGMP Version cell and select the IGMP version for the downstream interface. The
default version is IGMP version 3. You may need to select another IGMP version, for
example, to troubleshoot multicast accessibility on hosts, or if some hosts use a lower
IGMP version.
9. Repeat from Step 6 to define more Downstream Interfaces.

10.Click OK.
Note – Make sure your IPv4 Access rules allow this traffic to pass through the firewall (see
What’s Next?
Defining Policy Routing

Policy routing is used to resolve duplicate IP addressing issues. Policy routing allows you to
route traffic based on both source and destination IP address. Policy routing is useful if the
same IP address is in use on more than one physical host in different networks and it is not
possible to resolve the situation by changing IP address or by using NAT. In most systems, there
is no need to add any policy routing entries.
Note – Policy routing is only used if duplicate IP addresses are used in different networks.
To configure alternative routes to the same destination, use Multi-Link routing (see
Defining a Multi-Link Route for a Firewall (page 442)).
Policy routing entries are applied before the regular routes defined in the Routing tree (overriding
those configurations if matches are found), and they are processed exactly in the order
specified in the Policy Routing window; the first matching policy routing entry is applied to a
connection and any further entries are ignored.
Only IPv4 addresses are supported in policy routing.
 To configure policy routing

1. Right-click the Firewall element for which you want to define policy routing and select
Properties. The Properties dialog opens.
Illustration 34.5 Firewall Properties - Advanced Tab
3. Click the Policy Routing button. The Policy Routing dialog opens.

Illustration 34.6 Policy Routing Dialog
4. Click Add. A new entry appears in the table.

5. Double-click the cells and enter the required routing information (note that Routing is done
after NAT):
Setting Description
This is always something other than the default 0.0.0.0 that matches
Source IP Address any IP address (such configurations can be handled more easily with the
normal routing tools in the Routing view).
Source Netmask Enter the netmask for the source IP address.
Destination IP Address Enter the destination IP address.
Destination Netmask Enter the netmask for the destination IP address.
The IP address of the device to which packets that match the source/
Gateway IP Address
destination pair are forwarded.
6. Repeat from Step 4 to create any additional policy routing entries, then click OK. The Policy
Routing dialog closes.
7. Click OK. The Properties dialog closes.
What’s Next?
Related Tasks
 Policy routing entries are not automatically added to the Antispoofing view, so you may need
to update the antispoofing information manually. See Modifying Antispoofing for Firewalls
(page 454).

Adding Routes for IPS Components
Prerequisites: None
IPS components do not route traffic. Sensor interfaces that pick up traffic for inspection do not
need any manual routing configuration. You may need to define a default route if the
Management Center (Management Servers and Log Servers) and other system components are
not located on a directly connected network. Other routes may be needed in addition to the
default route if one or more system components are not directly connected and cannot be
reached through the default gateway. The IPS system communications include:
• management connections (all StoneGate IPS components)
• communication to Analyzer (Sensors only)
• communication to Log Server (all StoneGate IPS components)
• blacklisting commands to StoneGate firewalls and sensors (Analyzers only).
 To add a route for a StoneGate IPS component

2. Select the correct IPS element from the list above the Routing tree.
3. Expand the tree and browse to the interface from/to which traffic is to be routed. A Network
element corresponding to the interface’s IP address is shown.
4. Add a Router to the Network element.
• If the Router element you want to add already exists, drag and drop it onto the Network in
the Routing tree.
• If the Router element does not exist, create a new Router element by right-clicking the
Network element under the correct interface in the Routing tree and selecting
NewRouter.
• To add a default route, right-click the Router element you just added in the Routing tree
below the Router in the Routing tree.
• To create a new Host or Network element, use the right-click menu for the Router element
you just added in the Routing tree.
What’s Next?
 Refresh the IPS policy on the Sensor to transfer the changed configuration.
Related Tasks
 You may want to do a quick check with a few IP addresses to test your routing configuration.
See Checking Routes (page 456).
Adding Routes for IPS Components 453

Removing Routes
Prerequisites: Adding Routes for Firewalls/Adding Routes for IPS Components
You can remove any element you have added to the routing tree yourself at any time. Elements
that are added automatically based on the IP addressing of the interfaces cannot be removed
while they are still in use. Use the Access rules to control access to/from such addresses (see
Automatically added elements corresponding to a previous configuration are not automatically
removed when the IP address of an interface is changed to prevent any possible manual routing
definitions from being deleted accidentally. Instead, the elements that belong to the old
configuration are shown as invalid and you must remove the obsolete elements manually.
Removing elements from routing does not delete the elements from the system.
 To remove an element from the Routing tree

 Right-click the element in the Routing view and select Remove. The element is removed
from routing.
Modifying Antispoofing for Firewalls

Prerequisites: Adding Routes for Firewalls
Antispoofing is an important security measure. Antispoofing is intended to prevent malicious

attempts to use a legitimate internal IP address to gain access from lower-security networks to
higher-security networks. Antispoofing determines which addresses are valid source addresses
for the network(s) connected to each interface. If an interface receives a packet with a source
address that is not a valid source address for the network(s) that are connected to that
interface, the packet is considered to come from a spoofed IP address.
Firewalls automatically determine antispoofing rules based on the routing configuration. In most
cases, there is no need to change the antispoofing configuration in any way.
What’s Next?
 If you want antispoofing to allow connections that would otherwise be dropped, see
Deactivating Antispoofing for an IP Address/Interface Pair (page 455).
 If you want antispoofing to drop connections that it currently allows, see Activating
Antispoofing for Routable IP Addresses (page 456).

Deactivating Antispoofing for an IP Address/Interface Pair
In rare cases you may need to modify the default antispoofing definitions to make exceptions to
the antispoofing rules (for example, if you have defined policy routing manually). Manually
modified entries are marked with a plus sign (+) (active entries) or a minus sign (–) (disabled
entries) in the Antispoofing view to distinguish them from the automatically generated
antispoofing entries.
Note – Errors in the routing configuration (in StoneGate or in the surrounding network) can
cause legitimate packets to be incorrectly identified as coming from a spoofed IP address.
Always check that the routing is configured correctly before modifying antispoofing. For
example, routing loops generate log messages about spoofed packets, which cannot be
removed by any antispoofing changes.
By default, the firewall interprets the antispoofing tree by picking the most specific entry defined
in the view (for example, a definition of a single IP address is picked over a definition of a whole
network). In the default mode, if some IP address must be allowed access through two or more
different interfaces, the definition for each interface must be at the same level of detail for the
IP address in question.
Example If Interface A contains a Host element for 192.168.10.101 and Interface B contains a
Network element for 192.168.10.0/24, connections from 192.168.10.101 are considered by
default spoofed if they enter through Interface B, even though the address is included in the
Network element. The antispoofing configuration must be modified to allow the address also
from Interface B.
 To configure antispoofing
1. Select ConfigurationAntispoofing from the menu. The Antispoofing view opens.
2. Select the correct Firewall element from the list above the Antispoofing tree.
3. Add the element that represents the IP addresses for which you want to create an
exception to the Antispoofing tree in one of the following ways:
• Drag and drop an existing element on top of the interface through which you want the
element’s IP address(es) to be available.
• Create a new element by right-clicking the Network element under the correct interface
and selecting New(type of element).
4. (Optional) If you want to allow all connections from a network through a specific interface,
right-click the network under the correct interface and select Absolute. All the IP addresses
that belong to that network are now allowed for the interface, although more specific
antispoofing definitions for some addresses in the network may be defined for other
interfaces.
Caution – Never mark the Any Network element as Absolute. Disabling antispoofing in this
way is a security risk. Resolve large-scale antispoofing conflicts with specific antispoofing
definitions or by changing routing.
What’s Next?
Modifying Antispoofing for Firewalls 455

Activating Antispoofing for Routable IP Addresses
The Antispoofing view shows the allowed addresses for each interface. Only the first interface
selected for an aggregated link is shown in the Antispoofing view. Manually modified entries are
marked with a plus sign (+) (active entries) or a minus sign (–) (disabled entries) in the
Antispoofing view to distinguish them from the automatically generated antispoofing entries.
There is rarely any need to change the automatically added entries. The preferred way of
preventing routing for IP addresses is to change the Routing view instead.
Note – Disabling or removing elements in the Antispoofing view prevents access. The IP
addresses a disabled or removed element represents are considered spoofed addresses.
 To remove an element from the Antispoofing tree

 Right-click the element and select Remove.
 To disable an element in the Antispoofing tree

 Right-click the element and select Disable. You can again re-enable the element in the
same way when needed.
What’s Next?
Checking Routes
Prerequisites: None
The Routing view includes a Route Query tool that you can use to check where packets with a
certain IP address are routed according to the current definitions. The tool helps you check that
the routing is correct and to quickly find a particular branch in the Routing tree.
Policy routing is not considered in this query. The route query uses the configuration that is
currently stored on the Management Server (shown in the Management Client). You must
refresh the policy of the affected engines after completing the configuration to transfer the
changed routing information.
 To check routes with a Route Query

2. Select the correct engine element from the list above the Routing tree.
3. Right-click the engine element and select Query Route. The Query Route dialog opens.

Illustration 34.7 Route Query
4. Enter an IP address and click Query. The route is shown in the space below.
Checking Routes 457

C HAPT ER 35
OUTBOUND TRAFFIC MANAGEMENT
StoneGate firewall’s Multi-Link feature allows you to distribute outbound traffic between two or
more Internet connections to provide high availability and load balancing for outbound traffic.
Getting Started with Outbound Traffic Management (page 460)

Configuring Outbound Multi-Link Settings (page 461)
Creating Outbound Load Balancing NAT Rules (page 465)
Monitoring And Testing Outbound Traffic Management (page 466)
459
Getting Started with Outbound Traffic Management
Prerequisites: See the Configuration Overview below
What Outbound Traffic Management Does

Stonegate firewalls can balance outbound traffic between two or more network links (NetLinks)
using the Multi-Link feature. NetLinks are combined into Multi-Link elements. The NetLinks may
be of different types and they may have different speeds. You can also use Multi-Link with
aggregated links.
Multi-Link allows you to:
• Balance outbound traffic between two or more alternative network links to increase the
available bandwidth.
• Ensure that outbound network connectivity remains available even if network links fail. When
a network link fails, the firewall detects this and stops forwarding traffic through the failed
link.
Limitations
• VPN traffic is balanced independently from the settings covered in this configuration (when
the firewall is the VPN end-point).
• If you configure IGMP proxy multicast routing and use a NetLink on a firewall’s upstream
interface, you cannot use NetLinks on any of the firewall’s downstream interfaces.
What Do I Need To Know Before I Begin?
For a truly redundant configuration, we recommend connecting each link through different
physical network equipment (such as routers).
460 Chapter 35 Outbound Traffic Management

Router
Network NetLink
Firewall
Policy
Outbound
Multi-Link
QoS Class
1. Configure routing with at least two NetLinks. See Defining a Multi-Link Route for a Firewall
(page 442).
2. If you want the firewall to select the NetLink based on the type of traffic, create QoS Classes
and assign them to traffic. See Getting Started with QoS (page 616).
3. Create an Outbound Multi-Link element to group your NetLinks and define traffic
management settings. See Configuring Outbound Multi-Link Settings (page 461).
4. In the Firewall Policy, create a NAT rule in for outbound load balancing. See To define NAT
rules for outbound load balancing (page 465).
Configuring Outbound Multi-Link Settings

Prerequisites: Defining a Multi-Link Route for a Firewall, (optional) Creating QoS Classes
Outbound Multi-Link elements are used for combining NetLinks and for setting options for the
high availability and load balancing features.
There are two methods for link selection. If link selection is based on Round Trip Time, engines
send a connection to all the links, and then select the link that delivers the response the
fastest. The link selection can also be based on a Ratio of the relative bandwidth of each
NetLink. You must configure the basic settings for these methods in the properties of each
NetLink (see Creating NetLinks (page 443)).
What’s Next?
 Combine your NetLinks into Outbound Multi-Link element(s). Proceed to Creating an
Outbound Multi-Link Element (page 462).
Configuring Outbound Multi-Link Settings 461

Creating an Outbound Multi-Link Element
The Outbound Multi-Link element collects together the NetLinks and sets options for the load
balancing. The Outbound Multi-Link elements you create do not work on their own; you must use
them in the Firewall Policy’s NAT rules to select traffic for outbound load balancing.
 To define an Outbound Multi-Link element

view opens.
2. Browse to Network ElementsTraffic Handlers.
3. Right-click Traffic Handlers and select NewOutbound Multi-Link from the menu. The
Outbound Multi-Link Properties dialog opens.
Illustration 35.2 Outbound Multi-Link Properties
4. Give the Outbound Multi-Link element a unique Name.

5. (Optional) Add a free-form Comment for your own reference.
6. Specify the Method for link selection:
• Round Trip Time: The firewall periodically probes the NetLinks to test them for speed and
selects the fastest available active NetLink for each new outbound connection.
• Ratio: Traffic is distributed between all of the available active NetLinks according to the
relative bandwidth of each NetLink. The NetLink with the highest bandwidth is assigned
the largest portion of the traffic.
What’s Next?
 Continue by Selecting NetLinks for an Outbound Multi-Link (page 463).

Selecting NetLinks for an Outbound Multi-Link
 To add a NetLink to an Outbound Multi-Link element
1. Click the Add button. The Multi-Link Member dialog opens.
Illustration 35.3 Multi-Link Member Dialog
2. Select a NetLink.
3. Select the Network element that represents the IP address space in the directly connected
external network of this network link.
4. In the Selected Range fields, specify the IP address range for dynamic source address
translation (NAT) for the internal source IP addresses on this NetLink. To define a single IP
address, enter the same address in both fields.
• Since Multi-Link works without external arrangements, the address translation is
necessary for correct routing of packets.
5. Select the Type:
• Active: traffic is routed through the NetLink according to the Method you specify in the
Outbound Multi-Link element properties.
• Standby: traffic is only routed through the NetLink if all primary (active) NetLinks become
unavailable.
6. (Optional) Select the QoS Classes for traffic handled by this NetLink and click Add. You can
use the QoS classes to assign the NetLink with or without activating the actual QoS
features. For more information, see Getting Started with QoS (page 616).
• You can select the same QoS class for several NetLinks to balance the traffic between the
NetLinks. If none of the NetLinks with the appropriate QoS class are available, or if the
traffic has not been assigned a QoS class, the traffic is distributed between the NetLinks
according to the Method you specify in the Outbound Multi-Link element properties.
• QoS classes are assigned based on ToS codes in network traffic or in the Access rules.
Traffic that has been assigned the selected QoS class uses this NetLink if the NetLink is
available.
7. Click OK. The Multi-Link Member dialog closes, and the NetLink is listed in the Multi-Link
Members list.
Configuring Outbound Multi-Link Settings 463

8. Repeat these steps for each NetLink you want to add to the Outbound Multi-Link element.
When you are finished, click OK in the Multi-Link Properties dialog.
What’s Next?
 If you want to define how information on NetLink performance is cached, continue by
Defining Destination Cache Settings (page 464).
 Otherwise, proceed to Creating Outbound Load Balancing NAT Rules (page 465).
Related Tasks
 Changing NetLink State Manually (page 195)
Defining Destination Cache Settings

Information about the performance of each NetLink is cached. No new measurement is made if
a new connection is opened to the same destination within a short time period. You can define
the duration of the cached information.
 To define destination cache settings

1. Switch to the Advanced tab in the Outbound Multi-Link Properties.
Illustration 35.4 Outbound Multi-Link Properties - Advanced Tab
2. Deselect Default.
3. Enter the Timeout (in seconds) after which a new measurement of NetLink performance is
made. The default is 3600 seconds.
4. Enter the number of Maximum Retries for checking each NetLink. The default is 2.
5. Click OK.
What’s Next?
 Continue by Creating Outbound Load Balancing NAT Rules (page 465).

Creating Outbound Load Balancing NAT Rules
Prerequisites: Defining a Multi-Link Route for a Firewall, Configuring Outbound Multi-Link Settings
To balance outbound connections between the NetLinks, you must define NAT rules using the
source NAT addressing defined in the Outbound Multi-Link element.
You can create several Outbound Multi-Link elements to balance different types of traffic
differently. If there is some traffic that you do not want to balance at all, you can direct traffic
through a specific NetLink with a normal NAT rule that translates the source using a particular
NetLink's address space and matches the desired connections before the balancing rule.
 To define NAT rules for outbound load balancing

1. Right-click the policy and select Edit from the menu. The policy opens for editing.
2. Switch to the IPv4 NAT tab.
3. Add a new rule and specify the Source, Destination, and Service according to the traffic
that you want to balance using a particular Outbound Multi-Link element.
4. Double-click the NAT cell. The Network Address Translation dialog opens on the Source
Translation tab.
5. Select Dynamic as the Translation Type.
6. Click the Select button next to the IP Address Pool field. The Select Element dialog opens.
7. Browse to Network ElementsTraffic Handlers and select the Outbound Multi-Link
element.
8. (Optional) Specify a port range for source port translation by entering port numbers in the
First Port to Use and Last Port to Use fields. The default is to use all “free” high ports
from 1024 to 65535.
Note – Make sure that the IP address pool and port range are large enough to translate
the number of simultaneous connections that match this NAT rule.
9. Select/deselect Automatic Proxy ARP:

• Make sure that this option is selected if you want proxy ARP entries to be generated.
• For proxy ARP to work, the untranslated IP address of all hosts whose IP address is
translated must be included in the routing configuration in the Routing view (that is, there
is a CVI with an address from the same network defined in the Firewall element’s
properties or the Network or Host is manually added to the Routing view).
• Deselect the option to disable proxy ARP.
10.Click OK.
Illustration 35.5 Outbound Load Balancing NAT Rule - Example
Creating Outbound Load Balancing NAT Rules 465

This completes the configuration outlined in the Configuration Overview (page 461). Save and
install the policy to transfer the changes to the engines.
What’s Next?
 To follow up on how your Multi-Link configuration works, see Monitoring And Testing
Outbound Traffic Management (page 466).
 To configure inbound traffic management, see Getting Started with Inbound Traffic
 VPNs have independent link selection. To configure active and standby links (tunnels)
for VPNs, see Defining VPN Tunnel Settings (page 746).
Monitoring And Testing Outbound Traffic Management

Prerequisites: See Getting Started with Outbound Traffic Management
The status of the different NetLinks can be monitored in the System Status view. See Getting
Started with System Monitoring (page 84). Status is displayed based on the results of status
probes to the Probing addresses configured in the NetLink elements.
You can test that the outbound traffic management configuration works as intended by
generating traffic and then disabling network connections, for example, by unplugging cables (in
a cluster, disable the same link on all active nodes to simulate ISP failure).
Note – By default, if you unplug a cable from a node in a cluster, the automatic engine
tester recognizes this as a malfunction and turns the node offline (unless it is the last node
that remains online). To override this automatic test, command all nodes to “Lock Online”
for the duration of the test.
Most connections that are currently open on the link that goes down are cut and must be
reopened by the communicating applications, since the external IP address used in the
communications changes to an address of the new link. Any type of traffic can switch to using a
different link completely transparently if it is transported through a Multi-Link VPN between two
StoneGate Firewall/VPN engines.
If the Ratio-based load-balancing method is used, a link is used until a failure is detected based
on the link status probes to the Probing addresses configured in the NetLink elements. With
the Round Trip Time method, new connections are directed to working links (since the link that
responds the fastest is chosen) even if probing is not configured or working.
Related Tasks
 Getting Started with the Engine Tester (page 398).

C HAPT ER 36
INBOUND TRAFFIC MANAGEMENT
Firewalls allow you to set up a server pool that distributes the load of incoming traffic between
a group of servers and/or allows controlling the NetLink use of incoming traffic in a Multi-Link
setup. This ensures that services remain available even when one or more servers or
NetLinks fail, and balances the load of incoming traffic more efficiently between a group of
servers.
Getting Started with Inbound Traffic Management (page 468)

Defining a Server Pool (page 469)
Installing Monitoring Agents (page 472)
Uninstalling Monitoring Agents (page 473)
Configuring Monitoring Agents (page 474)
Enabling Monitoring Agents (page 488)
Entering the Server Pool’s IP Addresses on Your DNS Server (page 488)
Creating Access Rules for Inbound Load Balancing (page 489)
Configuring Dynamic DNS Updates (page 490)
Monitoring and Testing Monitoring Agents (page 493)
467
Getting Started with Inbound Traffic Management
Prerequisites: None
Inbound traffic on a firewall can be managed with a server pool.

What Inbound Traffic Management Does
The first and primary use for a server pool is to offer load-balancing and high availability for two
or more servers that offer the same service to users. A second use is to control which NetLink
incoming traffic uses. Inbound traffic management can:
• load-balance incoming traffic between several servers to even out their workload
• monitor the server’s status so that the traffic is not directed at unavailable or overloaded
servers (if the optional Monitoring Agents are installed on each server)
• send dynamic DNS (DDNS) updates to a DNS server to prevent incoming traffic from
attempting to use a non-functioning NetLink in a Multi-Link setup (with or without using the
other features of Server Pools).
Limitations
• DDNS updates have no access control, so the communications must be secured in other
ways.
• Standby servers cannot be defined for a server pool. Only load-balancing between the servers
in the server pool is supported.
• Only TCP and UDP protocols are supported for server pools.
• Source address translation is not supported for server pools.
What do I need to know before I begin?
• Each server pool should only offer one type of service. If the same servers provide more than
one service (for example, HTTP and HTTPS), create separate Server Pools for each service.
468 Chapter 36 Inbound Traffic Management

Hosts Server Firewall

Pool Policy
1. Create Host elements for all servers you want to include in the server pool (unless already
defined).
2. Define a Server Pool element and define settings for server load sharing and inbound
traffic management (see Defining a Server Pool (page 469)).
3. Check that the IP addresses defined as the servers’ public, external addresses in the
Server Pool properties correspond to the entries for them in the DNS server (see Entering
the Server Pool’s IP Addresses on Your DNS Server (page 488)).
4. Modify your policy to include inbound traffic management (see Creating Access Rules for
Inbound Load Balancing (page 489)).
5. (Optional) If you want to use Server Pool Monitoring Agents, install, configure, and enable
them (see Installing Monitoring Agents (page 472)).
6. (Optional) If you want to send dynamic DNS (DDNS) updates to a DNS server when
NetLinks go down, configure the updates (see Configuring Dynamic DNS Updates
(page 490)).
Defining a Server Pool

Prerequisites: None
The Server Pool element collects servers that provide a particular service into a single element
and defines the settings for handling the inbound traffic.
What’s Next?
 Begin by Creating a New Server Pool Element.
Creating a New Server Pool Element

Add servers in Server Pools based on the services that the servers provide. The Server Pool
considers all included servers to be equal. If the same servers provide more than one service,
create separate Server Pools for the different services even if the same services run all servers
(each Server Pool reserves an additional IP address).
 To create a new Server Pool element

2. Browse to Network Elements.
3. Right-click Traffic Handlers and select NewServer Pool from the menu. The Server Pool
Defining a Server Pool 469

4. Enter a unique Name for the Server Pool.
What’s Next?
 Continue by Defining Server Pools’ External Address(es).
Defining Server Pools’ External Address(es)

Clients make their incoming connections to the address of the Server Pool. The firewall then
decides which server is going to handle the connection and translates (in a NAT operation) the
public address to the private IP address of that server. The external address or addresses of the
Server Pool are defined as properties of the Server Pool element.
Note – Make sure your NAT rules do not overlap with the NAT of the Server Pool.
 To add External Addresses

1. Click the Add button in the External Addresses section of the Server Pool Properties dialog.
The External Address dialog opens.
Illustration 36.2 External Address
2. Select the NetLink you want to use, or if you want to configure load sharing for the servers
but no traffic balancing between NetLinks, select Not Specified.
3. For the Network, select the Network element that is used for the Server Pool’s external
NATed address.
4. Define the external NATed destination IP Address for the Server Pool. This is the address
client machines contact when accessing the service that the server(s) in the pool offer.
Note – The IP address you enter here must be reserved for NAT and it must not be used by
any equipment in your network. Remember to update your DNS server with any changes in
IP addressing.
5. In Status, select Enabled to use the NetLink for the Server Pool.
6. (Recommended) Select Proxy ARP Entry Generation to automatically generate a proxy ARP
for the NATed address in the selected Network. Otherwise, you must define the ARP entry
manually in the Firewall element properties.

7. Click OK to add the external address. Repeat these steps for any other NetLinks that
handle traffic to this Server Pool.
What’s Next?
 Continue by Adding Server Pool Members.
Adding Server Pool Members

You must add a Host element for the internal IP address of each member of the pool. The
firewall uses these addresses to select which server handles which traffic that arrives to the
Server Pool’s external address.
The Server Pool can have any number of members. You can also create a one-server Server Pool
to enable DDNS updates for a single server when ISP links go down if the server does not need
the other Server Pool features.
 To add Server Pool members

1. Click Select in the Server Pool Members section of the Server Pool Properties dialog. The
Select Element dialog opens.
2. Select the elements for the members of the pool.
• You can use either Server elements (for servers that have some special role in the
StoneGate configuration) or Host elements (for other servers).
• To create new elements to represent the Server Pool members, browse to Network
Elements and use the New icon above the element list.
3. In Allocate Traffic to Servers by, select the granularity for the server selection (defines
how ‘sticky’ the selection is). Usually it is best to choose the least granular option that still
produces an acceptable distribution of traffic. The options are (from least granular to most
granular):
• Source Network directs traffic coming from the same C-class network to the same
server. This is a good choice when connections come from many different networks. The
Not Defined setting has the same effect.
• Host directs traffic coming from the same IP address to the same server. This is a good
choice when a large portion of connections come from different hosts in the same C-class
network.
• Connection makes a new traffic management decision for each new connection. This
choice may be necessary if a large portion of connections uses just one IP address.
Note – Consider the type of traffic when selecting the allocation method. Using the Host
setting (if the host’s IP address apparent to StoneGate can change) or the Connection
setting (in all cases) means that connections from the same source may be directed to
different servers. Depending on the services offered, this may deteriorate service quality.
4. Define the Monitoring mode for the availability of the servers in the Server Pool.
• Select Ping if you want StoneGate to monitor the availability of the servers by using
periodical ICMP echo request (ping) messages.
• Select Agent if you want to use the Server Pool Monitoring Agent feature. The default port
for the servers to listen on is UDP 7777, but you can select a different port in the Port
field.
Defining a Server Pool 471

5. Click OK.
What’s Next?
 If you are using Monitoring Agents, continue to Installing Monitoring Agents (page 472).
 Otherwise, continue to Entering the Server Pool’s IP Addresses on Your DNS Server
(page 488).
Installing Monitoring Agents

Prerequisites: Defining a Server Pool
Server Pool Monitoring Agents are installed on the servers that form the pool to report about the
server’s health and load. The firewall uses the information to send traffic to the server that can
best handle the additional load and not send new connections to a server that is inoperative.
You must install the Server Pool Monitoring Agents onto all members of the Server Pool.
 To install in Windows
1. Copy the ServerPool_Monitoring_Agent_Installer\Windows\ directory from the
StoneGate Management Center installation CD to the Server Pool member on which you
wish to have the Monitoring Agent installed.
2. Run the self extracting installation program sgagent.exe.
3. Repeat these steps on all Server Pool members.
What’s Next?
 Proceed to Configuring Monitoring Agents (page 474).
 To install in Linux
1. Copy the ServerPool_Monitoring_Agent_Installer/Linux/ directory from the
StoneGate Management Center installation CD to the Server Pool member on which you
wish to have the Monitoring Agent installed.
2. Go to the location where the directory was copied, and extract the SGFWagent package.
Then run the rpm command. For example, you can use the following commands. The name
of the .rpm file may vary depending on the version you are using.
cp SGFWagent.tar /var/spool/pkg
cd /var/spool/pkg
tar -xf SGFWagent.tar
rpm -i sgagent-4.0.0.build403-1.i386.rpm
What’s Next?

 To install in Solaris
1. Copy the ServerPool_Monitoring_Agent_Installer/Solaris/ directory from the
StoneGate Management Center installation CD to a Server Pool member on which you wish
to have the Monitoring Agent installed.
2. Go to the location where the directory was copied. Untar the SGFWagent package and run
the package add command. For example, you may use the following commands:
cp SGFWagent.tar /var/spool/pkg
cd /var/spool/pkg
tar -xf SGFWagent.tar
pkgadd
3. Select SGFWagent for installation.

What’s Next?
Uninstalling Monitoring Agents

Prerequisites: If you plan to remove all Monitoring Agents, reconfigure the Server Pool not to use them
 To remove the Monitoring Agent in Windows

1. Open the Windows Control Panel.
2. Click Add/Remove Programs.
3. Select StoneGate Monitoring Agent and follow the instructions.
 To remove the Monitoring Agent in Linux

 Run the following command:
• rpm -e sgagent
 To remove the Monitoring Agent in Solaris

 Run the following command:
• pkgrm SGFWagent
Uninstalling Monitoring Agents 473

Configuring Monitoring Agents
Prerequisites: Installing Monitoring Agents
The Monitoring Agents are configured in two files: sgagent.local.conf and sgagent.conf.
Both files are found in the following directory on each server:
• Solaris: /opt/sgagent/etc/
• Linux: /etc/stonegate/
• Windows: Program Files\Stonesoft\StoneGate Monitoring Agent\
The sgagent.local.conf file contains server-specific information, and is different for each
server. If you do not want to change the default values, there is no need to edit this file.
The sgagent.conf file contains information that refers to the entire Server Pool.
What’s Next?
 To define settings specific to individual servers, proceed to Editing sgagent.local.conf
(page 474).
 If you only want to configure global settings for all servers, proceed to Editing
sgagent.conf (page 475).
Editing sgagent.local.conf
The server-specific file sgagent.local.conf includes information to identify the Server Pool
member if default values are not used. If the file is not configured, the Monitoring Agent uses
the system host name as the default value to identify the member. If edited, this file must be
different on each Server Pool member.
Table 36.1 Statements in sgagent.local.conf
Statement Description
Specifies hostname of the server. If no value is defined, the system host name
host hostname
is used.
set alias Defines the value of an alias that can be used as a variable in the global
value sgagent.conf configuration.
For example, to configure the member of the pool where sgagent.local.conf resides to use
server1 as its host name, and to set the alias hostip to 192.168.1.1:
host server1
set hostip 192.168.1.1
What’s Next?
 Proceed to Editing sgagent.conf (page 475).

Editing sgagent.conf
The file common to all Server Pool members is called sgagent.conf. In this file, you define
attributes for the entire Server Pool. In most cases, the Server Pool members are similar in
configuration and function, so the tests performed on each member are also similar. Usually,
the same sgagent.conf file is used on all servers. The sgagent.conf file contains two
sections: the statement section and the test section. See Illustration 36.3.
Illustration 36.3 An Example sgagent.conf File

# ---------------------------START OF STATEMENT SECTION
begin host server1
config boot-delay 5:00 # set the config delay on the slow member
end
begin host not server1
config boot-delay 20 # 20s config delay on other members
end
config alert-interval 1:00:00
config startup-script /etc/scripts/startup.sh
# Monitor one minute load average and set alert threshold at 5
load-index 500 load-average-1
# ---------------------------START OF TEST SECTION
# Tests
test "webster listening"
interval 2:00
action exclude
recovery 10:00
command portlistening 80 %hostip% # Check that this member's
# port 80 is listening.
test "server1 running baz"
interval 10:00
action exclude
host server1
script /etc/init.d/baz start
command servicerunning baz
test "external1"
interval 10:00
action alert
command external 3 700 /usr/lib/webster/test.sh 212.20.2.21
What’s Next?
 Proceed to Editing the sgagent.conf Statement Section (page 476).
Configuring Monitoring Agents 475

Editing the sgagent.conf Statement Section
In the statement section, you can define general commands for the tests the Monitoring Agents
perform. A statement can apply to all or only some members of the Server Pool.
Table 36.2 Statements in the sgagent.conf Statement Section
Statement Description
If you wish a statement to apply to certain Server Pool members only, the
statement must start with the begin host command followed by the name of
the Server Pool member.
The begin host command may be followed by actual server names or an
exclusion. In an exclusion, begin host is followed by not and the server name,
instead of just a server name. This indicates that the setting is to be applied to
begin host hostname all other servers except the one specified.
For example, the following statement would apply to all members in the pool
except server1:
config settings
end
config
[port port_number]
[boot-delay time]
[alert-interval time]
[alert-script path]
[startup-script path] Defines the option in question. See Options in the sgagent.conf Statement
[overload-script path] Section (page 477) for more information about the options. If a statement
[listen IP_address applies to all members in the pool, you can enter the setting on a single line
[:port]] without using begin or end.
[load-index threshold
index_name
[index-parameter]]
[load-index-action
exclude threshold]
end Ends the statement when begin is used.
What’s Next?
 Proceed to Options in the sgagent.conf Statement Section (page 477).

Options in the sgagent.conf Statement Section
When you want to configure a particular setting, the syntax starts with the command config.
The available options are listed below.
Table 36.3 Options in the sgagent.conf Statement Section
Option Description
port port_number Specifies the port that the Server Pool uses for communication with the engines.
All Server Pool members must use the same port number; the port setting cannot
start with the begin host command. The port number can be from 0-65535.
By default, the port is set to 7777. If you use another port instead of the default
port, you must modify the IPv4 Access rules to allow connections to the new port.
Defines how long the tester waits before starting the tests after the system has
been booted up or restarted to ensure that all necessary processes have
boot-delay time
completed their startup. Time is entered in the format [(hh:)mm:]ss. The default
is 30 seconds.
Defines how long the system waits before sending a new alert in response to a
alert-interval time test failure to prevent excessive alerts from being sent. Time is entered in the
format [(hh:)mm:]ss. The default is 1 hour.
Specifies the path to a custom alert script. You must use quotation marks if the
alert-script path path contains spaces. This is only needed when you want to use a custom alert
script. There is no default value.
Specifies the path to the custom script to be run when the Monitoring Agent
startup-script path
starts. You must use quotation marks if the path contains spaces.
Specifies the path to the custom script to be run if the load index exceeds the
overload-script path threshold value defined with the load-index statement. You must use
quotation marks if the path contains spaces.
Specifies the IP address the Monitoring Agent listens on. If no IP address is

listen IP_address
specified, the first IP address of the interface is used by default. If no port is
[:port] defined, the default port (7777) is used.
Defines the method that is used to measure the load. We recommend using the
same method of measurement for all members of the Server Pool. If the load
load-index threshold measurement exceeds the defined threshold, a log message and an alert are
index_name generated.
[index-parameter] The index_name can be a complex expression combining multiple methods with
basic arithmetic operations (+ - * /), such as “index-name + index-name”. The
index_name options are explained in Table 36.4.
Excludes the server from handling traffic for the specified time (in seconds)
load-index-action when the threshold value of the load-index is reached. When the server has
exclude switched to the Excluded state, the server does not return to the normal state
[time] until the specified length of time has elapsed, even if the load of the server has
dropped to a normal level.

Table 36.4 Index_name Options
Option Description
Measures the average processor load level over the specified time period. The
processor-load time time is entered in the format [(hh:)mm:]ss. The returned value is a percentage
value from 0-100.
Measures the average processor time spent in the kernel mode over the specified
processor-kernel-load
time period. The time is entered in the format [(hh:)mm:]ss. The returned value is
time
a percentage value from 0-100.
Measures the average number of processes waiting in the execution queue due
to reserved resources over the specified number of minutes. The options for the
load-average-minutes
value of minutes are 1, 5, or 15. The returned value is the load average for the
specified time period multiplied by 100.
What’s Next?
 To see some examples that illustrate the statement configuration explained so far,
proceed to Monitoring Agent Statement Configuration Examples.
 To skip the examples and see how to configure the Test section, proceed to Editing the
sgagent.conf Test Section (page 480).
Monitoring Agent Statement Configuration Examples

Port Option Example
To use port 5555 for the communication between the engine(s) and the Server Pool members
instead of the default port:
config port 5555
Boot-delay Option Example

To set a boot delay of 20 seconds on server1:
begin host server1

config boot-delay 20
end
Alert-interval Option Example

To set an alert interval of 1 hour on servers 1 and 2:
begin host server1 server2

config alert-interval 1:00:00
end

Alert-script Option Example
To run alertscript.sh every time an alert is generated:
config alert-script /etc/test/alertscript.sh
Startup-script Option Example

To run startup.sh when the Monitoring Agent starts on server1:
begin host server1

config startup-script /etc/test/startup.sh
end
Overload-script Option Example

To run overload.sh script when the threshold value of the load index is reached on server2:
begin host server2

config overload-script /etc/test/overload.sh
end
Listen Option Example

To make the Monitoring Agent of server2 listen to the IP address 192.168.10.31 using the
default port 7777:
begin host server2

config listen 192.168.10.31
end
Load-index Option Example

This example demonstrates how the measurement of load-average-5 is used on all servers
except server1 to compare against the threshold value 4. When the load-average is higher
than 4, a log message is generated.

config load-index 400 load-average-5
end
Because server1 is ignored in the previous statement, it would typically have its own statement
with different options, such as the one below:
begin host server1

config load-index 400 load-average-1
end

Load-Index-Action Option Example
To set the server status to Excluded when the threshold value of the load index is reached on
server2:
begin host server2

config load-index-action exclude 10
end
What’s Next?
 Proceed to Editing the sgagent.conf Test Section (page 480).
Editing the sgagent.conf Test Section

The second part of the sgagent.conf file specifies which tests the Monitoring Agents carry out
on the servers they monitor. A test begins with the test definition, followed by optional
parameter lines, and ends with the command definition. The test and command parameters are
always required. The interval, action, host, script, and recovery parameters are optional
and have their default values if not specified for the test.
Table 36.5 Parameters in the sgagent.conf Test Section
Parameter Description
Begins the test definition. Specifies the name of the test. The name
appears in the logs and alerts in the event of a failure, so it should be
descriptive to give the administrators enough information about what has
test name happened. The test name may be any string. You must use quotation
marks if the name contains spaces.
This parameter is required and has no default value.
Defines how often the test is executed. Time is entered in the format
interval time [(hh:)mm:]ss. The minimum interval is 3 seconds and the maximum is 1
day. If no interval is defined, the default is 60 seconds.
Defines what to do if the test fails.

alert creates an alert entry and runs the alert script if one is defined for
the test.
action alert|exclude exclude sets the server status to Excluded and creates an alert. No new
connections are directed to the excluded server and the current
connections are moved to the other members of the pool.
If no action is set for the test, alert is the default action.
Defines the server to be tested. If the name of the server is specified in

the host field of sgagent.local.conf, that name must be used here.
Otherwise, the default host name of the server must be used. See Editing
host server sgagent.local.conf (page 474) for more information.
You can also list multiple server names, separated by spaces.
If no specific server is defined, the test is performed on all Server Pool
members by default.

Table 36.5 Parameters in the sgagent.conf Test Section (Continued)
Specifies how many times the script is executed after the test fails, and
the path to the script file. You must use quotation marks if the path
contains spaces.
There are two options for how many times to execute the script after the
test fails:
script [always|repeat]
repeat defines the number of failures after which the script is no longer
path
run. The counter is reset each time the server status changes, or the test
succeeds.
always runs the script without restrictions on the number of failures.
If no argument is given, the script is run only after the first failure by
default.
Determines how long the tester reruns a failed test to see if it succeeds on
the next attempt.
There are two options for specifying the time period:
always: there are no time limits on how long the tester waits for the test
to succeed again. The server state is changed from Excluded to OK when
recovery always|time the test succeeds.
time: If the test succeeds in the defined time period after a failure, the
server state is changed from Excluded to OK. Time is entered in the format
[(hh:)mm:]ss.
If no recovery options are specified, the test is never rerun after a failure,
and the server state remains Excluded.
Specifies which test script to use, and the options for running the test.
This parameter is required and has no default value.
There are two options for specifying the test script:
external: indicates that an external test is used. External tests can be
created by combining predefined tests with AND, OR, and NOT operators,
or you can write your own script. Note that external tests must return an
exit code of 0 (zero) to indicate success. Any non-zero return value is
command interpreted as a failure.
external|test_expression test_expression: specifies the internal test to run. For more
information about the internal tests, see Editing Monitoring Agents’
[retry]
Internal Tests (page 483).
[timeout]
The other options are used as follows:
[path]
retry: specifies how many times the script is run before the test is
[parameters] considered failed.
timeout: specifies how long (in milliseconds) the tester waits for the test
result.
path: specifies the path to the external test script. You must use
quotation marks if the path contains spaces. The path is required for
external tests, and is not used for internal tests.
parameters: specifies any possible parameters that a specific test
may need.

What’s Next?
 To see some examples that illustrate the test configuration explained so far, proceed to
Monitoring Agent Test Configuration Examples (page 482).
 To skip the examples and see which internal tests are available, proceed to Editing
Monitoring Agents’ Internal Tests (page 483).
Related Tasks
 Enabling Monitoring Agents (page 488)
Monitoring Agent Test Configuration Examples

Internal Test Example
In this example, the test checks that server1 is listening to traffic on port 80. In this example,
the port information and the IP address of the server are required in the command definition. The
test is performed every two minutes, and in case of a failure, the server is excluded from the
Server Pool. If the test fails, the /etc/init.d/port start script is run. If the subsequent
tests succeed within 10 minutes of the failure, recovery occurs and the server returns to the OK
state.
test “port listening test”

interval 2:00
action exclude
host server1
script /etc/init.d/port start
recovery 10:00
command portlistening 80 192.168.1.1
External Test Example

In this example, the external test script test.sh is run. There are three attempts to run the test
before it is considered failed, and the tester will wait for one second before the test is timed
out. The test is run every 10 minutes, and in case of a failure an alert is generated.
test “multiple_services”
interval 10:00
action alert
command external 3 1000 /usr/lib/server/test.sh 192.168.1.1
What’s Next?
 Proceed to Editing Monitoring Agents’ Internal Tests (page 483).
Related Tasks
 Enabling Monitoring Agents (page 488)

Editing Monitoring Agents’ Internal Tests
All internal tests available for the Server Pool monitoring are listed below. The syntax for using
the tests in the command definition is described in Editing the sgagent.conf Test Section
(page 480).
Note – Some of the internal tests may not work on a VMware platform.
Table 36.6 Internal Tests
Test Description
Checks the available swap space. If the current amount of free swap
swapfree limit
space drops below the limit (given in kilobytes), the test fails.
Checks how many processes are currently running. If the number of

processcount count
processes exceeds count, the test fails.
Sends ICMP Echo Request messages to the defined IP addresses

multi-ping retry and waits for the replies. The test fails if none of the IP addresses
answers the ping query.
timeout
retry specifies how many ICMP Echo Request packets are sent to
ip_address
each IP address.
[ip_address [...]]
timeout defines how long (in milliseconds) the tester waits for the
reply.
Checks whether there is enough space left on a particular

partition. The test fails if the amount of free_space (in
kilobytes) is lower than the free space on the partition. The partition
filesystem partition
may also be identified by its path.
free_space
File system tests are quite taxing on the operating system. We
recommend that you set an interval of at least 15 minutes when
using this test.
Checks whether the specified service is running on the server. The

test fails if the specified service/process is not running. On Windows
servicerunning service_name platforms, the test checks whether the service called
service_name is running. In UNIX environments, the test checks
whether the process named service_name is running.
Checks whether the specified ip_address is listening on the server.

ip-listening ip_address
The test fails if the host does not have the specified IP address.
Checks whether the specified port is listening on the server(s). The

portlistening port test fails if the port is not in the listen state. You can optionally
[ip_address [protocol]] specify the ip_address at which to check for the port. The
protocol can be TCP or UDP.

Table 36.6 Internal Tests (Continued)
Test Description
Checks whether the TCP port answers a TCP query with the expected
response. The test fails if the port does not answer, or the answer
differs from the expected response.
Note that the Telnet protocol executes handshake procedures before
beginning the connection. If you use portanswer to test a Telnet
service, test the handshake procedure, not the Telnet prompt.
portanswer retry retry specifies how many attempts are made before the test is
timeout considered failed.
query timeout specifies how long the tester waits after sending a query to
response the port. The timeout is entered in milliseconds. If no response is
port received within the time period, the test fails.
[ip_address] query specifies the TCP query to send. You must use quotation
marks if the query contains spaces. If no query parameter is
specified, nothing is sent to the port.
response specifies the expected response to the TCP query. You
must use quotation marks if the response contains spaces.
port specifies the port to which the query is sent.
ip_address is the IP address to which the query is sent.
Checks whether the server answers an HTTP request for the specified
URL with the expected file. The test fails if the server does not
answer the HTTP request, or if the reply does not contain the contents
httpanswer retry of the specified file.
timeout port specifies the port to which the request is sent.
URL retry specifies how many attempts are made before the test is
considered failed.
file
timeout specifies how long the tester waits after sending a query to
port
the port. The timeout is entered in milliseconds. If no response is
[ip_address] received within the time period, the test fails.
ip_address is the IP address to which the requst is sent. If no
ip_address is specified, the tester sends the query to the localhost
address by default.
Checks that the specified interface is up. The test fails if the
specified network interface does not exist or is down. In Windows,
networkinterface-up interface
this test behaves similarly to the networkinterface-
linkstatus test described next.
networkinterface-linkstatus Checks the link-layer status of the specified interface. The test
interface fails if the specified network interface is not linked.
Checks whether a file exists on the server(s). The test fails if the file
file-exists path
is not found at the specified path.

What’s Next?
 To see some examples that illustrate the internal test configuration, proceed to
Monitoring Agent Internal Test Examples (page 485).
 To skip the examples and see how to enable the Monitoring Agents, proceed to Enabling
Monitoring Agents (page 488).
Monitoring Agent Internal Test Examples

Each test has an example configuration, which may differ from what you configure for your own
environment.
Swapfree Test Example
This example checks that there is at least 1500 kilobytes of free space on server 2. The test
runs at one-hour intervals and sends an alert if the test fails.
test “swapfree test”

interval 1:00:00
host server2
action alert
command swapfree 1500
Processcount Test Example

This example checks that there are a maximum of 2500 processes running on server2. The test
runs at 60-second intervals and sends an alert if the test fails.
test process_count
interval 60
host server2
action alert
command prosesscount 2500
Multi-ping Test Example

This example tests the connectivity of server2. The tester sends three ICMP Echo requests to
the IP addresses 192.168.1.2 and 192.168.1.254, and waits 1000 milliseconds for a reply.
The test runs at 30-second intervals. If the test fails, server2 is excluded from the Server Pool.
test “multi-ping test”

interval 30
host server2
action exclude
command multi-ping 3 1000 192.168.1.2 192.168.1.254

Filesystem Test Example
This example checks that there is at least 1000 kilobytes of free space in the /var/tmp
partition on server2. The test runs at 15-second intervals and sends an alert if the test fails.
test “free space in filesystem”

interval 15
host server2
action alert
command filesystem /var/tmp 1000
Servicerunning Test Example

This example checks that the ntpd service is running. The test runs at 15-second intervals. If
the test fails, the ntpd start script is run. If the test succeeds again within one minute of
failing, recovery occurs and the server is returned to the OK state. Otherwise, the server is
excluded from the Server Pool.
test “is ntp running -test”

interval 15
script /etc/init.d/ntpd start
action exclude
recovery 1:00
command servicerunning ntpd
Ip-listening Test Example

This example checks that server2 is listening at the IP address 192.168.1.1. The test runs at
30-second intervals, and the server is excluded from the Server Pool if the test fails.
test ip-listening
interval 30
host server2
action exclude
command iplistening 192.168.1.1
Port-listening Test Example

This example checks that server2 and server3 are listening on port 80. The test runs at 30-
second intervals, and the server is excluded from the Server Pool if the test fails.
test port-listening
interval 30
host server2 server3
action exclude
command portlistening 80

Httpanswer Test Example
This example checks that the server sends the contents of the file /web/file.html as a part
of its response to a URL request for http://www.example.com/index.html on port 80. The
request is attempted four times, and the tester waits 3500 milliseconds for a response before
retrying. The test runs at 30-second intervals, and the server is excluded from the Server Pool if
the test fails.
test http_answering
interval 30
action exclude
command httpanswer 4 3500 /www.example.com/index.html /web/file.html 80
Networkinterface-up Test Example

This example checks that the eth0 interface is up. The test runs at 45-second intervals, and an
alert is sent if the test fails.
test etc0_up
interval 45
action alert
command networkinterface-up eth0
Networkinterface-linkstatus Test Example

This example checks that the eth0 interface is linked. The test runs at 45-second intervals, and
an alert is sent if the test fails.
test “link status on eth0”

interval 45
action alert
command networkinterface-linkstatus eth0
File-exists Test Example

This example checks that the /important/index.html file exists. The test runs at 2-minute
intervals, and an alert is sent if the test fails.
test “index -file exists”

interval 2:00
action alert
command file-exists /important/index.html
What’s Next?
 Proceed to Enabling Monitoring Agents (page 488).

Enabling Monitoring Agents
Prerequisites: Defining a Server Pool, Installing Monitoring Agents, Configuring Monitoring Agents
Caution – Do not enable the Monitoring Agents before you configure them (see Configuring
Monitoring Agents (page 474)).
 To enable the Monitoring Agents

1. Right-click the Server Pool element for which you want to enable the Monitoring Agents and
select Properties from the menu. The Properties dialog opens.
2. Select Agent in the Monitoring section.
3. (Optional) Enter the Port if you want to use a port other than the default port (7777).
Note – Remember to modify the corresponding IPv4 Access rules to allow connections to
the new port.
4. Click OK.
What’s Next?
 If you are using static DNS entries, continue by Entering the Server Pool’s IP Addresses
on Your DNS Server (page 488).
 Otherwise, continue in Creating Access Rules for Inbound Load Balancing (page 489).
Entering the Server Pool’s IP Addresses on Your DNS Server

When using static DNS entries (recommended), you must ensure that the IP addresses for your
servers, as specified in the Server Pool properties, are properly entered into your DNS server’s
records.
If the servers have multiple IP addresses, make sure these are all defined on the DNS server to
ensure operation as intended.
Consult the documentation of your DNS server software for instructions on how to enter the IP
addresses.
What’s Next?
 Continue the configuration by Creating Access Rules for Inbound Load Balancing
(page 489).

Creating Access Rules for Inbound Load Balancing
The IPv4 Access rules specify which traffic is directed to the server pool.
Note the following:
• The Server Pool does automatic NAT from the external addresses you configured in the Server
Pool element to the addresses of the included servers, so make sure there are no
overlapping NAT rules in the policy. You can add a NAT rule that disables further NAT for
matching connections (empty NAT cell), if necessary.
• If you want to balance traffic that arrives through a VPN using a Server Pool, NAT must be
enabled in the properties of the VPN element (NAT is disabled by default for traffic that uses
a VPN).
• You must create a separate rule for each Server Pool.
• If the same Server Pool provides more than one service, you must create a separate rule for
each Service.
• You must enable Connection Tracking for the rule that directs traffic to the Server Pool. The
Server Pool uses NAT, which does not work without Connection Tracking.
 To create an access rule for inbound load balancing

1. Open the Firewall Policy for editing and add an IPv4 Access rule.
2. Configure the rule to match the Source, Destination, and Service of the traffic you want to
direct to the server pool.
Note – Each rule must contain only one Service.
3. Set the Action to Allow and enable Connection Tracking in the Action Options.
Example The following example rules direct traffic from outside networks to the HTTP Server Pool and
to the HTTPS Server Pool.

NOT internal Allow
HTTP Server Pool HTTP
Expression Connection tracking: normal
NOT internal Allow

HTTPS Server Pool HTTPS
Expression Connection tracking: normal
What’s Next?
 If you are using Dynamic DNS entries, continue the configuration by Defining a Dynamic
DNS Rule (page 493).
 If you are using static DNS entries, the configuration is complete. Save and Install the
Firewall Policy to transfer the changes.
Creating Access Rules for Inbound Load Balancing 489

Configuring Dynamic DNS Updates
Prerequisites: See Getting Started with Inbound Traffic Management
StoneGate supports the Dynamic DNS protocol and is capable of sending DDNS updates to a
specified DNS server. If a network connection specified by a NetLink element fails, the dynamic
DNS updates notify the DNS, which then removes the corresponding IP address from its
records.
To configure DDNS updates, you must have already defined the necessary NetLinks and the
Server Pool element. To use DDNS updates, you must set up a DDNS-capable DNS server in
your network. The DNS server must be configured as the primary DNS server for the domain.
Using dynamic DNS updates is a security risk. Before you start using dynamic DNS updates,
read the section Improving DDNS Security.
1. Implementing DDNS may be a security risk. Read the information in Improving DDNS
Security (page 490) before proceeding with the configuration.
2. To enable monitoring of the status of your NetLinks, you must add probe IP addresses in
the NetLinks’ properties as instructed in Creating NetLinks (page 443).
3. Define the DNS Server element (Defining an External DNS Server (page 491)).
4. Modify the Server Pool element to include information on how the DNS server is updated
(see Defining the Dynamic DNS Update Information (page 492)).
5. Modify the active policy to allow DDNS updates (see Defining a Dynamic DNS Rule
(page 493)).
Improving DDNS Security
Caution – Although StoneGate supports dynamic DNS updates, the protocol itself poses a
security risk because there is no access control. If you must use dynamic DNS updates, do
so only after very careful research, planning, and testing.
This section presents some basic steps you can take to improve the security of dynamic DNS
updates:
• Always place the DNS server(s) behind the firewall for protection from IP spoofing.
• Use BIND or an equivalent DNS server that allows you to define which hosts are allowed to
send dynamic updates.
• Always consider using static DNS entries instead, as DDNS is not necessarily needed with
inbound load balancing. Obviously, in that case the DNS entries are not removed
automatically from the DNS server if an ISP fails, but these problems can sometimes be
solved otherwise: for example, some Web browsers can automatically try other IP addresses
if one address does not respond.
What’s Next?
 To start using DDNS with inbound traffic management, continue to Defining an External
DNS Server (page 491).

Defining an External DNS Server
To use DDNS updates with Multi-Link, you must configure an External DNS Server element.
External DNS Server elements are also used in the SOHO firewall configuration to define DNS
server addresses.
 To define an External DNS Server element

3. Right-click Servers and select NewExternal DNS Server from the menu. The External
DNS Server Properties dialog opens:
Illustration 36.4 External DNS Server Properties
4. Enter a unique Name and IP address for the server.

5. Enter a Time to Live (TTL) interval in seconds. It defines how long a DNS entry can be
cached before querying the DNS server again. The default is 1 second.
6. Enter an Update Interval in seconds. It defines how often the DNS entries can be updated
to the DNS server if the link status changes constantly. The default is 10 seconds.
7. (Optional) If the device has additional IP addresses, you can enter them as Secondary IP
Addresses instead of creating additional elements. However, secondary IP addresses are
only used in the Source and Destination cells in rules. They are ignored otherwise.
8. Click OK.
What’s Next?
 Continue the DDNS configuration by Defining the Dynamic DNS Update Information
(page 492).
Related Tasks
Configuring Dynamic DNS Updates 491

Defining the Dynamic DNS Update Information
Next, you must define the settings for the Dynamic DNS updates sent from your firewall to the
DNS server. This data is configured in the Server Pool element.
 To define DDNS update information

2. Browse to Network ElementsTraffic Handlers.
3. Right-click the Server Pool and select Properties. The Properties dialog opens.
Illustration 36.5 Server Pool Properties
4. Select Enable Dynamic DNS Updates.

5. Select the DNS Server element to which the DDNS updates are sent.
6. Enter the Fully Qualified Domain Name for the Server Pool service (for example,
“www.example.com”).
7. Click OK.
What’s Next?
 Continue by Defining a Dynamic DNS Rule (page 493).

Defining a Dynamic DNS Rule
In addition to creating a rule for inbound load balancing (as explained in Creating Access Rules
for Inbound Load Balancing (page 489)), you may also need to add a rule allowing the Dynamic
DNS updates from your firewall to the specified DNS server. The Default template allows this
traffic by default, so if your policy is based on an unmodified Default template, there is no need
to add the rule outlined below.
 To add a rule that allows Dynamic DNS updates

1. Right-click the Firewall Policy and select Edit. The policy opens for editing.
2. Add the following Access rule:
• Source: the address (towards the DNS server) of the firewall or NDIs of all nodes in the
firewall cluster.
• Destination: the DNS server
• Service: the DNS Service Group.
• Action: Allow
3. Save and install the policy.
Monitoring and Testing Monitoring Agents

Prerequisites: Installing Monitoring Agents, Configuring Monitoring Agents
You can test and monitor the Server Pool Monitoring Agents on the command line. The
monitoring tool allows you to query the agents locally or remotely to check their status. The
Monitoring Agent command line tools are described in Server Pool Monitoring Agent Commands
(page 931).
 To test a Monitoring Agent

1. On the command line, browse to the folder where the Monitoring Agent is installed.
2. Run sgagentd -d test [filename], where the file is a configuration you want to test.
Giving the filename is optional, but if you omit the filename, the test is run with the active
configuration.
• Run sgagentd -h for more usage instructions.
 To monitor a Monitoring Agent

1. On the command line, browse to the folder where the Monitoring Agent monitoring tool is
installed:
• In Windows, this is the same folder as where the Monitoring Agent itself is installed.
• On Linux and Solaris, the program is installed in usr/bin.
2. (Optional) Copy the sgmon program and copy it to a remote host that you want to use for
testing the Monitoring Agents.
3. Run sgmon -h to see usage instructions and run your monitoring commands according to
the syntax displayed.
• The host argument is mandatory. To get the status locally on the server where the
Monitoring Agent is installed, use localhost as the host argument.
Monitoring and Testing Monitoring Agents 493

T RAFFIC I NSPECTION
P OLICIES
In this section:
Creating and Managing Policy Elements - 497
Editing Policies - 509
Defining IP Addresses - 561
Defining Network Services - 573
Defining Situations - 595
Defining User Responses - 611
Quality of Service (QoS) - 615
Setting up User Authentication - 623
Filtering Web Addresses - 651
Setting up HTTPS Inspection - 655
External Content Inspection - 669
Blacklisting Traffic - 677
495
496
C HAPT ER 37
CREATING AND MANAGING POLICY

ELEMENTS
Policy elements are containers for the rules that determine how traffic is filtered and
inspected.
Getting Started with Policies (page 498)

Creating a New Template Policy or a Policy (page 499)
Creating a New Sub-Policy (page 500)
Installing Policies (page 501)
Tracking Policy Changes (page 504)
Moving the Policy Under a Different Template (page 506)
Deleting Policies, Templates, and Sub-Policies (page 507)
497
Getting Started with Policies
Prerequisites: None
What Policy Elements Do

The policies organize traffic processing rules hierarchically to make the administration easier
and to optimize traffic inspection performance:
• Firewall and IPS Policies contain the rules according to which the firewalls, sensors, and
analyzers inspect traffic. Each policy must always be based on a Template Policy.
• Template Policies contain rules that are inherited into any template or policy below it in the
policy hierarchy. You must add insert points to templates for all types of rules to mark the
places where rules can be inserted in Policies (or Template Policies) that use the template.
Template Policies can enforce administrative boundaries and prevent modifications from
unintentionally changing the main design of your rules.
• You can also insert Sub-Policies in your policies. A Sub-Policy is a set of IPv4 Access rules
that can be matched conditionally to a restricted part of the traffic and may therefore improve
processing performance. Sub-Policies can also enforce administrative boundaries.
The same Policy can be shared by several firewall engines or by several IPS engines, and several
Policies can also share Policy Templates and Sub-Policies. In shared rules, Alias elements can
mark those IP addresses that depend on the environment, so that the actual values are defined
separately for each component.
Limitations
• SOHO firewalls do not have policies; their configuration is based on the interface
classifications and settings defined in the SOHO Firewall elements’ properties.
• Sub-Policies can only contain IPv4 Access rules.
See the Firewall/VPN Reference Guide and the IPS Reference Guide for more background
information and examples on using policies, template policies, sub-policies, and the rules in the
policies.
1. (Optional) Create a custom template as explained in Creating a New Template Policy or a
Policy (page 499) and add the rules and insert points.
2. Create a custom policy as explained in Creating a New Template Policy or a Policy
(page 499) and add the rules.
3. (Optional) Create sub-policies according to need as explained in Creating a New Sub-Policy
(page 500) and add the IPv4 Access rules.
Related Tasks
 Installing Policies (page 501)
 Tracking Policy Changes (page 504)
 Moving the Policy Under a Different Template (page 506)
 Deleting Policies, Templates, and Sub-Policies (page 507)
 Getting Started with Editing the Rules in Policies (page 510)
498 Chapter 37 Creating and Managing Policy Elements

Creating a New Template Policy or a Policy
Prerequisites: None
All new Policies are based on a Template Policy. The template rules are inherited to lower levels
in the policy hierarchy.
On firewalls, you must always build the policy hierarchy on top of the ready-made Default
Template Policy or a copy of it. The Default Template Policy contains the necessary entries to
allow the engine’s own system communications.
We highly recommend that you base your IPS policy hierarchy on one of the ready-made
templates, the IPS System Template or the IPS Strict Template.
 To create a new Policy or Template Policy

from the menu, The Firewall Configuration or IPS Configuration view opens.
2. Right-click the Firewall Policies branch or the IPS Policies branch.
3. Select New and the type of policy you want to create from the menu. The Properties dialog
of the policy element opens.
Illustration 37.1 Firewall Template Policy Properties
4. Give the element a Name.

5. Select the Template you want to base this template or policy on.
6. (Optional) Switch to the Permissions tab and grant rights for the template or policy.
• To add a permission, click Add Permission. A new row appears on the administrator list.
• Click the Administrator cell and select the Administrator.
• Double-click the Administrator Role cell to select the correct role.
7. Click OK. The new Template Policy or Policy opens in the Policy Editing view.
If you modified administrator permissions for the policy, the changes are applied immediately.
The permissions are also automatically updated in the properties of the administrator’s
account.
What’s Next?
 Adding Insert Points in Policy Templates (page 516)
Related Tasks
Creating a New Template Policy or a Policy 499

Creating a New Sub-Policy
Prerequisites: None
A Sub-Policy is a set of IPv4 Access rules that you can reuse in different places and in several
Firewall or IPS Policies.
The main goal of Sub-Policies is to make a significant portion of the traffic bypass the whole
sub-policy. To achieve this benefit, rules in a sub-policy should have at least some identical
matching criteria (source, destination, service, source VPN, and/or user authentication details)
that can be used to select only a portion of the traffic for the sub-policy checks.
Sub-policies can also be used to organize the policies and to delegate administrator privileges:
you can restrict specific administrators to edit/add/remove rules within a limited section of IPv4
Access rules (which is more restrictive than giving access to a template or policy).
There are two ways to create Sub-Policies: you can either create a Sub-Policy and add Access
Rules to it manually or select Access rules in a policy and convert them into a Sub-Policy.
What’s Next?
 To start from scratch, proceed to Creating a New Empty Sub-Policy (page 500).
 To use existing rules, proceed to Converting Existing Rules into a Sub-Policy (page 500).
Creating a New Empty Sub-Policy

 To create a new empty Sub-Policy
1. select ConfigurationConfigurationFirewall or ConfigurationConfigurationIPS
from the menu according to the type of component you want to work on.
2. In the Firewall or IPS configuration view, right-click the Firewall Policies branch or the IPS
Policies branch and select NewFirewall Sub-Policy or NewIPS Sub-Policy. The Sub-
Policy Properties dialog opens.
3. Type in a Name and an optional Comment.
4. (Optional) Switch to the Permissions tab and adjust the Access Control Lists at the top part
of the dialog to include the Sub-Policy on one or more custom Access Control Lists.
5. Click OK. The new sub-policy opens in the Policy Editing view.
What’s Next?
 Add the rules. See Editing Access Rules (page 518).
Converting Existing Rules into a Sub-Policy

You can convert IPv4 Access rules in an existing policy into a Sub-Policy. The rules do not have
to be consecutive, but if you add several references to a sub-policy in the same policy, all sub-
policy rules are checked at each reference point—even if those rules were already checked at a
previous reference point. This can be avoided, for example, by adding a rule at the end of the
Sub-Policy that stops all connections that did not match the other rules.
 To create a sub-policy from existing Access rules

1. Right-click the policy or template and select Edit Firewall Policy or Edit IPS Policy.

2. Switch to the IPv4 Access tab.
3. Select Access rules that you want to add to the sub-policy.
4. Right-click one of the selected rules and select Create Sub-Policy from the menu. The Sub-
Policy dialog opens.
5. Enter a Name for the Sub-Policy and click OK. The Sub-Policy element is created, a new
Jump rule that references the Sub-Policy is automatically added to the policy, and the
selected rules are moved to the Sub-Policy.
6. Edit the Jump rule cells to be as specific as possible so that traffic is not unnecessarily
matched to the sub-policy. If necessary, you can add more references to the Sub-Policy, for
example, by copy-pasting the Jump rule.
7. (Optional) Add the Sub-Policy to a custom Access Control List:
7a. Right-click the Action cell in the Jump rule and select Properties. The Properties dialog
for the Sub-Policy opens.
7b. Switch to the Permissions tab and adjust the Access Control Lists at the top part of the
dialog.
7c. Click OK.
Related Tasks
Installing Policies
Prerequisites: The policy you want to install must be allowed in the engine’s configuration
Changes to an engine’s rules and most other configurations (routing etc.) are activated in a
policy installation. Only Policy elements can be installed; Template Policy and Sub-Policy rules
are installed as part of the main Policy. A policy snapshot is automatically created each time you
install or refresh a policy for both your and the system’s reference.
You can initiate a policy installation through the Policy element or through the engine element.
The procedure below explains the first method.
 To install a policy
from the menu. The Firewall Configuration or IPS Configuration view opens with the Policies
branch selected in the tree view.
2. Right-click the policy you want to install and select Install Policy from the menu. The Task
Installing Policies 501

Illustration 37.2 Policy Upload Task Properties
3. Select the engine(s) on which you want to install the same policy and click Add. You can
install the same policy on several engines in one operation.
• The system tracks the policies installed on engines and pre-fills the Target when possible.
• It is not possible to select Analyzer elements. The analyzer’s policy is refreshed
automatically when a policy is installed on the sensor.
4. (Optional) Leave Keep Previous Configuration Definitions selected to allow established
connections to continue using existing configurations (such as NAT rules) until they finish.
• If the previous configurations are erased, connections that use them are cut.
• All previously established connections that are not allowed by the newly installed policy
are always dropped regardless of this setting.
5. (Optional) Leave Validate Policy before Upload selected to validate the rules in the policy.
See Validating Rules Automatically (page 556) for more information on the related settings.
Note – You cannot validate the policy if you are installing the policy on several engines.
6. (Optional) Add an Upload Comment. The comment provides history information to

administrators and Web Portal users when viewing Policy Snapshots.
7. Click OK to validate and install the policy. The progress is displayed on a new tab.

Illustration 37.3 Policy Installation Progress
List of engines
Detailed
progress for
selected engine
Issues found in
policy validation;
warnings and
errors during
policy installation
8. If validation issues are found, read the Issues tab in the Info panel and take action:
• Double-click an issue to view the corresponding configuration or click Continue.
• For more information, including steps to disable warnings, see Viewing Policy Validation
Issues (page 558).
9. Monitor the installation and make sure it is successful. With multiple engines, the progress
is indicated through colored icons on the left (click the icon to view the details):
• Yellow: ongoing installation.
• Blue: waiting for the installation(s) on other component(s) to finish.
• Red: failure
• Green: success
Related Tasks
 Tracking Policy Changes (page 504)
 Selecting Permitted Policies for an Engine (page 409)
Installing Policies 503

Tracking Policy Changes
Prerequisites: None
Checking the Currently Installed Policy

 To check the currently installed policy
1. Right-click the Firewall or Sensor cluster icon (not on a node) and select Current
PolicyInfo.
2. A message is displayed on the screen with the following information:
• Name of the installed policy
• Name of the administrator who installed the policy
• Date (year-month-day) and time of the policy installation.
Illustration 37.4 Current Security Policy Message Box
Date format is
year-month-day
3. Click OK to close the message box.
Previewing the Currently Installed Policy

 To preview the currently installed policy
 Right-click the Firewall or Sensor cluster icon (not on a node) and select Current
PolicyPreview. A preview of the policy in its current format on the Management Server
opens.
Note – The policy on the Management Server may be different from the actual currently
installed policy if the policy has been modified after it was installed.
Checking and Comparing Policy Versions

Each time when a policy is successfully installed, a record of that configuration is stored in the
upload history. This allows you to the check which policies were uploaded and when they were
uploaded, and allows you to run an automatic check on policy refresh needs. For example, you
can compare two policy snapshots, or to check which policy was in place at a particular time.
Note – The policy snapshot is only stored when the policy is successfully installed. No
snapshot is stored if the policy upload fails.
What’s Next?
 Viewing Policy Snapshots (page 505)
 Comparing Two Policy Snapshots (page 505)

Viewing Policy Snapshots
 To view a policy snapshot
from the main menu depending on the type of component you are interested in.
2. Browse to Other ElementsPolicy SnapshotsA list of policy snapshots with the upload
times and dates appears.
3. Double-click the policy snapshot you want to view. The details of the selected policy
snapshot opens.
Tip – You can also view the snapshot in HTML format: right-click a snapshot and select ToolsSave
as HTML File.
4. Select elements in the other panel to see their details. These are organized in the following
groups:
• Policy: the policy whose installation created the snapshot.
• Target: properties of the engine on which the policy has been saved.
• Elements: elements included in the policy.
Tip – Select ViewShow XML to view the policy snapshot in the XML format.
Comparing Two Policy Snapshots

You can compare any two policy snapshots from the list to check for changes between policy
installations.
 To compare policy snapshots

1. Open the comparison in one of the following ways:
• Select two policy snapshots you want to compare, right-click, and select Compare
Snapshots to compare any two snapshots to each other.
• Right-click the policy snapshot that you want to compare and select CompareCompare
to Engine’s Current Policy to compare it to the most recent policy snapshot.
• Right-click the policy snapshot that you want to compare and select CompareCompare
to Latest Saved Version to compare it to the current working version stored on the
Management Server.
2. Check the changes that are highlighted in the policy in colors and as a summary below.
3. Select objects in the summary to focus on them. For example, if you select a network
element, its properties are shown above. The objects are organized in the following groups:
• Targets: The engine on which the policy has been saved.
• New Elements: Elements added to the policy.
• Removed Elements: Elements that have been removed from the policy.
• Modified Elements: Elements that exist in both policies but have been modified.
Tracking Policy Changes 505

Checking for Untransferred Configuration Changes
Most changes done in any part of the configuration are transferred to the engines when the
Security Policy for that engine is refreshed. You can view a list of Firewall and Sensor engines
whose Security Policy has not been refreshed after the latest changes that affect the engine’s
operation. You can also view a list of the Log Servers whose Alert Policy needs refreshing.
 Checking for policy refresh needs

1. In the System Status view, select the elements that you want to include in the check.
2. Right-click the selected category, and select ConfigurationPolicy Refresh Check. The
Policy Refresh check dialog opens and the check is performed (how long it takes depends
on how many elements you selected).
Illustration 37.5 Policy Refresh Check
3. If elements are shown, select the ones whose policies you want to refresh (all elements are
selected by default).
4. Click Refresh. The policy upload for the selected elements begins.
Moving the Policy Under a Different Template

Prerequisites: Creating a New Template Policy or a Policy (page 499)
You can switch the template of a firewall or IPS policy. For example, if you created policy A based
on template X, you can later reparent policy A to inherit rules from template Y.
 To switch the template of a policy

2. Select Firewall Policies or IPS Policies in the tree view.
3. Right-click the correct policy and select Properties from the menu. The Properties dialog for
the policy opens showing the policy tree.
4. Select the new parent template in the policy tree. The parent template must have insert
points for the types of rules that the Policy contains.
5. Click OK. The policy is moved under your chosen template in the tree view, and starts using
rules from the new template.

Deleting Policies, Templates, and Sub-Policies
Prerequisites: You must have created a policy, a policy template, or a sub-policy
To delete a template, there must be no policies that are based on that template. The deletion is
not allowed until you either delete the policies or switch them to use a different template. See
Moving the Policy Under a Different Template (page 506).
To delete a sub-policy, there must be no policies that have Jump rules to the sub-policy. The
deletion is not allowed until you edit or remove the Jump rules in the policies.
See Deleting Elements (page 79) for general information on deleting elements.
Deleting Policies, Templates, and Sub-Policies 507

C HAPT ER 38
EDITING POLICIES
The rules in Firewall and IPS Policies allow you to control how the engines inspect and filter
network traffic and how NAT (network address translation) is applied on the firewalls.
Getting Started with Editing the Rules in Policies (page 510)

Using the Policy Editing View (page 511)
Adding Insert Points in Policy Templates (page 516)
Editing Ethernet Rules (page 516)
Editing Access Rules (page 518)
Editing Inspection Rules (page 531)
Editing NAT Rules (page 545)
Limiting the Time when a Rule Is Active (page 555)
Validating Rules Automatically (page 556)
Adding Comments to Policies (page 560)
Changing Default Rules (page 560)
509
Getting Started with Editing the Rules in Policies
Prerequisites: Creating a New Template Policy or a Policy
What Rules Do
Rules are instructions to the engines for handling traffic. There are four main types of rules.
• Ethernet rules (IPS only) filter traffic based on MAC addresses and low-level network
protocols. These rules can be used to segment a network.
• Access rules filter traffic based on IP addresses and IP-based protocols. These rules control
access to resources. There are separate Access rules for IPv4 and IPv6 traffic.
• Inspection rules filter traffic based on patterns in any of the information that is transferred.
These rules log complex traffic usage patterns and find network attacks, network worms, or
other worrying or unwanted traffic like the use of peer-to-peer file transfer applications.
• NAT rules (firewall only) change source and/or destination IP addresses in traffic that is
allowed to pass through the firewall. NAT (network address translation) can hide the network
structure and allows several computers to use the same IP address on the Internet.
The engines process the rules one type at a time in the order listed above. IPv4 and IPv6 traffic
on the IPS may be matched to both IPv4 and IPv6 Access rules in any order if traffic is tunneled
(for example, IPv6 tunneled in IPv4 or IPv4 tunneled in IPv6), possibly several times.
Basic Rule Design Considerations
Rule tables are read from top down, so the order of the rules is just as important as their
contents. Make sure that the rules advance logically from specific rules at the top toward more
general rules at the bottom whenever the matching criteria in rules overlap.
Example A rule that denies access to your server from a particular network must be placed above a
more general rule that allows access to that server from any source address.
Any two rules that have completely overlapping matching criteria are redundant and should be
merged. Automatic rule validation can be used to find such mistakes.
When rules are matched to traffic, each rule is compared to the traffic one by one until a match
is found. What happens when the end of the rule table is reached without any matches varies by
the component and the type of rules.
Limitations
Current IPv6 support on firewalls is limited. IPv6 is supported on single firewalls only. NAT, deep
packet inspection, and antivirus are supported for IPv4 traffic only.
What’s Next?
 Using the Policy Editing View (page 511)
Related Tasks
 Editing Ethernet Rules (page 516)
 Editing Inspection Rules (page 531)
 Editing NAT Rules (page 545)
 Validating Rules Automatically (page 556)
 Changing Default Rules (page 560)
510 Chapter 38 Editing Policies

Using the Policy Editing View
You can open a policy for editing through the right-click menu for the policy or through the
preview mode. Only one administrator at a time can edit a policy, so be sure to save your
changes and close the policy editing view when you are finished.
Illustration 38.1 Policy Editing View (IPv4 Access Tab)
Legend: 1 - Policy toolbar. 2 - Rule table. 3 - Search tool. 4 - Change history for selected rule.
Illustration 38.2 Inspection Rules
Legend: 1 - Rule table for detailed exceptions to the main Rules tree. 2 - The main Rules tree.
Using the Policy Editing View 511

Illustration 38.3 Policy Toolbar
Save changes and install Undo/Redo. Show Inherited rules passed down from
policy on engine(s). higher-level template(s).
Save A Snapshot is made at

Automatic validation finds rules each policy install to
that are clearly incorrect. allow change tracking.
Toggle between element

names and IP addresses.
Display the number of
hits for each Firewall
Search tool for finding rules. Access and NAT rule.
Editing Rule Tables

You can edit the rule tables in the following ways:
• Use the actions in the right-click menu (add, cut, copy, paste, move etc.). If you right-click a
cell that has cell-specific actions, the rule-specific actions are moved to the Rule submenu.
• Drag and drop (move) whole rules by the rule’s ID or Tag number.
Illustration 38.4 Example of a Right-Click Menu for a Rule

Cell actions are at the
main level.
Rule actions are in a Standard editing
submenu. actions are available
here and as keyboard
Selected rules can be shortcuts.
converted to a Sub-Policy.
You can temporarily
Lock prevents edits until the disable rules without
rule is explicitly unlocked. deleting them.
The rule’s identifier

Comment rules create
can be used as a log
collapsible segments.
filter.
Editing Rule Cells

Most rule cells require you to insert elements of specific types:
• When you click the cell, the resource panel on the left shows the type(s) of elements that you
can insert in that cell.
• Drag and drop the correct elements into the cell from the resource panel, from another cell,
or even between tabs (the tab switches if you hover the pointer over a tab while dragging).
• You can create new elements in the resource panel (of the type(s) that are currently
displayed).

To modify rule cells that do not accept elements, right-click the cell and select an item from the
right-click menu.
Illustration 38.5 Right-Click Menu for the Action Cell in a Firewall Access Rule
Opens a dialog for setting

options.
In the Action cell, the dialog
contains additional settings
for the selected Action (if
Main options for the any exist).
Action cell.
Adding Comments in Policies

You can add two types of comments in policies:
• The Comment cell in each rule allows you to write rule-specific comments, for example, to
record why the rule was added or changed. Note that the History in the Info panel shows
when the rule was added and last changed and through which administrator account.
• In rule tables, you can insert comment rules (through the right-click menu for any rule) to
visually structure the policy under collapsible sections.
Reading Rule Identifiers

Each rule has two (uneditable) identifiers:
• ID cell shows the order of the rules. For example, 14.1.2 shows that the rule is the second
rule in the policy. It is in an insert point that is the first rule in the parent template. That insert
point is the fourteenth rule in the top-level parent template. The number changes as you add,
remove, and move around rules.
• Tag is the unique identifier of the rule in this policy. It contains a static part that does not
change when rules are added, removed, and moved around and a changing part that versions
the rule. For example, in Tag “@274.12”, “274” is the unchanging part and “12” indicates
that the rule is currently in its twelveth edit. The tag is used, for example, to provide links
from logs to rules that created them.
Related Tasks
 Searching in Rules (page 514)
 Finding Unused Rules in Firewall Policies (Hit Counters) (page 515)
 Adding Insert Points in Policy Templates (page 516)
 Editing Inspection Rules (page 531)

Searching in Rules
In rule tables, you can search rules based on most of the cells. Click the Tools icon in the
Policy-specific toolbar and select Search Rules to display the search at the bottom of the rule
table (Illustration 38.6).
In the Rules tree on the Inspection tab, you can search the Situations through type-ahead
searching. When you type a part of the name of the Situation, the tree is filtered to contain only
matching Situations (and their parent Situation Types, which make up the tree branches). The
currently active type-ahead search is shown at the bottom of the tree panel.
The illustration below shows the rule search in rule tables.
Illustration 38.6 Rule Search for Rule Tables

Drag and drop or enter the search
criteria in selected cell(s). Remove all search criteria
Search rules that match all defined criteria

Search rules that match any defined criterion
Do not find rules that have ANY in a cell
that is used as search criterion
Hides rules that do not

match the defined criteria
You can add values in different ways:

• Drag and drop elements from the rule table above, from different windows and tabs, or from
the resource panel (shown in Edit mode).
• Right-click a cell and choose Select to browse for elements.
• In the Source and Destination search cells, you can manually type in IPv4 or IPv6 addresses,
networks, or address ranges. Use standard notations (for example, 192.168.1.0/16, or
192.168.10.0 - 192.168.10.101 for IPv4 networks, or 2001:0db8:1234::/48, or
2001:0db8:1234:: - 2001:0db8:1234::100 for IPv6 networks.
Fill in the cell(s) that you are interested in. The cells you leave empty are simply ignored in the
search. The first rule that matches your search is shown on a dark green background and all
other matching rules are highlighted on a light green background. Click the Next or Previous
arrow to move up or down from the currently selected rule to a matching rule above or below.
Related Tasks

Finding Unused Rules in Firewall Policies (Hit Counters)
Firewall IPv4 and IPv6 Access rules as well as NAT rules contain a Hits cell that can show how
many times each rule in your firewall policy has matched actual network traffic. By default, the
Hits cells are empty and you have to populate them with the Rule Counter tool.
The main purpose of viewing the rule hits is to find valid rules which match traffic that the
firewall does not encounter in the network. This feature complements the rule validation checks,
which can find rule design errors. Current firewall engine versions count rule hits automatically
for all rules of supported types. The hits are stored as statistical counter data on the Log
Server(s).
 To run a Rule Counter analysis

1. Open the policy for preview or editing and switch to the correct tab for the type of rules you
want to examine (IPv4 Access, IPv6 Access, or NAT).
2. Select an engine using the menu in the policy-specific toolbar.
Illustration 38.7 Policy-Specific Toolbar
3. Click the Tools icon in the policy-specific toolbar and select Rule Counters. The Rule
Counter Analysis dialog opens.
Illustration 38.8 Rule Counter Analysis
4. Select the Period for which you want to check the rule matches; either one of the pre-set
relative periods or Custom if you want to define the Period in detail.
5. (Optional) To exclude Log Servers from this operation or to include archived data, switch to
the Storage tab and change the selection. Make sure you include the Log Servers and
folders that contain data for the target engine and the period you selected.
6. Click OK to display the rule hits. The Hit information is displayed until you close the view.
• The Hit cell in each rule is filled in with the number of connections that matched the rule
during the chosen period.
• If there is no statistical information about the rule with your selected criteria, the Hit cell
shows “N/A” (for example, for rules added after the period you are analyzing).
Related Tasks

Adding Insert Points in Policy Templates
Insert Points mark the positions where rules can be added. When you edit a Template Policy, you
must add at least one new yellow Insert Point on all tabs in all templates if you want the
inheriting Policy or Policy Template to be editable on each tab. Green Insert Points are inherited
insert points from the previous level, and they are not inherited further down in the hierarchy.
They only show you where the higher-level template allows you to add rules and disappear as
soon as you add a rule or a new (yellow) insert point in that position.
 To add an insert point in a Policy Template

1. Open the Policy template in editing mode.
2. Right-click the green insert point and select Add Insert Point or a rule that is editable in
this Template and select RuleAdd Insert Point Before or Add Insert Point After.
3. Give the insert point a descriptive Name in the dialog that opens and click OK. An
inheritable (yellow) insert point is added to the Template.
You can add as many insert points in the Template as your rule structure calls for.
Editing Ethernet Rules

Prerequisites: You must have privileges to edit the Policy element
Ethernet rules are used by IPS sensors. These rules define whether Ethernet traffic is allowed to
continue or whether the traffic is denied immediately. Inline interfaces of IPS sensors can
directly stop any traffic when the Discard action is used.
If you are using one of the default IPS templates as the basis for your policies, the Ethernet
rules direct all IPv4 and IPv6 traffic to the Inspection rules for further inspection, and let ARP,
RARP, and STP traffic through. You can use the first Insert Point in the template to make
exceptions to this behavior for certain MAC addresses and/or Logical Interfaces. We
recommend that you insert any other changes at the second insert point.
Make sure that your Ethernet rules direct IP traffic for inspection against Access rules (by
applying the default IPv4 and IPv6 Services to traffic). When traffic does not match any Ethernet
rule, the traffic is let through without further inspection.
 To add an Ethernet rule

opens with the policy elements selected for viewing.
2. Right-click a Template Policy or Policy element and select the corresponding Edit action
from the menu that opens. The policy opens for editing.
3. Switch to the Ethernet tab.
4. Add the rule in one of the following ways:
• Right-click the ID cell of an existing rule and select Add Rule Before or Add Rule After.
• Copy-paste some existing rule.

5. Specify the portion of the traffic that you want to control and select what happens to traffic
that matches the rule as explained in the table below.
Table 38.1 Matching Cells and Actions in Ethernet Rules
Cell Option Explanation

If your Sensor has more than one Logical Interface defined, you can
optionally add Logical interface elements in this cell to select which
Logical Interface rules apply to which Logical Interfaces (network segments). The
rules in the default IPS templates match any Logical Interface.
Matches any Logical Interface by default.
Source Match the rule to one or more MAC addresses.

Destination Does not match anything by default (whole rule is ignored).
Match the rule to an Ethernet Service.

Service
Does not match anything by default (whole rule is ignored).
Matching traffic is allowed to pass. If the Service cell contains the

default IPv4 or IPv6 Service element(s), the matching continues in
Allow
Action the Access rules. Otherwise, the traffic is allowed to continue
without further examination.
(Right-click to
select) If passing through inline Sensor interfaces, matching traffic is
Discard silently dropped. This action cannot be applied to traffic picked up
through Capture interfaces.
Defining Logging Options for Ethernet Rules

 To create a log or alert entry when the rule matches
1. Double-click the Logging cell in the rule.
2. Define the options as explained in the table below.
Caution – Ethernet rules are matched to each packet, and if logging is active for a rule, a
new log entry is produced for each matching packet. Excessive logging can saturate the
logging features, so do not activate any logging for Ethernet rules that match sizeable
portions of your network traffic.
Table 38.2 Logging Options in Ethernet Rules
Options Explanation
A match creates no entry in the log. This is the recommended
None
setting for most Ethernet rules.
Log Level Each matching packet creates a log entry that is stored on the Log
Stored
Server.
Alert Each matching packet triggers the alert you add to the Alert field.
Editing Ethernet Rules 517

Table 38.2 Logging Options in Ethernet Rules (Continued)
Options Explanation
If Log Level is set to Alert, defines the Alert that is sent. Selecting
Alert different Alerts for different types of rules allows more fine-grained
alert escalation policies.
If Log Level is set to Alert, allows you to override the severity defined
Severity
in the Alert element.
Defining a MAC Address for Ethernet Rules

The MAC Address element defines the MAC (Media Access Control) address of a network card.
The MAC Address elements are used to match a certain source or destination MAC address in
the Ethernet rules.
 To define a MAC Address element

1. Browse to Other Elements in the IPS Configuration view.
2. Right-click MAC Addresses and select New MAC Address. The MAC Address Properties
dialog opens.
3. Name the element.
4. Enter the MAC Address. You can enter any valid MAC address including, for example, the
broadcast address (ff:ff:ff:ff:ff:ff).
Editing Access Rules

Prerequisites: You must have a custom Policy element and privileges to edit it
Access rules filter traffic by defining matching criteria and an action that is applied to packets
that match all criteria defined in the rule. Access rules are used by firewalls and sensors:
• In Firewall policies, the Access rules are the most important part. The criteria you define in
the Access rules determines which connections are allowed to pass. By default, Firewall
Access rules stop traffic that you do not specifically allow.
• In IPS policies, Access rules can be used to optionally filter out some traffic and to exclude
some traffic from further inspection (which is the more important part of IPS policies). Only
traffic on Inline interfaces can be filtered with Access rules. Sensors allow all traffic that you
do not specifically deny. If the policy is based on one of the default IPS templates, all allowed
traffic is inspected against the Inspection rules by default.
 To add an Access rule

from the menu. The Firewall Configuration view or IPS Configuration view opens with the
policy elements selected for viewing.
2. Right-click a Template Policy, Policy, or Sub-Policy element and select the corresponding
Edit action from the menu that opens. The policy opens for editing.
3. Switch to the IPv4 Access tab or to the IPv6 Access tab.
• Right-click the ID cell of an existing rule and select Add Rule Before or Add Rule After.
• Copy-paste some existing rule.

5. Specify the portion of the traffic that you want to control as explained in Defining What
Traffic an Access Rule Matches (page 519).
6. Define what happens to traffic that matches the rule as explained in Defining What Action
an Access Rule Takes (page 521).
7. (Optional) Define options for triggering logs and alerts as explained in Defining Access Rule
Logging Options (page 528).
Defining What Traffic an Access Rule Matches

IPv4 Access rules and IPv6 Access rules are both configured in the same way. IPS sensors and
single firewalls use both types of Access rules. Firewall clusters do not support IPv6. IPS
analyzers do not use the Access rules at all in their operation.
When traffic does not match any rule and the end of the Access rule table is reached, firewalls
stop all traffic and sensors let all traffic through.
In addition to more specific matching criteria, the matching cells can be set to two additional
settings:
• ANY (available through right-click in a cell and selecting Set to ANY) matches all valid values
for the cell, for example, all IPv4 addresses.
• NONE is the default value for mandatory traffic matching cells that have no matching criteria
in them. As long as any cell in a rule contains NONE, the whole rule is invalid and is ignored.
To define how an Access rule matches traffic, fill in the cells with elements as explained in the
table below.
Table 38.3 Matching Cells in Access Rules
Cell Explanation
If your Sensor has more than one Logical Interface defined, you can optionally add
Logical interface elements in this cell to select which rules apply to which Logical
Interfaces (network segments). The rules in the default templates match any
Logical Interface
Logical Interface.
(IPS only)
For more information, see Defining Traffic Inspection Interfaces for Sensors
(page 379).
Source Match the rule to one or more IP addresses. Any elements in the Network Elements
category can be inserted into these cells. If you have both IPv4 and IPv6 networks,
the elements must have the correct type of IP address for the type of rule or the
element is ignored.
Destination
For more information, see Getting Started with Defining IP Addresses (page 562).
Match the rule to a network protocol and (if applicable) a TCP or UDP port or port
range.
Service
For more information, see Getting Started with Services (page 574).
Editing Access Rules 519

Table 38.3 Matching Cells in Access Rules (Continued)
Cell Explanation
If defined, the rule matches the specific authenticated users or user groups you add
as elements to this cell. If the connection source is not currently authenticated or
Users
the authenticated user is not included in this rule, the rule does not match and the
(Firewall only, matching continues to the next rule. It is not possible to set this cell to ANY.
IPv4 only, If you fill in this cell, you must also fill in the Authentication cell.
Optional) For more information, see Getting Started with User Authentication (page 624).
Matches both authenticated and unauthenticated users by default (cell is empty).
If defined, the rule matches the specific Authentication Services (authentication

methods) you add to this cell. If the connection source is not currently
authenticated or the authentication is done using a method that is not included in
Authentication
this rule, the rule does not match and the matching continues to the next rule.
(Firewall only,
If you fill in this cell, you must also fill in the Users cell.
IPv4 only,
Double-click the cell for more options, see Defining Access Rule Authentication
Optional) Options (page 530).
For more information, see Getting Started with User Authentication (page 624).
Matches both authenticated and unauthenticated users by default (cell is empty).
Double-click to limit the rule’s validity to a specific time period. During the specified
time period, the rule matches. Outside the specified time period, the rule does not
Time
match and the matching continues to the next rule.
(Optional)
The time is entered in the UTC time zone.
For more information, see Limiting the Time when a Rule Is Active (page 555).
Matches the rule based on whether the traffic is received through a VPN. Double-
click to specify that the rule matches only VPN traffic, only non-VPN traffic, only
Source VPN traffic from a specific VPN, or only VPN client traffic (configured in any VPN). This
(Firewall only, allows you, for example, to restrict the services VPN client users can access
IPv4 only, remotely when the IP addresses assigned to their laptops are the same both over
the VPN and when connecting from within the local internal network.
Optional)
For more information, see Creating VPN Rules (page 748).
Matches all traffic by default (cell is empty).

Defining What Action an Access Rule Takes
 To define what an Access rule does to matching traffic
 Right-click the Action cell and select the Action as explained in the table below.
Table 38.4 Access Rule Actions
Action Options Explanation

The traffic matching the rule is allowed to pass through the firewall
or sensor. The traffic may still be subject to various forms of deep
packet inspection depending on the component and the options you
Allow Yes set.
Further options for traffic handling are available in the Action
Options. See Defining Firewall “Allow” Action Options (page 523) or
Defining IPS “Allow” Action Options (page 527).
The options specified in a rule with this action are stored in memory
while the matching process for the packet continues. The specified
options are applied to any other rule that the same packet matches
if the rules have no rule-specific definitions for the same options.
Continue Yes
Further options for traffic handling are available in the Action
Options. See Defining Firewall “Allow” Action Options (page 523) or
Defining IPS “Allow” Action Options (page 527).
For more information, see the Firewall/VPN Reference Guide.
The traffic is discarded without informing the originator of the

Discard No connection. This action can never be applied to traffic picked up
through capture interfaces on a sensor.
The traffic is discarded and an ICMP error message or a TCP reset

(for TCP connections) is sent in response to the source. This action
Refuse No
can never be applied to traffic picked up through Capture interfaces
on a sensor.
The processing is continued in a Sub-Policy (selected in the Action

Options). If none of the rules in the Sub-Policy match, processing
continues to the next rule in the main policy. Note that options that
Jump Yes are set to specific values in a Jump rule override the corresponding
settings in the sub-rules.
See Defining “Jump” Action Options (page 522).
Includes a specific IPsec VPN configuration in the policy (selected in

Use IPsec VPN the Action options).
(Firewall only, Yes Directs outgoing traffic into a specific VPN and/or allows incoming
IPv4 only) traffic from the specified VPN.
See Defining Firewall “Use VPN” Action Options (page 526)

Table 38.4 Access Rule Actions (Continued)
Action Options Explanation

The engine checks the traffic against its current blacklist entries. If
the traffic matches a blacklist entry, it is discarded. If the traffic
does not match any current entries on the blacklist, processing
continues to the next rule in the main policy.
Apply Blacklist
Yes There is only one blacklist per firewall or sensor, but you can add
(IPv4 only) several rules that reference this blacklist.
You can limit the components that are allowed to add blacklist
entries in the Action Options.
See Defining “Apply Blacklist” Action Options (page 522).
Opens a dialog that allows you to modify action-specific options if

Action Options (N/A) the selected action has options.
See the explanations above for further information.
Defining Access Rule Action Options

Defining “Apply Blacklist” Action Options
The options for the Apply Blacklist action in IPv4 Access rules affect the reception of blacklist
entries on firewalls and sensors. For information on setting up blacklisting and generating
blacklist requests, see Getting Started with Blacklisting (page 678).
 To set the Action options for the Apply Blacklist action in IPv4 Access rules
1. Right-click the Action cell in an IPv4 Access rule and select Apply Blacklist.
2. Double-click the Action cell. The action-specific options dialog opens.
Set the options as explained in the table that follows.
Table 38.5 Apply Blacklist Action Options
Option Explanation
Blacklist entries are accepted from all StoneGate Management
Allowed Any Servers and analyzers defined in the system (sensors’ blacklisting
blacklisters for commands are relayed through analyzers).
the rule Blacklist entries are only accepted from the components you specify
Restricted
(and from the engine command line).
To allow manual blacklisting, add the Management Server(s).

Allowed Blacklisters To allow dynamic blacklisting by StoneGate IPS components, select
an Analyzer element.
Defining “Jump” Action Options

The Jump action in Firewall and IPS IPv4 Access rules adds a conditional section of rules to the
policy. If a connection matches the Jump rule’s matching criteria, it is matched against the rules
in the Sub-Policy.

 To set the Action options for the Jump action in IPv4 Access rules
1. Right-click the Action cell in an IPv4 Access rule and select Jump. The action-specific
options dialog opens.
2. Set the options as explained in the table that follows.
Table 38.6 Jump Action Options
Tab Options Explanation

Select a Sub-Policy. Connections that match the Jump rule are
matched against the selected Sub-Policy. If the Sub-Policy rules do
Jump Sub-Policy
not match, the processing is returned to the next rule in the main
policy.
Standard If you select specific connection tracking options in a Jump rule, the
Connection
connection options you select here are used for all rules in the Sub-Policy
Tracking
tracking regardless of the settings in those rules.
(Firewall Only) options See Defining Firewall “Allow” Action Options (page 523).
Defining Firewall “Allow” Action Options

The Connection Tracking Options control the following aspects of firewall traffic handling:
• You can control stateful inspection by setting options for connection tracking, including idle
timeouts, TCP segment size enforcement, and concurrent connection limits (DoS protection).
• (License permitting) You can activate the deep inspection to match traffic against Inspection
rules and/or check the traffic for viruses by setting deep inspection and anti-virus options.
 To set the Action options for the Allow action in firewall Access rules
1. Right-click the Action cell in a firewall Access rule and select Allow.
3. Set the options as explained in the tables that follow.
Table 38.7 Firewall Allow Action Options
Option Explanation
Select the option to activate the Connection Tracking settings and override any
Override Collected Connection Tracking options set in a preceding Continue rule that matches the
Values Set with same connections.
“Continue” Rules Deep inspection and antivirus cannot be set using a Continue action, so those
options are not affected and can be activated without selecting the override.
Enables connection tracking. The firewall allows or discards packets according to

the selected Connection Tracking mode. Reply packets are allowed as part of the
allowed connection without an explicit Access rule. Protocols that use a dynamic
On (Recommended)
port assignment must be allowed using a Service with the appropriate Protocol
Agent for that protocol (in Access rules and NAT rules). The additional options
available when connection tracking is on are explained in the next table.

Table 38.7 Firewall Allow Action Options (Continued)
Option Explanation
Disables connection tracking. The firewall operates as a simple packet filter,
allowing packets based on their source, destination, and port used. You must
add separate Access rules that explicitly allow the reply packets. NAT cannot be
Off applied to traffic allowed without connection tracking.
Turn off logging in the rule if you disable connection tracking. When connection
tracking is off, a log entry is generated for each packet and this may considerably
stress the firewall, network connections, and the Log Server.
Inspects traffic that matches this rule against the Inspection rules of this policy.
Deep Inspection To use this option, the Service in the rule must include one of the protocols
(IPv4 Only) supported for deep inspection on the firewall (HTTP, HTTPS, IMAP, POP3, SIP,
SMTP, or SNMP).
Inspects matching traffic against the virus signature database.

To use this option, anti-virus must be activated in the Firewall element’s
properties as explained in Configuring Anti-Virus Settings (page 424) and the
Antivirus Service in the rule must include one of the Protocols supported for anti-virus
(IPv4 Only) inspection (HTTP, HTTPS, IMAP, POP3, or SMTP).
Selecting this option also activates the Deep Inspection option. You can further
adjust virus scanning using Inspection rules. See Defining Firewall “Permit”
Action Options (page 538) for details.
Table 38.8 Additional Options When Connection Tracking Is Enabled
Option Explanation
TCP traffic is handled as in the Normal mode or Strict mode depending on
Default whether Strict Connection Tracking has been enabled in the firewall
properties. ICMP and UDP traffic is handled as in the Normal mode.
The firewall drops ICMP error messages related to connections that are
not currently active in connection tracking (unless explicitly allowed by a
rule in the policy). A valid, complete TCP handshake is required for TCP
Normal traffic. The firewall checks the traffic direction and the port parameters of
UDP traffic. If the Service cell in the rule contains a Service that uses a
Protocol Agent, the firewall also validates TCP and UDP traffic on the
Connection application layer. If a protocol violation occurs, the connection is dropped.
Tracking Allows only TCP traffic that strictly adheres to the TCP standard as defined
Mode in RFC 793. The firewall also checks the sequence numbers of the
packets in pre-connection establishment states and for RST and FIN
Strict packets, and drops packets that are out of sequence. If the Service cell in
the rule contains a Service that uses a Protocol Agent, the firewall also
validates the traffic on the application layer. If a protocol violation occurs,
the connection is dropped.
Allows some connection patterns and address translation operations that

are not allowed in the Normal mode. Can be used, for example, if routing
Loose
is asymmetric and cannot be corrected or if the use of dynamic routing
protocols cause the firewall to receive non-standard traffic patterns.

Table 38.8 Additional Options When Connection Tracking Is Enabled (Continued)
Option Explanation
Disables the synchronization of connection information between firewall
Do not synchronize cluster nodes. This reduces the traffic volume on the active heartbeat
connections interface, but it also prevents transparent failover of connections to other
nodes. This option is supported starting from Firewall/VPN version 5.2.1.
The timeout (in seconds) after which inactive connections are closed. This
timeout concerns only idle connections. Connections are not cut because
of timeouts while the hosts are still communicating.
This setting overrides the default idle timeouts set in the Firewall
properties.
Idle Timeout
Caution! Do not set long timeouts for many connections. Each connection
that is kept active consumes resources on the firewall. Setting excessive
timeouts for a large number of connections may lead to serious
performance problems. Generally, the idle timeout should not be more
than a few minutes at most.
Allows entering the Minimum and Maximum value for the MSS in bytes.
Headers are not included in the MSS value; MSS concerns only the
payload portion of the packet. In most cases, network equipment prefer to
send packets at the Ethernet-standard MTU (maximum transmission unit)
size of 1500 (including both payload and headers).
Maximum value: If a TCP packet has an MSS value larger than the
maximum, the firewall overwrites the packet’s MSS with the maximum
value you set here. Setting the maximum MSS size may be necessary to
prevent fragmentation. Typically, the value you enter is lower than the
Enforce TCP MSS standard Ethernet MTU (1500), with consideration for the packet headers
that are added to the MSS.
Minimum value: If a TCP packet has an MSS value smaller than the
minimum you set here, the packet is dropped. The smaller the data
content is, the less efficient the communications get due to the fixed-size
headers. Limiting the minimum size may help alleviate certain types of
network attacks. Typically, the minimum value you enter is smaller than
the standard minimum MSS (536).
If a TCP packet does not include a MSS value, the firewall does not add
the MSS value to the packet, but enforces the minimum MSS.
Concurrent connection Settings for DoS (denial of service) attack protection. Allows you to set a
limit per source IP maximum limit for the number of total open connections from/to a single
IP address at any one time. You can select between Discard (silent drop)
and Refuse (with ICMP error message) as the Action that is applied to new
connections if the limit is reached.
Concurrent connection These limits are enforced by rules that have their Action set to Allow,
limit per destination IP Continue, or Use IPsec VPN (all actions Apply/Enforce/Forward included).
Be careful to apply the concurrent connection limits correctly for the types
of communication that this rule handles to avoid cutting off connections
unnecessarily.

Defining Firewall “Continue” Action Options in Access Rules
The specified options are applied to any other rule that the same packet matches if the rules
have no rule-specific definitions for the same options.
 To set the Action options for the Continue action in firewall Access rules
1. Right-click the Action cell in a firewall Access rule and select Continue.
3. Set the options as explained in the table in Defining Firewall “Allow” Action Options
(page 523).
Defining Firewall “Use VPN” Action Options

For more information on specific use cases, see Creating VPN Rules (page 748).
 To set the Action options for the Use VPN action in firewall Access rules
1. Right-click the Action cell in a firewall Access rule and select Use IPsec VPN. The action-
specific options dialog opens.
Table 38.9 Use IPsec VPN Action Options
Options Explanation
Incoming connections: The traffic is allowed if it arrives through the specified VPN.
Otherwise, the rule does not match and the matching process continues to the
Apply next rule.
Outgoing connections: The traffic is sent through the specified VPN. If the
connection is not allowed in the VPN configuration, it is discarded.
Incoming connections: The traffic is allowed if the specified VPN is used.

Otherwise, the connection is discarded.
Enforce
Outgoing connections: The traffic is sent through the specified VPN. If the traffic is
not allowed in the VPN configuration, it is discarded.
VPN traffic: The engine forwards the traffic from one VPN to another. If the traffic is
not allowed in the VPN configuration, it is discarded. For more information, see
Forward Routing Traffic Between VPN Tunnels (page 772).
Other traffic: The traffic is sent through the specified VPN. If the traffic is not
allowed in the VPN configuration, it is discarded.
The Selected
The action is applied to a specific VPN.
IPsec VPN
$ Client-to-
Gateway IPsec The action is applied to IPsec VPN client traffic in any VPN.
VPNs
3. (Optional) Switch to the Connection Tracking tab and set the options as explained in
Defining Firewall “Allow” Action Options (page 523).

Defining IPS “Allow” Action Options
You can use the IPS Access rules to activate/deactivate deep inspection for matching traffic. If
deep inspection is disabled, the traffic is not checked against the Inspection rules at all.
If you use one of the default templates as a basis for your policy, Deep Inspection is enabled by
default for all supported protocols (with Continue rules), and can be disabled for a specific rule
if necessary. Otherwise, make sure that your custom template policy directs all necessary
Protocols to be inspected.
 To set the Action options for the Allow action in IPS Access rules
1. Right-click the Action cell in an IPS Access rule and select Allow.
3. Set the options as explained in the table below.
Table 38.10 IPS Allow Action Options
Tab Option Explanation

Selects traffic that matches this rule for checking against the
Inspection Deep Inspection Inspection rules of this policy. Traffic is inspected as the Protocol
that is attached to the Service element in this rule.
Defining IPS “Continue” Action Options in Access Rules

The specified options are applied to any other rule that the same packet matches if the rules
have no rule-specific definitions for the same options.
 To set the Action options for the Continue action in IPS Access rules
1. Right-click the Action cell in an IPS Access rule and select Continue.
Table 38.11 IPS Continue Action Options

Selects traffic that matches this rule for checking against the
Inspection Deep Inspection Inspection rules of this policy. Traffic is inspected as the Protocol
that is attached to the Service element in this rule.
Override Collected Select the option to activate the settings on this tab and override
Values Set with any options set in a preceding Continue rule that matches the
“Continue” Rules same connections.
Response Defines which automatic response is shown to the user when an
HTTP connection is refused or blacklisted. For more information
User Response
about User Responses, see Getting Started with User
Responses (page 612).

Defining IPS “Discard” Action Options
 To set the Action options for the Discard action in IPS Access rules
1. Right-click the Action cell in an IPS Access rule and select Discard.
Table 38.12 IPS Discard Action Options
Option Explanation
Select the option to activate the settings and override any
Override Collected Values Set with
options set in a preceding Continue rule that matches the same
“Continue” Rules
connections.
Defines which automatic response is shown to the user when an

HTTP connection is refused. For more information about User
User Response
Responses, see Getting Started with User Responses
(page 612).
Defining IPS “Refuse” Action Options

 To set the Action options for the Discard action in IPS Access rules
1. Right-click the Action cell in an IPS Access rule and select Refuse.
Table 38.13 IPS Refuse Action Options
Option Explanation
options set in a preceding Continue rule that matches the same
connections.
Defines which automatic response is shown to the user when an

HTTP connection is refused. For more information about User
User Response
Responses, see Getting Started with User Responses
(page 612).
Defining Access Rule Logging Options

Rules can create a log or alert entry each time they match. By default, logging options set in a
previous rule with Continue as its action are used. If no such rule exists, firewalls by default do
log the connections, but sensors do not. Each individual rule can be set to override the default
values.
Note – Log pruning may override the logging options by deleting any number of generated
log entries when they are received at the Log Server.

 To set the Logging options for Access rules
1. Double-click the Logging cell. The logging options dialog opens.
Table 38.14 Access Rule Logging Options
Option Explanation
options set in a preceding Continue rule that matches the
same connections.
None A match creates no entry in the log.
Generates a log entry that is displayed in the Current

Transient
Events mode in the Logs view (if someone is viewing it at
(Firewall only) the moment) but is not stored.
A match to this rule creates a log entry that is stored on

Stored
the Log Server.
Log Level
Generates a log entry that is shown in the Logs view,
Essential saved for further use, and handled as high-priority if the
(Firewall only) log transfer from the firewalls to the Log Server is
interrupted.
A match to this rule triggers the alert you add to the Alert
Alert
field.
If Log Level is set to Alert, defines the Alert that is sent

when the rule matches (the Default alert or a custom
Alert element created in your system). Selecting different Alerts
for different types of rules allows more fine-grained alert
escalation policies.
If Log Level is set to Alert, allows you to override the

Severity
severity defined in the Alert element.
No log No log entries are created when connections are closed.
Both connection opening and closing are logged, but no

Normal log
information is collected on the volume of traffic.
Connection Closing Both connection opening and closing are logged and
(Firewall only) information on the volume of traffic is collected. This
Log accounting option is not available for rules that issue Alerts.
information If you want to create reports that are based on traffic
volume, you must select this option for all rules that allow
traffic that you want to include in the reports.

Defining Access Rule Authentication Options
 To set the Authentication Options for Firewall IPv4 Access rules
1. Double-click the Authentication cell. The Authentication Parameters dialog opens.
Table 38.15 Authentication Parameters
Option Explanation
Require The users are required to authenticate themselves. The request
Authentication is sent to the appropriate authentication service and evaluated.
The firewall establishes a connection to the remote system, and

Method the client software then prompts the user for their ID and
Firewall-initiated
password. The request is sent to the appropriate authentication
Authentication
service and evaluated. This method requires that VPN client
software is installed on the remote system.
Authorization is granted for a single connection. Each connection

requires that the users type in their credentials again. This
Connection
option is useful for granting restricted access to a particular
service that does not open many separate connections.
Permits connections from the client’s IP address until reaching

Authorize
the set Timeout. Choose this option if you want to grant access
Client IP
to several services or a service that opens many connections
during a single session.
Time until the Client IP authorization expires. The default Timeout

Timeout
is 3600 seconds.

Editing Inspection Rules
Inspection rules activate checks for specific traffic patterns and define what action the system
takes when a match is found. Inspection rules examine the packet payload throughout whole
connections, and take action at the point when something threatening is discovered. Inspection
rules are applied to those connections that are selected for deep inspection in the Access rules.
The default IPS templates direct all IP traffic to deep inspection.
The IPS policy contains rules both for the sensor and for the analyzer to which the sensor sends
its event data. Sensors examine IPv4 and IPv6 traffic against criteria defined in Situation
elements. Analyzers process the sensor-detected events using Correlation Situation criteria.
Firewalls work similarly to sensors, but do not send their findings to analyzers, so no event
correlation is available. On firewalls, deep inspection is available for IPv4 connections that are
carried over the HTTP, HTTPS, IMAP, POP3, SIP, SMTP, or SNMP protocols.
 To add an Inspection rule

from the menu. The Firewall Configuration view or IPS Configuration view opens.
2. Right-click a Template Policy, Policy, or Sub-Policy element and select the corresponding
Edit action from the menu that opens. The policy opens for editing.
3. Switch to the Inspection tab.
4. Adjust the Rules that are applied to the majority of traffic. See Modifying the Inspection
Rules Tree (page 531).
5. Define detailed Exceptions to the main Rules. The main uses for exceptions are to
eliminate false positives and to activate blacklisting or User Responses for specific traffic
patterns. See Adding Exceptions to Inspection Rules (page 535).
Modifying the Inspection Rules Tree

The Rules tree on the Inspection tab in firewall and IPS policies allows you to define what kind of
action the system takes when Situation matches are found in traffic and how the match is
logged. The Exceptions in the table above are matched before the Rules tree.
In the tree, the items that have subitems are Situation Type elements. The items that have no
subitems are the individual Situation and Correlation Situation elements. The Rules tree
contains all Situation Types and Situations associated with them, as you can see when
expanding the branches.
What’s Next?
 Changing Inspection Rules Tree Settings (page 532)
Related Tasks
 Defining Logging Options for Inspection Rules (page 533)
 Adding Situations to the Rules Tree (page 534)
 Removing Overrides From the Rules Tree (page 535)
Editing Inspection Rules 531

Changing Inspection Rules Tree Settings
The Inspection tab in Firewall and IPS policies is the main tool for controlling the deep packet
inspection. To edit these rules, you simply click and select an Action or Logging option.
All levels of the tree are editable. Subitems inherit their values from their parent item by default.
Any setting that is different from the default is considered an override. If you change a value in
an item that has subitems, all subitems that are set to use the default value inherit this change.
Any subitems that are set to an override continue to use that override.
Example The parent item and ten of the subitems are set to the “Permit (Default)” action. Two of the
subitems are set to the “Permit” action. You change the parent to the “Terminate” action. Ten
subitems change to “Terminate (Default)”. Two subitems continue to use “Permit”.
The illustration below shows how overrides are highlighted in the tree.
Illustration 38.9 Default Values and Overrides in the Tree

Overrides
Default values
In lists of options, the default setting is also labeled, for example, “Permit (default)”.
Regardless of the settings in the Rules tree in a higher-level template, it is still possible to
change any Rules tree values in the inheriting policy. To add template rules that cannot be
modified in the inheriting Policies, add the rules as Exceptions.
Table 38.16 Inspection Tab - Rules Panel - Action Column
Option Explanation
The definition is ignored. If the included Situations are not referred in the Exceptions
either, the traffic patterns contained in those Situations are not transferred to the
Do Not Inspect
engines and therefore not matched to network traffic. This reduces the engine
workload. This action is only available at the top level of the tree.
The connections are still allowed to continue even when an included pattern is found
in traffic. This Action is useful if you want to log or record connections without
Permit
stopping them. The inspection continues, so other Situations can still match the
same connection and carry out a different action.
On firewalls, stops the connection.

On sensors, stops the connection if that is possible in the physical configuration -
only traffic that flows through an Inline interface pair can be stopped directly. Traffic
that is picked up through a Capture interface can be terminated by closing the
connection through a Reset interface. When this action is triggered, the matching
traffic is not inspected any further. Sensors have a passive termination mode for
Terminate testing purposes in which the connections are not stopped, but create an easily
distinguishable log entry instead. This mode can be set for the whole sensor in the
Sensor element or rule by rule in the options of Exceptions.
Analyzers cannot directly stop a connection, and your actions are restricted to
blacklisting the traffic on a StoneGate firewall or sensor, and/or sending an alert.
The Terminate action triggers a policy installation warning and is converted to an
Alert if used with Correlation Situations (the Analyzer-specific definitions).

Table 38.17 Inspection Tab - Rules Panel - Logging Column
Option Explanation
None A match creates no entry in the log.
Transient Generates a log entry that is displayed in the Current Events mode in the Logs view
(Firewall only) (if someone is viewing it at the moment) but is not stored.
Stored A match creates a log entry that is stored on the Log Server.
Generates a log entry that is shown in the Logs view, saved for further use, and
Essential
handled as high-priority if the log transfer from the engines to the Log Server is
(Firewall only) interrupted.
Triggers an alert. By default, the Default Alert is generated, but you can select a
Alert
different Alert through the Logging Options item.
Logging Allows you to set up traffic recording and select a custom Alert. See Defining Logging
Options Options for Inspection Rules (page 533).
Related Tasks
 Adding Situations to the Rules Tree (page 534)
 Removing Overrides From the Rules Tree (page 535)
 Adding Exceptions to Inspection Rules (page 535)
Defining Logging Options for Inspection Rules

The logging options in the Rules tree contain additional options compared to the main list that
you see when you click the current Logging option for an item. The capabilities are quite similar
in both firewall and IPS, but IPS sensors have additional possibilities for recording traffic (note
that analyzers do not handle network traffic directly, so they cannot record).
 To set logging options

1. Click the Logging setting and select Logging Options. The Logging Options dialog opens.
Table 38.18 Inspection Rules - Logging Options
Option Explanation
Override default value Activates the settings below and sets the Rule to override mode.

Table 38.18 Inspection Rules - Logging Options (Continued)
Option Explanation
Does not generate any entry in the log. If this option is selected,
None
the Recording options are not available.
Generates a log entry that is displayed in the Current Events

Transient
mode in the Logs view (if someone is viewing it at the moment)
(Firewall only) but is not stored.
Logging
Stored Generates a log entry that is stored on the Log Server.
Generates a log entry that is shown in the Logs view, saved for
Essential
further use, and handled as high-priority if the log transfer from
(Firewall only) the engines to the Log Server is interrupted.
Alert Generates the alert selected below.
Click to choose a custom Alert for alert escalation. Selecting

Alert Select different alerts for different types of rules allows more fine-
grained alert escalation policies.
Stores an excerpt of the packet that matched. The maximum

Excerpt
recorded excerpt size is 4 KB. This allows quick viewing of the
(Sensors Only) payload in the Logs view.
Additional Stores packet payload extracted from the traffic. The collected
Recording Payload payload provides information for some of the additional log fields
(Sensors and listed in Log Fields Controlled by the Additional Payload Option
Firewalls) (page 1015) depending on the type of traffic.
Record Records the traffic up to the limit you set in the Record Length
(Sensors Only) field. This allows storing more data than the Excerpt option.
Record Length
Sets the length of the recording for the Record option in bytes.
(IPS Only)
Note – Storing or viewing the packets’ payload may be illegal in some jurisdictions due to
laws related to the privacy of communications.
Adding Situations to the Rules Tree

 To add your custom Situations to the tree
 Select the most appropriate Situation Type (these are all already included at some level
of the tree) as the Situation Type in the properties of a custom Situation element.
Related Tasks
 Creating New Situation Elements (page 597)

Removing Overrides From the Rules Tree
 To remove overrides
 Right-click an item in the tree and select Reset Branch. The item you right-clicked and
all of its subitems are reset to the Default value.
Adding Exceptions to Inspection Rules

Inspection Exceptions allow you to make changes that are not applied to all connections and set
some options (using the Continue action) for Exceptions and Rules further down. Exceptions
also contain some additional options that are not available in the Rules tree.
• You can match specific connections based on the IP addresses of the communicating hosts,
the Service used, and the Logical Interfaces of sensors. For example, an Exception is needed
to eliminate a false positive specifically in traffic between two internal hosts without disabling
the inspection check completely.
• You can set additional responses to matches that are found. You can blacklist connections
on a StoneGate firewall or sensor, and you can add user responses as notifications to some
types of events.
 To define an Exception rule in Inspection rules

• Right-click a generated log entry and select one of the options in the Create Rule
submenu. The rule is created as an Exception with matching details from the log entry.
• Right-click the ID cell in an existing Exception and select Add Rule Before or Add Rule
After.
• Copy-paste some existing Exception rule.
• Copy-paste a rule from the Rules tree to the Exceptions table to match the same
Situation(s) and options.
• Copy-paste an Access rule to match the rule to the same Source, Destination, and
Service.
2. Match the rule to traffic as explained in Defining What Traffic an Inspection Exception Rule
Matches (page 536).
3. Define the exception you want to apply as explained in Defining What Action an Inspection
Exception Rule Takes (page 537).
4. (Optional) Define options for triggering logs and alerts as explained in Defining Logging
Options for Inspection Exceptions (page 543).

Defining What Traffic an Inspection Exception Rule Matches
Inspection rules are matched based on the patterns defined in Situation elements. The traffic is
checked against all patterns in the policy, and when a match is found, the Situation element is
used in looking up the rule that determines what happens to the traffic. If none of the
Exceptions match, the matching continues in the Rules tree.
 To define how an Inspection rule matches traffic

 Fill in the cells as explained in the table below. The Time cell is optional; all other cells
always contain some value.
Table 38.19 Matching Cells in Inspection Rules
Cell Explanation
The traffic patterns that you want the rule to match. The Situation cell accepts
Situation, Situation Type, Tag, and Vulnerability elements.
Situation Types, Tags, and Vulnerabilities are shown as branches in the Situations
tree. Under the branches, you can view the individual Situations. Each Situation is
Situation usually listed more than once because there are alternative ways to categorize the
Situations. The Situation Types form the Rules tree on the Inspection tab, and the
Situation Type tree contains each Situation only once.
Correlation Situations are used by IPS analyzers only. Sensors and firewalls do not
correlate, so they ignore all Correlation Situations.
Matches the rule to only Situations with the specified Severity value(s). For
example, if your rule is general and matches a wide range of Situations, you may
Severity
want to create two similar rules: one for less severe Situations and one for more
Severe situations. Useful in rules that contain Tags in the Situation cell.
If your Sensor has more than one Logical Interface defined, you can optionally add
Logical Interface elements in this cell to select which rules apply to which Logical
Interfaces (network segments). The rules in the default templates match any
Logical Interface Logical Interface.
(IPS only)
For more information, see Defining Traffic Inspection Interfaces for Sensors
(page 379).
Source Matches the rule to one or more IP addresses. Any elements in the Network
Elements category can be inserted into these cells. Both IPv4 and IPv6 addresses
are valid in these cells.
Destination For more information, see Getting Started with Defining IP Addresses (page 562).
You can optionally restrict the scope of Inspection rules by using the
communications protocol as a matching criteria. The communications protocol
Protocol
information is attached to connections in the Access rules (Service cell). Useful in
rules that contain Tags in the Situation cell.

Table 38.19 Matching Cells in Inspection Rules (Continued)
Cell Explanation
Limits the rule’s validity to the specified time period. During the specified time
period, the rule matches. Outside the specified time period, the rule does not
Time
match and the matching continues to the next rule.
(Optional)
The time is entered in UTC. For more information, see Limiting the Time when a
Rule Is Active (page 555).
Defining What Action an Inspection Exception Rule Takes

 To define what an Inspection rule does to matching traffic
 Right-click the Action cell and select one of the options explained in the table below.
Table 38.20 Inspection Exception Rule Actions
Action Explanation
The included Situations are disabled for the matching connections and the
inspection continues. The Situations included in the Permit rule are ignored if they
are included in further rules. Other Situations can still match the same connection
Permit and carry out a different action.
Further options for traffic handling are available in the Action Options. See Defining
Firewall “Permit” Action Options (page 538) and Defining IPS “Permit” Action
Options in Inspection Exceptions (page 541).
The options specified in a rule with this action are stored in memory while the
matching process continues. The specified options are applied to any other rule
that the same traffic matches if the rules have no rule-specific definitions for the
same options.
All settings in the Options cell and the settings for the Terminate action in the Action
Continue cell can be set using Continue rules for further Exceptions and the Rules tree.
However, the Rules tree ignores any logging options set with Continue rules, since
the tree has a separate inheritance system for those options.
Firewall “Continue” Action Options in Inspection Exceptions (page 538) and
Defining IPS “Continue” Action Options in Inspection Exceptions (page 541).

Table 38.20 Inspection Exception Rule Actions (Continued)
Action Explanation
On firewalls, stops the connection.
On sensors, stops the connection if that is possible in the physical configuration -
only traffic that flows through an Inline interface pair can be stopped directly. Traffic
that is picked up through a Capture interface can be terminated by closing the
connection through a Reset interface. When this action is triggered, the matching
traffic is not inspected any further. Sensors have a passive termination mode for
testing purposes in which the connections are not stopped, but create an easily
distinguishable log entry instead. This mode can be set for the whole sensor or in
Terminate
the options of Exceptions.
Analyzers cannot directly stop a connection, and your actions are restricted to
blacklisting the traffic on a StoneGate firewall or sensor, and/or sending an alert.
The Terminate action triggers a policy installation warning and is converted to an
Alert if used with Correlation Situations (the Analyzer-specific definitions).
Firewall “Terminate” Action Options (page 539) and Defining IPS “Terminate” Action
Options (page 542).
Opens a dialog that allows you to modify action-specific options.

Action Options
See the explanations above for further information.
Defining Firewall “Continue” Action Options in Inspection Exceptions

The Continue action can set options for the Permit and Terminate actions in subsequent rules.
 To set the Action options for the Continue action in Firewall Exception rules
1. Right-click the Action cell in a firewall Exception rule and select Continue.
3. Set the options as explained in Defining Firewall “Permit” Action Options (page 538) and
Defining Firewall “Terminate” Action Options (page 539).
Defining Firewall “Permit” Action Options

The options for the Permit action in firewall Exception rules allow you to control the virus
scanning in further detail and set a User Response for virus scanning or Situation matches.
 To set the Action options for the Permit action in Firewall Exception rules
1. Right-click the Action cell in a firewall Exception rule and select Permit.

Table 38.21 Exception Rules - Permit Action Options

Override
collected Select the option to activate the settings on this tab and override
values set with any options set in a preceding Continue rule that matches the
“Continue” same connections.
rules
Anti-Virus Defines if traffic that matches the included Situation(s) is

scanned for viruses. For example, you can deactivate virus
scanning for a specific URL.
Anti-Virus This option only affects traffic that is already selected for virus
scanning in the Access rules. By default, all traffic that is
selected for virus scanning in the Access rules is scanned unless
you make a specific exception.
Override
collected Select the option to activate the settings on this tab and override
values set with any options set in a preceding Continue rule that matches the
“Continue” same connections.
rules
Define which automatic response is sent to the user when an

HTTP connection is terminated due to a Situation match.
Response options are always specific to the Situation used.
Response
When the rule matches Situation “Anti-Virus_Virus-Found” you
can define a response for “Virus found (Firewall)”.
User Response When you match the special URL filtering Situations, you can
define a response for “URL not allowed”.
When you match other HTTP-based Situations, you can define a
response for “Connection terminated by inspection rule”.
For more information, see Getting Started with User Responses
(page 612).
Defining Firewall “Terminate” Action Options

The Terminate action options control connection termination and notifications.
 To set the Action options for the Terminate action in Firewall Inspection Exceptions
1. Right-click the Action cell in a firewall Exception rule and select Terminate.

Table 38.22 Exception Rules - Terminate Action Options - Terminate Tab
Option Explanation
Select the option to activate the settings on this tab and override
Override collected values set with
any options set in a preceding Continue rule that matches the
“Continue” rules
same connections.
If you select Yes, traffic is stopped.

If you select No, a special “Terminate (passive)” log entry is
created, but the traffic is allowed to continue. This option is
Terminates the connection
useful for testing purposes to make sure a new Terminate rule
does not match traffic that you do not want to terminate. The log
entry is generated regardless of the Logging options in the rule.
A TCP reset is sent to both communicating parties, so that they

Notifies client and server with a are notified that the connection did not succeed (like the Refuse
reset action in Access rules). Further options can be set on the Reset
tab for terminated traffic that is not a TCP connection
Table 38.23 Exception Rules - Terminate Action Options - Reset Tab
Option Explanation
same connections.
Sends an This option is only used if the Terminate options are set to notify
‘ICMP communicating parties with a TCP Reset.
destination When you select Yes, the engine sends an ICMP notification to
Reset action unreachable’ communicating parties when non-TCP traffic is terminated.
message if not When you select No, no notification is sent for non-TCP traffic.
a TCP Whether a notification is useful depends on the communicating
connection application.
Table 38.24 Exception Rules - Terminate Action Options - Response Tab
Option Explanation
same connections.

Table 38.24 Exception Rules - Terminate Action Options - Response Tab (Continued)
Option Explanation
HTTP connection is terminated due to a Situation match.
Response options are always specific to the Situation used.
When the rule matches Situation “Anti-Virus_Virus-Found” you
can define a response for “Virus found (Firewall)”.
User Response When you match the special URL filtering Situations, you can
define a response for “URL not allowed”.
When you match other HTTP Situations, you can define a
(page 612).
Defining IPS “Continue” Action Options in Inspection Exceptions

The Continue action can set options for the Permit and Terminate actions in subsequent rules.
 To set the Action options for the Continue action in IPS Exceptions
1. Right-click the Action cell in an IPS Exception rule and select Continue.
3. Set the options as explained in Defining IPS “Permit” Action Options in Inspection
Exceptions (page 541) and Defining IPS “Terminate” Action Options (page 542).
Defining IPS “Permit” Action Options in Inspection Exceptions

The options for the Permit action in IPS inspection Exceptions allow you to blacklist traffic.
 To set the Action options for the Permit action in IPS Exceptions
1. Right-click the Action cell in an IPS Exception rule and select Permit.
Table 38.25 Exception Rules - Blacklist Scope Tab
Option Explanation
same connections.
Creates entries that stop matching current connections, but

Terminate the single connection
which are not stored for any time.
Creates entries that stop matching connections and block traffic

Block traffic between endpoints
between the matching IP addresses for the set duration.
Firewalls and sensors to which the blacklist requests are sent.

Blacklist executors The components must be set up to receive and implement the
requests.

Defining IPS “Terminate” Action Options
The Terminate action options control connection termination, notifications, and the creation of
blacklist entries that can be sent from Sensors and Analyzers to StoneGate Firewalls and
Sensors to block traffic dynamically for a specified time period.
 To set the Action options for the Terminate action in IPS Exceptions
1. Right-click the Action cell in an IPS Exception rule and select Terminate.
Table 38.26 Exception Rules - Terminate Action Options - Terminate Tab
Option Explanation
same connections.
If you select Yes, traffic going through the inline interfaces of a

sensor is stopped and traffic picked up through capture
interfaces is reset (other options permitting). Additionally, a
blacklist entry can be created by the sensor or analyzer and sent
according to the options set on the Blacklist Scope tab.
Terminates the connection
If you select No, a special “Terminate (passive)” log entry is
created, but the traffic is allowed to continue. This option is
useful for testing purposes to make sure a new Terminate rule
does not match traffic that you do not want to terminate. The log
entry is generated regardless of the Logging options in the rule.
A TCP reset is sent to both communicating parties, so that they

Notifies client and server with a are notified that the connection did not succeed (like the Refuse
reset action in Access rules). Further options can be set on the Reset
tab for terminated traffic that is not a TCP connection
Table 38.27 Exception Rules - Terminate Action Options - Reset Tab
Option Explanation
same connections.
Sends an This option is only used if the Terminate options are set to notify
‘ICMP communicating parties with a TCP Reset.
destination When you select Yes, the sensor sends an ICMP notification to
Reset action unreachable’ communicating parties when non-TCP traffic is terminated.
message if not When you select No, no notification is sent for non-TCP traffic.
a TCP Whether a notification is beneficial depends on the
connection communicating application.

Table 38.28 Exception Rules - Terminate Action Options - Blacklist Scope Tab
Option Explanation
same connections.
Creates entries that stop matching current connections, but

Terminate the single connection
which are not stored for any time.
Creates entries that stop matching connections and block traffic

Block traffic between endpoints
between the matching IP addresses for the set duration.
Firewalls and sensors to which the blacklist requests are sent.

Blacklist executors The components must be set up to receive and implement the
requests.
Table 38.29 Exception Rules - Terminate Action Options - Response Tab
Option Explanation
same connections.

HTTP connection is terminated.
Response options are specific to the Situation used.
When you match the special URL filtering Situations, you can
User Response define a response for “URL not allowed”.
When you match other HTTP Situations, you can define a
(page 612).
Defining Logging Options for Inspection Exceptions

The logging options are quite similar in both firewall and IPS Policies, but IPS Policies have
additional options for recording traffic on sensors (Analyzers do not handle network traffic
directly, so they cannot record).
 To set logging options

1. Double-click the Logging cell. The logging options dialog opens.
Table 38.30 Exception Rules - Logging Options
Option Explanation
Override default value Activates the settings below and sets the Rule to override mode.

Table 38.30 Exception Rules - Logging Options (Continued)
Option Explanation
Does not generate any entry in the log. If this option is selected,
None
the Recording options are not available.
Generates a log entry that is displayed in the Current Events

Transient
mode in the Logs view (if someone is viewing it at the moment)
(Firewall only) but is not stored.
Logging
Stored Generates a log entry that is stored on the Log Server.
Generates a log entry that is shown in the Logs view, saved for
Essential
further use, and handled as high-priority if the log transfer from
(Firewall only) the firewalls to the Log Server is interrupted.
Alert Generates the alert selected below.
Click to choose a custom Alert for alert escalation. Selecting

Alert Select different alerts for different types of rules allows more fine-
grained alert escalation policies.
Stores an excerpt of the packet that matched. The maximum

Excerpt
recorded excerpt size is 4 KB. This allows quick viewing of the
(Sensors Only) payload in the Logs view.
Additional Stores packet payload extracted from the traffic. The collected
Recording Payload payload provides information for some of the additional log fields
(Sensors and listed in Log Fields Controlled by the Additional Payload Option
Firewalls) (page 1015) depending on the type of traffic.
Record Records the traffic up to the limit you set in the Record Length
(Sensors Only) field. This allows storing more data than the Excerpt option.
Record Length
Sets the length of the recording for the Record option in bytes.
(Sensors Only)
Note – Storing or viewing the packets’ payload may be illegal in some jurisdictions due to
laws related to the privacy of communications.

Editing NAT Rules
Firewalls can perform NAT (network address translation) for IPv4 addresses. NAT replaces the
source and/or destination IP addresses in packets with IP addresses of your choice. NAT rules
are matched to allowed connections after Access rule matching. NAT is applied before a routing
decision is made, so the address translation may affect how the traffic is routed.
Available NAT Operations
You can define the following types of NAT:
• Static source NAT, typically used for translating the internal (“real”) IP address of an internal
host to a different IP address in the external network.
• Static destination NAT, typically used for translating the public IP address of an internal host
to the private IP address, so that the host (server) can receive new connections from external
hosts. Allows IP address or port translation (PAT), or both.
• A combination of both of the above if you want to translate both the Source and Destination
address in the same connection, for example, to allow internal hosts to access your
organization’s public servers using the public IP addresses of both the client and the server.
• Dynamic source NAT, typically used to translate the internal IP addresses of several internal
hosts to one or a few external IP addresses to hide the internal network structure from
outsiders and to avoid acquiring a separate public IP address for each of the hosts.
• Dynamic destination NAT can be configured for IPv4 traffic as part of the Server Pool feature
(not in NAT rules). See Inbound Traffic Management (page 467).
Guidelines
General guidelines for adding NAT rules:
• NAT rules only apply to connections that are handled statefully (Connection Tracking option is
left selected in the Access rule that allows the connection).
• NAT rules are applied to whole connections; reverse NAT for reply packets is automatic, so
you do not need to define rules for replies within a connection.
• The NAT rules are matched to connections with the same type of matching criteria as other
types of rules. The first matching NAT rule is applied and any other NAT rules are ignored.
• To prevent a NAT rule from matching some connections, create a NAT rule for those
connections that specifies no translation and place it above the rule that matches.
• By default, NAT rules are ignored for traffic that enters or leaves a VPN tunnel. To match such
traffic to NAT rules, enable NAT in the Gateway element’s properties.
• Routing decisions are made after NAT, so keep in mind that translating the destination
address may affect how the traffic is routed. If not included in existing definitions, you may
need to add the translated addresses in the Routing view.
• If you install the firewall policy with the Keep Previous Configuration Definitions option
selected, previous NAT rules are also be kept until all currently open connections that use
those rules are closed. In some cases, the old and the new rules may conflict, preventing
policy installation until the option is deactivated.
For more background information, consult the StoneGate Firewall/VPN Reference Guide.
Related Tasks
 NAT Rule Examples (page 551)
Editing NAT Rules 545

Adding a NAT Rule
 To define a NAT rule
• Right-click the ID cell of an existing NAT rule and select Add Rule Before or Add Rule
After.
• Copy-paste some existing NAT rule.
• Copy-paste an Access rule to match the rule to the same Source, Destination, and
Service.
2. Match the rule to traffic as explained in Defining What Traffic a NAT Rule Matches
(page 546).
3. Define the translation you want to apply as explained in the following sections:
• Overwriting the Source Address in Packets (page 547).
• Overwriting the Destination Address in Packets (page 550).
Defining What Traffic a NAT Rule Matches

NAT rules are matched based on IP addresses and services, but the each address translation
operation places specific restrictions on what you can put in the cells (as explained in the table
below). Consider the design of your NAT rules and Access rules separately, because attempting
to match the different types of rules one-to-one is not effective in most cases, and not always
possible.
To overwrite both the source and destination IP address in the same packet (for example, to
achieve so called “hairpin NAT”), configure both address translations in the same NAT rule.
 To how a NAT rule matches traffic

 Fill in the cells as explained in the table below.
Table 38.31 Matching Cells in NAT Rules
Cell Explanation
Defines the addresses that you want to translate in source address translation
rules. A single continuous address space is required for static source IP address
translation. ANY is invalid as a static address translation definition. Any
combination of IP addresses is valid in dynamic source address translation.
Source
Only used for rule matching in Destination address translation rules, so any
combination of IP addresses (including ANY) is valid in that role.
Elements must contain IPv4 addresses to be valid in NAT rules.
Defines the addresses that you want to translate in destination address translation
rules. A single continuous address space is required for destination IP address
translation. ANY is invalid as an address translation definition.
Destination Only used for rule matching in Source address translation rules, so any combination
of IP addresses (including ANY) is valid in that role.
Elements must contain IPv4 addresses to be valid in NAT rules.

Table 38.31 Matching Cells in NAT Rules (Continued)
Cell Explanation
Defines the TCP or UDP port(s) that you want to translate for destination port
translation. A single continuous port range is required for destination port
translation. ANY is invalid as a port translation definition.
Only used for rule matching in IP address translation rules, so any combination of
ports (including ANY) is valid in that role.
Service
Protocols with complex connection models (such as FTP) require dynamic address
allocation. To apply NAT to such protocols, use a Service that contains the correct
Protocol Agent. The Protocol Agent translates the port or address information that is
sent as packet payload between the client and the server (on the application layer).
If the policy is shared by several firewalls, you can add Firewall element(s) in this
Used On
cell to restrict the NAT rule’s validity to selected firewall(s).
(Optional)
By default, matches on all firewalls that receive the rule (cell is empty).
Overwriting the Source Address in Packets

 To translate source addresses
1. Double-click the NAT cell in the NAT rule. The Network Address Translation dialog opens.
2. Select the translation type as explained in the table below.
Table 38.32 NAT Rule Options - Source Translation Types
Translation Type Explanation

Source addresses in matching connections are not translated. The packets are
None
sent onwards with the source address intact.
Source addresses in matching connections are translated using a smaller pool

of IP addresses than there are original source addresses included in the rule.
Many hosts can use the same IP address, and the connections are
distinguished by allocating a different TCP or UDP port for each connection.
Also used for activating an Outbound Multi-Link configuration (IPv4 only).
Dynamic
Because ports are needed to keep track of connections, dynamic NAT only
works with TCP and UDP protocols. If the protocol used in the communications
is not transported on top of TCP or UDP, the communicating applications must
encapsulate the packets in TCP or UDP (NAT traversal) to communicate through
dynamic NAT.
Source addresses in matching connections are translated using the same

Static number of IP addresses as there are possible original source addresses. Each
translated IP address corresponds to one original IP address.
3. If you selected an address translation operation, configure the additional options according
to the type of operation:
• Defining Static Source Translation Options (page 548).
• Defining Dynamic Source Translation Options (page 549).

Defining Static Source Translation Options
Illustration 38.10 Network Address Translation - Source Tab With Static Translation Selected
Table 38.33 NAT Rule Options - Static Source Translation Options
Option Explanation
The IP addresses you want to change with this address translation. These are
Original defined in the Source cell of the NAT rule and shown here for your reference
only; it is not possible to edit the Original addresses here.
The IP addresses you want the address translation to write in the packets. The
Translated address space must have exactly the same number of IP addresses
as there are in the Original address space, since each original address has a
Translated fixed pair in the translated address space.
Click Select to use an existing network element to define the IP address(es).
Click Address to manually type in the IP address or (sub)network you want to
use for the address translation.
Allows the firewall to answer address queries regarding the translated

address(es). For this to work, the original IP address of all hosts whose IP
Use Proxy ARP (IPv4 address is translated must be included in the address definitions (for example,
only) a Network element) under the correct interface in the Routing view.
This option is required in most cases, but it must not be active for IP addresses
that are used by any equipment in the directly connected networks.

Defining Dynamic Source Translation Options
Illustration 38.11 Network Address Translation - Source Tab With Dynamic Translation Selected
Table 38.34 NAT Rule Options - Dynamic Source Translation Options
Option Explanation
The IP address pool of IP address(es) that are used for the translation. The
minimum size for the pool is one IP address. The number of IP addresses
required depends on how many ports you allow the address translation to use
and how many concurrent connections are handled by dynamic address
translation at peak times. If the IP address/port pairs run out, new connections
cannot be opened before existing connections are closed.
The IP addresses used for NAT must not be in use in the network, as this will
IP Address Pool create an IP address conflict. However, the firewall’s own IP address (CVI on
clusters) can be used for address translation if there are no free IP addresses
available (make sure that your selected port range does not overlap with
communications ports that the firewall uses on this address).
Click Select to use an existing network element to define the IP address(es). To
use Multi-Link features for this traffic, select an Outbound Multi-Link element.
Click Address to manually type in the IP address or (sub)network you want to
use for the address translation.
The start of the port range for source IP address translation. The default is the
First Port to Use
beginning of the “free” high port range, 1024.
The end of the port range for source IP address translation. The default is the
Last Port to Use
highest possible port 65535.
Allows the firewall to answer address queries regarding the translated

address(es). For this to work, the original IP address of all hosts whose IP
Use Proxy ARP (IPv4 address is translated must be included in the address definitions (for example,
only) a Network element) under the correct interface in the Routing view.
This option is required in most cases, but it must not be active for IP addresses
that are used by any equipment in the directly connected networks.

Overwriting the Destination Address in Packets
 To translate Destination addresses
1. Double-click the NAT cell in the NAT rule. The Network Address Translation dialog opens.
Illustration 38.12 Network Address Translation - Destination Tab
2. Select the translation type as explained in the table below
Table 38.35 NAT Rule Options - Destination Tab
Option Explanation
Select if you want to translate destination IP addresses. If you do
Translate Destination
not select this option, IP addresses are not translated, so packets
(Optional) are sent onwards with the destination address intact.
The IP addresses you want to change with this address translation.

These are defined in the Destination cell of the NAT rule and shown
Original
here for your reference only; it is not possible to edit the Original
addresses here.
The IP addresses you want the address translation to write in the

packets. The Translated address space must have exactly the same
IP addresses number of IP addresses as there are in the Original address space,
since each original address has a fixed pair in the translated
Translated address space.
Click Select to use an existing network element to define the IP
address(es).
Click Address to manually type in the IP address or (sub)network
you want to use for the address translation.

Table 38.35 NAT Rule Options - Destination Tab (Continued)
Option Explanation
Allows the firewall to answer address queries regarding the
translated address(es). For this to work, the original IP address of
all hosts whose IP address is translated must be included in the
address definitions (for example, a Network element) under the
Automatic Proxy ARP (IPv4 only) correct interface in the Routing view.
This option is required in most cases, but it must not be active for
IP addresses that are used by any equipment in the directly
connected networks.
Select if you want to translate destination port(s). If you do not

Translate Destination Port select this option, ports are not translated, so packets are sent
onwards with the destination port intact.
The port(s) you want to change with this address translation. These
are defined in the Service element in the Service cell of the NAT rule
Original
and shown here for your reference only; it is not possible to edit the
Original port(s) here.
IP ports The port or port range you want the address translation to write in
the packets. If you enter a port range, it must have exactly the
Translated same number of ports as there are in the Original ports, since each
original port has a fixed pair in the translated address space (for
example, 1-1023 could be translated to 50001-51023).
NAT Rule Examples

Example of a Static Source Translation Rule
This example shows a static address translation that translates the addresses in one network
to IP addresses in another network. In this example, the NAT is done to access a particular
server on the Internet.
Illustration 38.13 Example Scenario
Internal Clients External web server
192.168.1.0/24 213.28.200.140
Table 38.36 Example NAT Rule Matching Cells
Source Destination Service

192.168.1.0/24 213.28.200.140 HTTP

Illustration 38.14 Example NAT Settings
In static address translation using whole networks, each original source IP address has a static
translated pair. For example here, the host 192.168.1.6 is always translated to 193.25.25.6
and host 192.168.1.11 is always translated to 193.25.25.11.
Example of a Dynamic Source Translation Rule

This example shows a dynamic address translation that translates the addresses in one
internal network to a single external address for the purpose of general web browsing.
Internal Clients External web servers
192.168.1.0/24 Any

192.168.1.0/24 ANY HTTP

In dynamic address translation, several source IP addresses are translated using a smaller pool
of translated addresses with the help of port translation. Each client connection uses a different
port on an IP addresses that is shared between several different connections. Since each client
reserves a port, the maximum number of simultaneous connections for a dynamic NAT
operation can be calculated by multiplying the number of IP addresses by the number of ports in
the range. Every port and IP address pair must be free from any other use (duplicate
connections cannot successfully cross the firewall).
Example of a Destination Translation Rule

This example shows a static address translation that translates the external IP address
(213.28.200.140) of a web server to the server’s internal address (192.168.1.201).
External Clients Internal web servers
ANY 192.168.1.201

ANY 213.28.200.140 HTTP

Example of a Combined Source And Destination Translation Rule

In this example, so called “hairpin NAT” is configured. Clients in the internal network
(192.168.1.0/24) contact the organization’s own public web server using the public IP address
(213.28.200.140). The server’s external address is translated to an internal address
(192.168.1.201) that belongs to the same internal network address space as the contacting
clients. Source address translation is used to prevent the server replies to the client’s original IP
address, since such replies would be routed directly within the local network instead of through
the firewall, and the connections do not work without the reverse NAT that the firewall provides.
Internal Clients Internal web server
192.168.1.0/24 192.168.1.201

192.168.1.0/24 213.28.200.140 HTTP

The NAT settings on each tab are not any different than when you apply only source translation
or only destination translation to matching connections. The key is that both definitions must be
defined in the same NAT rule, because none of the other NAT rules are considered after the first
match is found.
Limiting the Time when a Rule Is Active

Prerequisites: None
You can specify whether Access rules and inspection Exception rules are effective during certain
days or times of day only. If you do not specify when a rule is active (the Time cell is left empty),
the rule is always active.
 To specify the validity time of a rule

1. Double-click the Time cell in a rule. The Rule Validity Time dialog opens.
Illustration 38.21 Rule Validity Time
2. Select the Month range during which the rule is effective.

3. Select one of the following:
• Days of Week: creates a weekly schedule.
• Days of Month: creates a monthly schedule.
4. In Day, select the beginning and end of the period during which the rule is enforced.
Limiting the Time when a Rule Is Active 555

5. In Time, specify the times of day during which the rule is enforced.
Note – The time is entered in UTC, so you must calculate which UTC day and time
corresponds to the time that you want to set. Also remember that UTC does not adjust for
Daylight Saving Time (summer time).
6. Click OK.
Validating Rules Automatically

Prerequisites: None
You can automatically validate the rules in a policy at any time when you view or edit a policy in
the Policy Editing view. You can also validate the policy when you install or refresh the policy on
an engine. In both cases, you can also select which issues are checked in the policy.
 To validate a policy
1. Start the policy validation in one of the following ways:
• If the policy is open in the Policy Editing view, click the Tools icon in the policy toolbar and
select Validate. The Validate Policy dialog opens.
• If you are installing or refreshing a policy and the Task Properties dialog is open, make
sure that the Validate Policy before Upload option is selected and click Select Settings.
Illustration 38.22 Validate Policy Dialog
2. (Optional; available in the Policy Editing view) Select the Target engine on which you want to
install the policy to get more accurate results.
• The Target engine selection is used to resolve Alias elements when a policy is validated.
• If no Target engine is selected, all the issues related to the engine configuration cannot
be checked (for example, parts of the VPN configuration).
3. (Optional) Modify the Validation Settings (the types of issues that are checked). All checks
are not performed by default. See Selecting Rule Validation Settings (page 558).

4. (Optional) Click Save as Default if you want so save the selected settings as the default set
for future policy validations.
5. Click OK.
Related Tasks
Overriding Default Validation Options for Rules

The rule properties allow you to view some rule-specific information and select the settings that
are applied to the selected rule when the policy is validated. The rule-specific settings override
the default validation options for your administrator account.
 To select the Validation Settings for a rule

1. Double-click the rule’s ID cell. The Rule Properties dialog opens.
2. Switch to the Validate tab.
Illustration 38.23 Rule Properties Dialog - Validate Tab
3. Modify the Validation Settings (the types of issues that are checked). See Selecting Rule
Validation Settings (page 558).
4. Click OK.
The selected Validation Settings are now applied to this rule when you next validate the policy. A
green check mark is added to the rule’s ID cell in the rule table to indicate that the Validation
Settings of the rule are different from the Validation Settings of the whole policy.
Validating Rules Automatically 557

Selecting Rule Validation Settings
Table 38.40 Rule Validation Options
Option Explanation
General Checks Finds combinations of general settings that are not valid.
Invalid Settings Finds incorrect or incomplete definitions.
Checks that there is a definition in all the mandatory matching cells

Missing Definitions
(Source, Destination, and Service cells).
Routing Definitions
Checks routing definitions.
Check (IPS only)
Configuration
NAT and Routing
Definitions Checks the NAT and routing definitions.
(Firewall only)
VPN Definitions
Checks the VPN configurations in the rule.
(Firewall only)
Duplicate Rules Checks if there are any identical rules in the policy.
Analyze Rules
Unreachable Rules Finds rules that are in a position in which they can never match.
Related Tasks
Viewing Policy Validation Issues

If policy validation finds something, the issues are displayed in the Issues panel in the Policy
Editing view or on the tab that shows the progress of the policy installation.
Illustration 38.24 Issues Panel

Revalidate policy with the Number of
same validation settings found issues
Validate policy and

select validation
properties
Descriptions
of found issue
Rules with issues are listed by rule tag.

 To view a configuration in which a validation issue was found
 Double-click the issue. The relevant part of the configuration is shown.
In rules, the ID cell shows the status of validation issues in the rule. If issues are found for a
rule, the rule’s ID cell has a yellow triangle with an exclamation mark. If a rule’s Validation
Settings override the Validation Settings of the whole policy, the rule’s ID cell has a green check
mark (see Overriding Default Validation Options for Rules (page 557) for more information).
Illustration 38.25 Rules with Validation Issues or Rule-Specific Validation Settings
Rule in which a validation

issue was found
Rule with modified
Validation Settings
What’s Next?
 Fix the issues that are indicated.
Related Tasks
 Disabling a Validation Warning for a Rule (page 559).
 Excluding Rules from Policy Validation (page 559).
 Overriding Default Validation Options for Rules (page 557).
Disabling a Validation Warning for a Rule

You can select that an issue listed in the Issues panel is no longer checked for a rule.
 To exclude a validation issue for a rule

 Right-click the rule in the Issues panel and select Ignore Issue Type for a Rule.
This issue type is no longer checked for this rule. A green check mark is added to the rule’s ID
cell in the rule table to show that the rule’s Validation Settings are not the same as the policy’s
Validation Settings.
You can change the overall selection of validation issues for a rule in the rules’s properties. See
Overriding Default Validation Options for Rules (page 557).
Excluding Rules from Policy Validation

If you do not want to validate a certain rule in the policy, you can exclude the rule from policy
validation.
 To exclude a rule from policy validation

 Right-click the rule in the Issues panel and select Disable All Issues for the Rule.
The rule is no longer checked when you validate the policy. A green check mark is added to the
rule’s ID cell in the rule table to show that the rule’s Validation Settings are not the same as the
policy’s Validation Settings.
Validating Rules Automatically 559

Adding Comments to Policies
Prerequisites: None
You can add two types of comments in firewall and IPS policies:
• The Comment cell in each rule allows you to write rule-specific comments, for example, to
record why the rule was added. Double-click the cell to edit the comment text.
• In rule tables, you can insert comment rules between rules through the right-click menu of
rules. The rules between comments are converted into collapsible sections under the
comment rules to visually structure the policy. Double-click the row to edit the comment text.
You can set each comment rule’s color through the Colors submenu in the comment rules’
right-click menu.
The maximum length of both types of comments is 249 characters.
Changing Default Rules

Prerequisites: None
In most cases, templates and policies are inherited from the default templates in the system.
However, it is not possible to modify these system elements. If you must modify the default
templates, you can create a copy.
Version upgrades and dynamic updates may require changes to the default template rules.
These changes are not applied to any copies of the templates. You must manually modify the
copies to ensure that the system communications continue to be allowed (firewalls) and all
necessary inspection continues to be performed (IPS).
 To create a custom version of a default template

1. Right-click the template and select NewDuplicate.
2. Save the copy of the template under a different name.
3. Right-click existing policies that should use the modified template and select Properties.
4. Select your copy of the template in the Template panel and click OK.
Caution – The operation of the engines can be seriously disturbed by incorrect

modifications to the default rules.

C HAPT ER 39
DEFINING IP ADDRESSES
IP addresses are defined as elements in the system to allow reuse of the same definitions in
any number of configurations for any types of components in the system. Any element that
represents at least one IP address is a Network Element and can be used to define IP
addresses in policies (with some restrictions).
Getting Started with Defining IP Addresses (page 562)

Defining IP Addresses as Elements (page 563)
Using Feature-Specific Elements in Policies (page 571)
561
Getting Started with Defining IP Addresses
Prerequisites: None
The elements that you can use for defining IP addresses are called Network Elements (not to be
confused with the Network element, which defines an IP network). Each element can be inserted
in several places in the Access, Inspection, and NAT rules (as source and destination of traffic)
and in many other places where you need to define IP addresses, for example, in routing and log
filtering.
There are elements in the system whose only role is to define an IP address. But also elements
created for configuring a feature in the system can also be used in policies (with some
limitations) if they represent an IP address.
To access network elements, select ConfigurationConfigurationFirewall or
ConfigurationConfigurationIPS from the menu and expand the
Network Elements branch of the element tree.
To create/modify elements:
• Click the New icon in a view that is currently displaying Network Elements.
• Right-click the Network Elements category or a sub-category in a tree view and select New
from the menu that opens.
• To create a copy of an existing element, right-click it and select NewDuplicate.
• To modify an existing element, right-click an element where it appears and select Properties.
Note that default system elements cannot be edited.
What’s Next?
 The primary tools for defining IP addresses are elements that only exist to represent
one or more IP addresses. These are explained in Defining IP Addresses as Elements
(page 563).
 Many elements that are configured as parts of some feature can also be used to
represent IP addresses. The special issues related to these elements are discussed in
Using Feature-Specific Elements in Policies (page 571).
562 Chapter 39 Defining IP Addresses

Defining IP Addresses as Elements
Prerequisites: None
Different types of elements allow you to flexibly define any set of IP addresses:
• Address Ranges allow you to define any continuous range of IP addresses. See Defining
Address Range Elements (page 563).
• Aliases represent a variable value in policies. The IP address value is filled in based on the
engine on which the policy is installed. Aliases make using the same policy on several
engines practical. See Defining Alias Elements (page 564).
• Expressions allow you to define any set of IP addresses in a single element. They are
especially well suited for excluding some IP addresses from otherwise continuous ranges.
See Defining Expression Elements (page 565).
• Hosts represent a single device in the network. Each Host can represent one or more
individual IP addresses in policies. See Defining Host Elements (page 568).
• Networks represent complete network segments. See Defining Network Elements (page 569).
• Routers represent a gateway device in the network and are primarily meant for configuring
routing. Each Router can represent one or more IP addresses in policies. See Defining Router
Some elements that are primarily meant for configuring a certain feature also define an IP
address. Such elements can be used in policies, but there are some additional considerations.
See Using Feature-Specific Elements in Policies (page 571).
Defining Address Range Elements

An Address Range element can specify any continuous range of IP addresses.
Table 39.1 Address Range Properties
Property Description
The element’s name in the Management Center. Used, for example, to resolve IP
Name
addresses to names in the logs.
Either two valid IPv4 addresses or two valid IPv6 addresses. You must enter the
IP Range same type of address in both fields. The address value on the left (start of range)
must be lower than the address value on the right (end of range).
Category Categories allow you to flexibly filter your Management Client view. See Using
(Optional) Categories (page 72).
Comment Free-form comment for your reference. The comment is displayed in the element’s
(Optional) Properties dialog and in the Info view.
Defining IP Addresses as Elements 563

Defining Alias Elements
Aliases are like variables: they can be given different IP address values in the policy depending
on the engine on which the policy is installed. This makes it possible to create rules that are
valid on several engines without including all IP addresses in the policies of all elements. Alias
elements are especially useful in Template Policies.
Tip – You can view the IP addresses that the Alias represents in the policy of each component: switch
the policy view to the “network details” mode through the Tools icon in the view-specific toolbar
and then select a component from the list that is added to the toolbar.
Some of the default system Aliases always receive their values directly from other parts of each
engine’s configuration and cannot be modified; these Aliases start with two $$ symbols. There
are also some default Aliases in the system that either do not receive any value without your
action, or allow you to add to and change the default values. These Aliases start with one $
symbol, as do all Alias elements you create yourself. For descriptions of default aliases, see
Predefined Aliases (page 943).
Table 39.2 Alias Properties
Name
The value that is used when the policy is installed on a component that does not
have a more specific value for the Alias.
Default Value
If there is no default value, falling back to the default translation returns an empty
(Optional)
value. If the Alias is the only element in the rule cell, the rule is invalid and ignored
when the policy is installed (a warning is displayed if this happens).
Component- The values that the Alias is replaced with when used in the policies of the
Specific components listed.
Values If there is no specific translation value for a component, the default value is used
(Optional) instead.

Defining Expression Elements
Expression elements allow you to combine other Network Elements with logical operators to
represent complex sets of IP addresses.
If you are unfamiliar with the concepts presented here, we recommend reading the chapter on
expressions in the Management Center Reference Guide before you start creating Expression
elements.
The main parts of the Expression properties are explained in the illustration below.
Illustration 39.1 Expression Element Properties
Selected
Create and select element.
elements here.
The Add button
adds this
Logical element to the
Operators. expression.
The expression.
Logical Operators in Expressions are resolved in the following order (however, items inside
parentheses are evaluated before any items outside parentheses are considered):
1. Negations.
2. Intersections.
3. Unions.
 To edit the expression

1. Select the first element in the left panel.
2. Click Add.
3. Select a logical operator.
4. Select the second element in the left panel.
5. Click Add.
Repeat the steps to create a more complex expression. Expressions can also start with a
negation operation or a section in parenthesis. AND and OR logical operators must have an
element (or a section in parenthesis) on both sides of the operator.
You can also:
• Click the expression to view the cursor. Click again or use the arrow keys to move the cursor.
• When the cursor is visible, you can press the Delete or Backspace key to remove an item (no
undo).

Tip – You can view the actual IP addresses that the element adds to a policy: insert the expression in
a rule and activate the “network details” mode through the Tools icon in the view-specific
toolbar.
Table 39.3 Expression Properties
Name
Adds the item in the top right panel into the expression at the bottom at the cursor
Add
location.
If the selected item in the right panel is an Expression element, the button switches
Expand/
the view between showing the element and showing the expression defined in the
Compact
element.
 Union. Includes all IP addresses defined in both elements that the union combines.
Intersection. Includes only those IP addresses that the two elements that the

intersection combines have in common.
Negation. Includes all IP addresses except those that are defined in the element that
~
follows the negation.
( Parentheses group parts of the expression together. Items inside parenthesis are
) evaluated before they are compared to items outside the parenthesis.
Example Expression defining any other network but one internal network (172.16.2.0/24): “[negation]
net-172.16.2.0/24”.
Example Expression for selecting Hosts in the Network 172.17.1.0/24 from a Group element which
contains Hosts from many different networks: “net-172.17.1.0/24 [intersection] Intranet
Hosts Group”.

Defining Group Elements
The Group element can be used to combine any number of previously defined elements into a
single element. The elements can be of different types. Group elements make policies clearer
to read and greatly simplify the editing of configurations where the same elements always
appear together.
Example Host elements for file servers could be gathered together in a Group element, which is then
used in several rules in both firewall and IPS policies. When a new file server is introduced, it
is simply added to the Group. The change is propagated to all rules in all policies in which the
Group is used.
Table 39.4 Group Properties
Name
Resources Select elements that you want to add to the Group in this panel.
Content The elements that are included in the Group.
Use for Status When selected, adds the Group to the System Status tree if the Group contains
Monitoring elements that can be monitored.

Defining Host Elements
A Host element represents the IP address(es) of any single device. Host elements are used to
represent individual devices that have no additional special role in the system configuration
(such as being a next-hop router, an external authentication server etc.).
Table 39.5 Host Properties - General Tab
Name
IPv4 Address
(Optional*) Single valid IPv4 or IPv6 address. You can enter either one or both addresses.
IPv6 Address (*Either an IPv4 or IPv6 address is mandatory.)
(Optional*)
If the device has additional IP addresses, you can enter them here instead of creating
Secondary IP
additional elements for the other IP addresses. The secondary IP addresses are valid
Addresses
in policies and in routing and antispoofing. You can add several IPv4 and IPv6
(Optional) addresses (one by one).
Tools Profile Allows you to add commands to the element’s right-click menu. See Adding Custom
(Optional) Commands to Element Menus (page 53).
Table 39.6 Host Properties - Monitoring Tab
Select the Log Server that monitors this device (third-party monitoring). You must
Log Server select a Log Server to activate the other options. See Getting Started with Third-Party
Device Monitoring (page 112).
Activates the Status Monitoring for this device. You must also select the Probing
Status Profile that contains the definitions for the monitoring. When you select this option,
Monitoring the element is added to the tree in the System Status view. See Creating a Probing
Profile (page 121).
Activates Log Reception from this device. You must also select the Logging Profile
Logs
that contains the definitions for converting the syslog entries to StoneGate log
Reception
entries. See Receiving Logs From External Devices (page 113).
Activates SNMP trap reception from this device. The data that the device sends must
SNMP Trap
be formatted according to the MIB definitions currently active in the system. See
Reception
Importing MIBs (page 120).

Defining Network Elements
A Network element represents the IP address space of a complete network or subnetwork.
Table 39.7 Network Properties
Name
IPv4 Address
and
IPv4 Netmask
A valid IPv4 address and netmask and/or a valid IPv6 address and prefix length. You
(Optional*) can enter either one or both addresses.
IPv6 Address (*Either an IPv4 address and netmask or an IPv6 address and prefix length are
and mandatory.)
Prefix Length
(Optional*)
Broadcast and Includes the broadcast address and the network address in the definition. This
Network option is only used in the Source and Destination cells in rules. In other uses, the
Addresses broadcast and network addresses are always included in the definition regardless of
Included this option.

Defining Router Elements
A Router element represents a next-hop gateway’s IP address in routing configurations when the
Router has a fixed IP address. The element can also be used to represent IP address(es) in
rules and other configurations as needed.
Note – If the interface towards the next-hop gateway has a dynamic IP address, a special
Gateway (DHCP Assigned) element must be added directly through the right-click menu of
the automatically added Network (DHCP assigned) element in the Routing view. The
Gateway (DHCP Assigned) element is not valid in policies; use a corresponding Alias
element instead, see Predefined Aliases (page 943).
Table 39.8 Router Properties - General Tab
Name
IPv4 Address
(Optional*) A valid IPv4 address and/or a valid IPv6 address. You can enter either one or both
IPv6 Address addresses. (*Either an IPv4 address or an IPv6 address is mandatory.)
(Optional*)
If the device has additional IP addresses, you can enter them here instead of creating
Secondary IP
additional elements for the other IP addresses. The secondary IP addresses are valid
Addresses
in policies and in routing and antispoofing. You can add several IPv4 addresses (one
(Optional) by one).
Tools Profile Allows you to add commands to the element’s right-click menu. See Adding Custom
(Optional) Commands to Element Menus (page 53).
Table 39.9 Router Properties - Monitoring Tab
Select the Log Server that monitors this device (third-party monitoring). You must
Log Server select a Log Server to activate the other options. See Getting Started with Third-Party
Device Monitoring (page 112).
Activates the Status Monitoring for this device. You must also select the Probing
Status Profile that contains the definitions for the monitoring. When you select this option,
Monitoring the element is added to the tree in the System Status view. See Creating a Probing
Profile (page 121).

Table 39.9 Router Properties - Monitoring Tab (Continued)
Activates Log Reception from this device. You must also select the Logging Profile
Logs
that contains the definitions for converting the syslog entries to StoneGate log
Reception
entries. See Receiving Logs From External Devices (page 113).
Activates SNMP trap reception from this device. The data that the device sends must
SNMP Trap
be formatted according to the MIB definitions currently active in the system. See
Reception
Importing MIBs (page 120).
Related Tasks
 Configuring Routing (page 439)
Using Feature-Specific Elements in Policies

Prerequisites: None
Many elements are created as part of configuring a particular feature. When such elements
define an IP address for a device, the element can also be used to represent the IP address in
policies. However, there are some special issues that may have to be considered depending on
the element type.
Tip – To view the actual IP addresses that the element adds to a policy, insert the element in a rule
and activate the “network details” mode through the Tools icon in the view-specific toolbar.
System Components
Using elements that represent StoneGate system components as a source or destination IP
address in policies may produce unexpected results. Be careful especially when you use engine
elements as source or destination IP addresses in policies:
• Firewall, SOHO Firewall, Sensor, Sensor Cluster, Analyzer, and Sensor-Analyzer: These
elements represent all static IP addresses defined for all interfaces. Create separate Host
elements to represent individual IP addresses.
• Firewall Cluster: Represent all CVI IP addresses of all interfaces, but not the NDI addresses.
Create separate Host elements to represent individual CVI addresses and NDI addresses.
• Firewalls with dynamic IP addresses: The Firewall element does not represent any of the
dynamic IP addresses. There are default Aliases that can be used to represent the firewall’s
own dynamic IP addresses in the firewall’s own policy. Fixed IP address definitions are needed
for the dynamically assigned IP addresses when they need to be defined in the policies of any
other components.
• SSL VPN Gateway: the element represents the single IP address that is the source address
for centralized monitoring and logging information.
• Management Center servers: represent the single primary IP address defined for the
element.
• Contact addresses are not considered when the element is used in a policy. Consider which
IP address has to be added to the rule and create separate Host elements for the contact
addresses as necessary.
Using Feature-Specific Elements in Policies 571

External Servers
Several types of external servers can be integrated with StoneGate when configuring different
features. In general, each server element simply represents the single primary IP address
defined in the element when used in a policy. Some elements have additional considerations
when used in policies:
• Secondary IP addresses: Many server elements can contain one or more secondary IP
addresses in addition to the primary address displayed for the element. The secondary
addresses are equally valid in policies.
• Contact addresses: Some server elements can have a contact address. Contact addresses
are not considered when the element is used in a policy. Consider which IP address has to be
added to the rule and create separate Host elements for the contact addresses as
necessary.
• Server Pools: The Server Pool element represents the external address(es) that the clients
contact. Use the Server Pool in rules that allow clients’ traffic to the servers whenever you
want to use the Server Pool features. Elements that represent the individual members of the
pool can be used to allow connections to individual pool members (for example, to allow
remote administration of each server).
Traffic Handlers
Traffic handlers are necessary in policies when configuring Multi-Link for firewalls. They can be
used in rules as follows:
• In Source and Destination cells: A Netlink element represents the whole network address
space that is associated with the Netlink element. An Outbound Multi-Link element
represents the network address spaces of all Netlinks included. Traffic handlers are seldom
used this way.
• In the NAT cell in NAT rules: When the source address is translated using the Outbound Multi-
Link element as the address space, the traffic is balanced between the included Netlinks
according to the options selected for the Outbound Multi-Link.
Related Tasks
 Creating an Outbound Multi-Link Element (page 462)
 Defining a Server Pool (page 469)

C HAPT ER 40
DEFINING NETWORK SERVICES
The Service elements match traffic based on protocol or port and set options for advanced
inspection of traffic. Services are used in both firewall and IPS policies.
Getting Started with Services (page 574)

Defining Services (page 575)
Using Protocol Elements (page 579)
Defining Protocol Parameters (page 579)
573
Getting Started with Services
Prerequisites: None
What Services Do
Service elements specify a network protocol, as well as source and/or destination ports for TCP
and UDP traffic.
• Services can be used to match rules to traffic in Ethernet rules (Ethernet Services), Access
rules, and NAT rules.
• Services can refer to Protocol elements, which activate further inspection checks and
advanced traffic handling. Some Protocols have additional options that you can set in the
Service element’s properties.
Most of the time, you can use the default Services already available in the system for standard
protocols and ports. However, you may need to occasionally create a new Service:
• If none of the default Services match the type of traffic you want to allow, for example, if
some TCP or UDP service in your network uses a non-standard port.
• If you want to set options for advanced traffic handling, for example, firewall Access rules for
CIS (content inspection server) redirection, firewall/sensor Access rules that disallow the use
of either the active or passive FTP connection mode, or firewall access and NAT rules for
protocols that assign ports dynamically inside the packet payload.
Illustration 40.1 Elements in the Services Configuration
Protocol (default Service Group
elements only)
Service
1. Create a new Service that matches the correct protocol number and port number (if
applicable), see Defining Services (page 575).
2. (Optional) Select one of the default Protocol elements if you want the traffic to be
inspected further or if you want to use a Protocol Agent. See Using Protocol Elements
(page 579) and Defining Protocol Parameters (page 579).
3. (Optional) Add the Service to a Service Group to make it easier to insert several related
Services into configurations, see Grouping Services (page 578).
574 Chapter 40 Defining Network Services

Defining Services
Prerequisites: None
There are predefined Service elements in the system that correspond to reserved and
commonly used protocols and ports. In addition to these, you may need to add your own
customized Service elements to the system for any non-standard ports in use or if you want to
define options for advanced traffic handling (Protocol Agents).
What’s Next?
 To define a Service for Access, Inspection, or NAT rules, see Defining a New IP-Based
Service.
 To define a Service for Ethernet rules, see Defining a New Ethernet Service (page 577).
Defining a New IP-Based Service

IP-based services are used in Access rules and NAT rules. Make sure that you are clear on
which underlying protocol the traffic you want to allow uses, and be aware of whether you must
define a protocol number or a port number. Usually, the Services you define yourself will be TCP-
or UDP-based and are identified by the port number they use. However, there are many common
protocols that are not TCP- or UDP-based (for example, ICMP and RPC) and are identified by
other information.
Example For example, the GRE protocol is transported directly over IP as protocol number 47 - on the
same layer as TCP (#6) and UDP (#17). Therefore, any custom Services created for TCP and
UDP ports 47 do not allow GRE to pass the firewall.
 To define a new custom service

from the menu. The Firewall or IPS Configuration view opens.
2. Expand the Other ElementsServices branch of the element tree.
3. Create the new Service element:
• To create a new element with no settings predefined, right-click the branch for the type of
Service you want to create and select New[Service type] Service. The Service
Properties dialog opens without any options set.
• To create a new Service based on some other Service element, right-click the existing
Service and select NewDuplicate. The Service Properties dialog opens with options
copied from the existing Service.
Defining Services 575

Illustration 40.2 TCP Service Properties
4. Give the new Service a unique Name and write an optional Comment.
5. Identify the traffic that this Service element matches depending on the Service type as
explained in the table below (IANA assigns the protocol codes; visit www.iana.org for a list):
Table 40.1 Traffic Identification Options in IP-Based Service Elements
Protocol Option Explanation

A destination port or port range. To match a single port, enter it in
Dst. Ports the first field and leave the other field empty. To enter a range,
(Optional*) enter a value in both fields.
TCP and (*Either source or destination port is mandatory.)
UDP A source port or port range. To match a single port, enter it in the
Src. Ports first field and leave the other field empty. To enter a range, enter
(Optional*) a value in both fields.
(*Either source or destination port is mandatory.)
Type The ICMP type number that the traffic uses.
The ICMP code that the traffic uses. If the Code field is empty, the
ICMP Code Service matches traffic regardless of the ICMP code. If you enter
(Optional) 0 as the code, the Service matches only packets that contain no
ICMP code.
Program Number The program number.
Version The remote program version number. If you do not enter a

(Optional) program version, the element matches traffic of any version.
SUN RPC Allow TCP
Allows the RPC message when transported over TCP.
(Optional)
Allow UDP
Allows the RPC message when transported over UDP.
(Optional)
IP Code The numerical protocol code that the traffic uses.

6. (Optional) If you want to associate the Service with a Protocol, click the Select button for
the Protocol field and select the correct Protocol.
• Selecting the Protocol is mandatory if the Service is inserted in an Access rule that
directs packets to deep inspection against the inspection rules.
• Some types of traffic may require a Protocol of the type Protocol Agent.
What’s Next?
 Some Protocols have more options that you can set on the Protocol Parameters tab,
see Using Protocol Elements (page 579).
 Otherwise, click OK to create the new Service element.
Related Tasks
 Grouping Services (page 578).
 Defining What Traffic an Access Rule Matches (page 519).
 Defining What Traffic a NAT Rule Matches (page 546)
Defining a New Ethernet Service

There are predefined Ethernet Service elements in the system that correspond to commonly
used Ethernet services. The predefined Ethernet Services should cover most needs you have,
but you can add additional Ethernet Services to the system if you want to filter other Ethernet-
level traffic, use different names, or add your own comment for the Services.
Caution – Match any IP traffic you allow in Ethernet rules to the default IPv4 and IPv6
Services. These Services match the traffic using the correct Protocol element. Only IP
traffic matched to the correct Protocol element is inspected further against the Access
rules. Non-IP traffic is never inspected any further.
 To define a new Ethernet Service

opens.
2. Expand the Other Elements branch of the element tree.
3. Right-click Ethernet Services and select NewEthernet Service. The Ethernet Service
4. Give the new Ethernet Service a unique Name.
5. Select the Ethernet-level protocol and enter the details as explained in the table below
(IEEE assigns the protocol codes).
Table 40.2 Traffic Identification Options in Ethernet Service Elements

Ethernet
MAC type Enter the EtherType code of the protocol that the traffic uses.
2 (DIX)
Raw IPX
(none) Matches IPX (internetwork packet exchange) traffic.
(Novell)
Defining Services 577

Table 40.2 Traffic Identification Options in Ethernet Service Elements

SSAP The SSAP (source service access point) address that the traffic uses.
LLC The DSAP (destination service access point) address that the traffic
DSAP
uses.
Vendor The OUI (organizational unique identifier) that the traffic uses.
SNAP
Type The type that the traffic uses.
Not editable. Present in the default IPv4 or IPv6 services to direct

Protocol N/A traffic to further filtering and inspection. Not present in any custom
Service elements you create.
6. Click OK.
What’s Next?
 To group similar Ethernet Services together, see Grouping Services.
Related Tasks
Grouping Services
Grouping several Services into Service Group elements simplifies your policies, since you can
insert the Group instead of several individual Service elements. You can group both default
system Services as well as your custom-made elements.
 To create a new Service Group

2. Expand the Other Elements branch of the element tree.
3. Right-click the Services or (IPS only) Ethernet Services branch according to the type of
service you want to create and select either:
• New[Service type] Service Group to create a Service Group under the branch for the
selected type of services (for example, TCP).
• or select NewService Group to create the Service Group under the Group branch (item
not available if you right-clicked Ethernet Services).
4. Give the new Service Group a unique Name.
5. Select the required Services in the list on the left and click Add.
6. Click OK.

Using Protocol Elements
Prerequisites: Defining a New IP-Based Service
Protocol elements can be inserted directly in Inspection rule exceptions. In Access rules, the
Protocol elements are always contained in a Service element, which can then be inserted into
the Service cell in rules. Some Protocols add options that you can adjust to custom Service
elements that you create. You cannot add or modify the Protocol elements directly.
All Protocol Elements identify traffic as being of a certain network protocol. A Protocol element
in Access rules identifies the protocol for inspection against Inspection rules. In Inspection
rules, the Protocol can be used to limit the scope of exception rules according to the Protocol
(as identified in the Access rules) in rules that otherwise match a large number of Protocols.
Additionally, the Protocols may activate some additional software modules on the engines. This
depends on the type of the Protocol element:
• Protocol Tag: a Protocol element that does not activate additional modules.
• Protocol Agent: a Protocol element that activates an additional module on the engines to
provide advanced application layer features.
Some Protocol elements have additional parameters. See Defining Protocol Parameters.
Defining Protocol Parameters

Many Protocols provide options for you to set in the Service that uses them. Some of the
parameters are only used by a specific type of component (firewall or sensor). To set options for
a Protocol, you must attach it to a custom Service element: either open the properties of a
custom Service you have created previously or create a new Service.
See the following sections for more information:
• Defining DNS Protocol Parameters (page 580).
• Defining FTP Protocol Parameters (page 580)
• Defining GRE Protocol Parameters (page 582)
• Defining H323 Protocol Parameters (page 582)
• Defining HTTP/HTTPS Protocol Parameters (page 583)
• Defining IPv4 Encapsulation Protocol Parameters (page 584)
• Defining MSRPC Protocol Parameters (page 585)
• Defining NetBIOS Protocol Parameters (page 586)
• Defining Oracle Protocol Parameters (page 587)
• Defining Shell (RSH) Protocol Parameters (page 588)
• Defining SIP Protocol Parameters (page 589)
• Defining SMTP Protocol Parameters (page 590)
• Defining SSH Protocol Parameters (page 590)
• Defining SunRPC Protocol Options (page 591)
• Defining TCP Proxy Protocol Parameters (page 592)
• Defining TFTP Protocol Parameters (page 593)
Using Protocol Elements 579

Defining DNS Protocol Parameters
The DNS protocol parameters control the DNS protocol enforcement on the IPS sensors. When
you activate this feature, the sensors can determine if traffic on the DNS port is actual DNS
traffic or some other application that misuses this commonly open port (for example, peer-to-
peer file transfer applications may use this port).
The parameters in this protocol are for sensors only.
 To configure DNS Protocol options

1. In the properties of a custom Service you have created, click the Select button for the
Protocol field and select DNS.
2. (For sensors only) Switch to the Protocol Parameters tab and set the parameters for the
Protocol:
Table 40.3 DNS Protocol Parameters
Option Explanation
When set to On, the sensor terminates DDNS update messages.
Deny DDNS updates When set to Off, the sensor allows DDNS update messages to
pass.
When set to On, the sensor terminates DNS zone transfer

messages.
Deny DNS zone transfers
When set to Off, the sensor allows DNS zone transfer messages
to pass.
When set to On, the sensor terminates traffic that is not actually
using the DNS protocol.
Enforce DNS protocol usage
When set to Off, the sensor allows traffic to pass even if the
traffic is not actually DNS-related.
3. Click OK.
Defining FTP Protocol Parameters

A File Transfer Protocol (FTP) session starts with a control connection (by default, TCP port 21),
and the communications continue using a dynamically allocated port. The FTP Protocol Agent
keeps track of the actual ports used, for example, to open them as needed so that the whole
range of possible dynamic ports does not need to be allowed in the policy.
 To configure FTP Protocol options

Protocol field and select FTP.
2. Switch to the Protocol Parameters tab.

3. Set the parameters for the Protocol. Options marked as “Firewall only” should not be
changed from their default values when used on IPS engines:
Table 40.4 FTP Protocol Parameters
Option Explanation
Server is allowed to open data connections to the client
Allow active Yes
(according to information exchanged in the control connection).
mode
No Server-initiated data connections are forbidden.
Client is allowed to open data connections to the server

Allow passive Yes
(according to information exchanged in the control connection).
mode
No Client-initiated data connections are forbidden.
Allows control connections to be opened with the data

Allow related On
connection.
connections
Off Disables the Protocol Agent.
If commands that do not comply with the RFC 959 FTP standard
Strict
Control data are used, the connection is dropped.
inspection
The Protocol Agent tries to identify information for opening the
mode
data connection even if the communications do not strictly follow
(Firewall only) Loose
the FTP standards. Sometimes needed with non-standard FTP
configurations.
Highest allowed source port for Enter a port value to limit the range of allowed source ports of
active data connection data connection on the server.
(Firewall only) Value 0 for the lowest port means that the server always uses the
Lowest allowed source port for port number immediately preceding the destination port.
active data connection If the server uses a standard port, both the lowest and highest
(Firewall only) port number must be 0.
Selects the Content Inspection Server (CIS) to which the

Redirect connections to CIS
connections are redirected. For more information, see External
(Firewall only) Content Inspection (page 669).
4. Click OK.
Defining Protocol Parameters 581

Defining GRE Protocol Parameters
The Generic Routing Encapsulation (GRE) protocol is a tunneling protocol that allows the
encapsulation of network layer packets inside IP tunneling packets.
 To configure GRE Protocol options

Protocol field and select GRE.
3. Set the parameters for the Protocol:
Table 40.5 GRE Protocol Parameters
Option Explanation
Rematches the encapsulated payload inside the tunneling packet
Apply Tunnel On until the maximum rematch count defined in the Sensor
Rematch Properties is reached
Off Encapsulated packets are not rematched.
Tunnel IPv4 On Allows tunneling over IPv4.

Protocol Off Stops connections that are tunneled over IPv4.
Tunnel IPv6 On Allows tunneling over IPv6.

Protocol Off Stops connections that are tunneled over IPv6.
4. Click OK.
Defining H323 Protocol Parameters

H.323 consists of a series of different types of standards relating to video and audio services,
real-time transport, control channels, security, etc. The H323 Protocol Agent tracks the H.323
connections, for example, to allow H.323 traffic through a firewall when NAT is used.
Note – T.120 connections, used for instance for file transfer and whiteboard drawing, are
not allowed by the H.323 Protocol Agent. To allow T.120, use the H.323 Service Group or
the T.120 Service element.
 To configure the H323 Protocol options

Protocol field and select H323.

Table 40.6 H323 Protocol Parameters
Option Explanation
The Protocol Agent monitors the H.323 connection and allows the
Allow related On
related connections in Access and NAT rules.
connections
Allow special Allows H.323 clients to open a special logical channel for audio
Yes
logical and video without NAT.
channels
through (No No Special logical channels are not allowed.
NAT)
4. Click OK.
Defining HTTP/HTTPS Protocol Parameters

There are three HTTP Protocol elements:
• The HTTP element can be used for redirecting traffic to an external content inspection server
and to log the URLs from HTTP requests. This agent has parameters you can set in the
Service properties.
• The HTTP Proxy element can be used for redirecting traffic to any proxy-type of software so
that the client application does not need to be configured to use a proxy. This Protocol has no
parameters.
• The HTTPS Protocol is for SSL encrypted HTTP. This Protocol has the same parameters as the
HTTP agent.
 To configure the HTTP or HTTPS Protocol options

Protocol field and select HTTP or HTTPS.
3. Set the parameters for the Protocol (see the two tables below):
Table 40.7 HTTP Protocol Parameters
Option Explanation
Logging of The URLs of sites that users access are included in generated log
Yes
Accessed entries.
URLs No URLs are not included in generated log entries.
When matching connections to the Inspection rules, the server

Optimized Yes stream matching is done only for patterns that are valid for the
server stream client’s browser type and version.
fingerprinting
No All server stream patterns are matched.

Table 40.7 HTTP Protocol Parameters (Continued)
Option Explanation
Redirect Connections to CIS
connections are redirected. See Getting Started with External
(Firewall Only) Content Inspection (page 670).
Table 40.8 HTTPS Protocol Parameters
Option Explanation
Specifies the HTTPS Inspection Exceptions according to which
traffic is decrypted and inspected or allowed to pass without
HTTPS Inspection Exceptions
decryption. See Getting Started with HTTPS Inspection
(page 656).
HTTPS Yes Enables HTTPS decryption and inspection.

Decryption and
Inspection No HTTPS traffic is not decrypted for inspection.
The URLs of sites that users access are included in generated log
Logging of Yes entries. With HTTPS traffic, requires that the traffic is decrypted
Accessed (see Getting Started with HTTPS Inspection (page 656)).
URLs
No URLs are not included in generated log entries.
When matching connections to the Inspection rules, the server

Optimized Yes stream matching is done only for patterns that are valid for the
server stream client’s browser type and version.
fingerprinting
No All server stream patterns are matched.
4. Click OK.
Defining IPv4 Encapsulation Protocol Parameters

The IPv4 Encapsulation Agent provides protocol inspection for tunneled IPv4 traffic. The
parameters define if IPv4 packets encapsulated in IPv6 packets are rematched to the policy.
 To configure the IPv4 Encapsulation Protocol options

Protocol field and select IPv4 Encapsulation.

Table 40.9 IPv4 Encapsulation Protocol Parameters
Option Explanation
Rematches the encapsulated IPv4 payload inside the IPv6
Apply Tunnel On tunneling packet until the maximum rematch count defined in the
Rematch Sensor Properties is reached
Off Does not rematch encapsulated payload.
For information only. Shows the Ethernet frame type used for
Next Ethernet Type
examining the encapsulated packet.
4. Click OK.
Defining IPv6 Encapsulation Protocol Parameters

The IPv6 Encapsulation Agent provides protocol inspection for tunneled IPv6 traffic. The
parameters define if IPv6 packets encapsulated in IPv4 packets are rematched to the policy.
 To configure the IPv6 Encapsulation Protocol options

Protocol field and select IPv6 Encapsulation.
Table 40.10 Protocol Parameters
Option Explanation
Rematches the encapsulated IPv6 payload inside the IPv4
Apply Tunnel On tunneling packet until the maximum rematch count defined in the
Rematch Sensor Properties is reached
Off Does not rematch encapsulated payload.
For information only. Shows the Ethernet frame type used for
Next Ethernet Type
examining the encapsulated packet.
4. Click OK.
Defining MSRPC Protocol Parameters

The MSRPC (Microsoft RPC) Protocol Agent allows related connections for MSRPC applications,
and handles also NAT modifications for communications between Microsoft Outlook clients and
Microsoft Exchange servers.

The supported end-point mapper (EPM) connection method is TCP. By default, the Microsoft
RPC/EPM service is available at port 135/tcp and the communications continue using a
dynamically allocated port. The Protocol Agent keeps track of the actual ports used to
dynamically allow the connections based on the port allocation. This removes the need to allow
the full range of ports.
 To configure the MSRPC Protocol options

Protocol field and select MSRPC.
2. (Firewall only) Switch to the Protocol Parameters tab and set the parameters for the
Protocol:
Table 40.11 MSRPC Protocol Parameters
Option Explanation
Allow MS Allows remote administration of the Microsoft Exchange server
Yes
Exchange through the Exchange System Attendant service.
Remote
administration No Prevents remote administration.
service
Allows the normal use of the Microsoft Outlook client; the

Allow MS Protocol Agent allows the use of Exchange Database service,
Yes
Exchange user Directory service, Information Store service, MTA service, and
services Store service.
No Prevents end-user services.
Allow related On Allows responses sent by the end-point mapper (EPM) service.
connections Off Disables the Protocol Agent.
Allows other MSRPC requests in addition to Outlook/Exchange.

Allow any UUID On The Service can be used in Access rules to allow related
in endpoint connections. NAT is not supported.
mapping
Off The Service allows only Outlook/Exchange traffic.
Allow Allows message types that are not supported by the Protocol
Yes
unsupported Agent to bypass the control connection.
MS RPC
message Allows only supported message types (bind, bind ack, request,
No
types and response).
3. Click OK.
Defining NetBIOS Protocol Parameters

This Protocol Agent can be used to make NAT modifications in IP addresses transported in the
payload of Windows NetBIOS Datagram Service connections through the firewall, or for deep
inspection on Sensors.

 To configure the NetBIOS Protocol options
1. In the properties of a custom UDP Service you have created, click the Select button for the
Protocol field and select NetBIOS (UDP).
3. Set the parameters for the Protocol Agent:
Table 40.12 NetBIOS Protocol Parameters
Option Explanation
Make If inserted in a NAT rule, the addresses relayed in the NetBIOS
On
corresponding communications are translated according to the NAT rule.
NAT
modifications Only the IP addresses in packet headers are translated if inserted
Off
to payload in a NAT rule.
4. Click OK.
Defining Oracle Protocol Parameters
Caution – The Oracle Protocol Agent is meant for cases in which TCP port 1521 is used
only for negotiating the port number for Oracle database connections, and the port number
for the actual connection is assigned dynamically. It must not be used in any other cases.
This Protocol Agent handles Oracle Transparent Network Substrate (TNS) protocol-based
SQL*Net, Net7, and Net8 connections. It is meant only for non-SSL connections where the port
number is assigned dynamically. If TCP port 1521 is used for the actual database connection,
do not use a Service that contains this Protocol element, because this may consume excessive
resources on the firewall and lead to performance problems (instead, use a Service that
matches TCP port 1521 without any Protocol element).
If you plan to use NAT for Oracle connections, you must configure the Oracle listener so that the
listener tells the client its original non-NATed IP address. This, and the Protocol Agent itself, is
necessary only if the database is located on a different computer than the Oracle listener. The
Oracle Protocol Agent does not modify payload data because the database service connections
could go through a different route than the listener connection.
 To configure the Oracle Protocol options

Protocol field and select Oracle.

Table 40.13 Oracle Protocol Parameters
Option Explanation
Allows database connection based on information in the listener
Allow related On
connection.
connections
Max. length allowed for one TNS Enter the maximum amount of TCP payload data that each Oracle
packet TNS packet is allowed to carry.
Enter a netmask for limiting the allowed traffic. The value

Netmask for allowed server 255.255.255.255 allows the database connection only to the
addresses address in which the Oracle Listener service is located. The value
0.0.0.0 allows database connections to all addresses.
Set checksum Resets the header and packet checksums to zero when the
Yes
to zero for Protocol Agent modifies the packet payload data.
modified TNS
packets No Checksums remain even when the packet is changed.
4. Click OK.
Defining Shell (RSH) Protocol Parameters

Remote Shell (RSH) is a widely used remote management protocol. This Protocol Agent
manages Remote Shell connections and allows NAT modifications to the standard output
(stdout) stream. It also manages RExec connections.
 To configure the Shell Protocol options

Protocol field and select Shell.
Table 40.14 Shell (RSH) Protocol Agent Parameters
Option Explanation
Standard error (stderr) stream is allowed through the firewall as a
Allow Related On
response to an RSH command.
Connections
Off Protocol Agent is disabled.
4. Click OK.

Defining SIP Protocol Parameters
The Session Initiation Protocol (SIP) agent can be used to handle multimedia connections that
use SIP as their transfer protocol.
Using the agent allows SIP to be used across a firewall that uses NAT. SIP uses TCP or UDP port
5060 to initiate the connection, after which the traffic is allocated a dynamically assigned port.
The Protocol Agent keeps track of the actual ports used, so that the range of dynamic ports
does not need to be allowed in the firewall policy.
The SIP agent can be configured to force the client and/or server address used within the SIP
transport layer to be used also for the media stream carried over SIP (by default set on for both
client and server).
Note – Connections used for file transfer and whiteboard drawing are not allowed by the
SIP Protocol Agent. Allow them in a different rule as necessary.
 To configure the SIP Protocol options

Protocol field and select SIP.
Table 40.15 SIP Protocol Parameters
Option Explanation
Allow Related Allows SIP media connections based on the signalling

On
Connections connection.
(Firewall Only) Off Protocol Agent is disabled.
Requires that the media stream uses the same client-side

Enforce client Yes
address as the transport layer.
side media
No Media stream can use any address.
Requires that the media stream uses the same server-side

Enforce server Yes
address as the transport layer.
side media
No Media stream can use any address.
The maximum number of calls allowed by the Access rule. If the

Maximum number of calls
value is 0, no limit is set for the number of calls.
4. Click OK.

Defining SMTP Protocol Parameters
On Firewalls, the SMTP Protocol Agent redirects connections to an external content inspection
server (CIS) for screening. The SMTP client and the external content inspection server have to
be in different networks to ensure that they always communicate through the firewall.
On Sensors, this agent provides protocol inspection and deep inspection.
 To configure the SMTP Redirection options

Protocol field and select SMTP.
2. (For firewalls only) Switch to the Protocol Parameters tab and set the parameters for the
Protocol Agent:
Table 40.16 SMTP Protocol Agent Parameters
Option Explanation
Redirect Connections to CIS connections are redirected. See Getting Started with External
Content Inspection (page 670).
3. Click OK.
Defining SSH Protocol Parameters

Secure Shell (SSH) is an encrypted remote use protocol. This Protocol Agent validates the
communications to make sure the protocol used really is SSH. You can create custom SSH
agents with different settings, if required. The SSH Agent validates SSHv1 only. This Protocol
Agent is available on firewalls and sensors.
 To configure the SSH Protocol options

Protocol field and select SSH.
2. (For firewalls only) Switch to the Protocol Parameters tab and set the parameters for the
Protocol:
Table 40.17 SSH Protocol Agent Parameters
Option Explanation
Bytes allowed from client before Amount of data that the client is allowed to send to the server
Server ID before the server sends its own identification string.
Bytes allowed from server before Amount of data that the server can send to the client before the
Client ID client sends its own identification string.
Bytes allowed from server before Amount of data that the server can send to the client before the
Server ID server sends its own identification string.

Table 40.17 SSH Protocol Agent Parameters (Continued)
Option Explanation
Validates the SSH transfers according to the parameters defined
Make protocol On
in this dialog.
validation
3. Click OK.
Defining SunRPC Protocol Options

There are both UDP and TCP based Protocol Agents for Sun Remote Procedure Call (RPC)
protocol. On the firewall, these agents only assist the firewall in Portmapper connections. They
make the handling of RPC program numbers used in the Access rules more rapid. On the
sensor, these protocol agents provide deep inspection.
Note – The Protocol Agent is meant only for Portmapper connections. Allow other RPC
services using Service elements without the Protocol Agent.
The Portmapper Protocol Agents collect information about RPC services by interpreting the GET
PORT and DUMP PORTS requests and their respective answers. All information it collects is
stored in the Portmapper cache.
When the packet filter needs to evaluate RPC matches, it consults the Portmapper cache to
check if the destination of the packet has the appropriate service defined in the rule. If the
cache does not have the requested information available, the packet under evaluation is not let
through and a query is sent to the destination host for RPC information. The information
received is stored in cache.
When a security policy contains a rule referring to RPC program number, it is essential to pay
attention to the structure of the security policy. We recommend you to follow these precautions
with the RPC protocol:
• Attach Portmapper Protocol Agent only to Portmapper connections passing through the
firewall.
• Allow the firewall engine to send RPC queries as explained below.
• Optimize the structure of your security policy (see www.stonesoft.com/support/ and search
for document number 1313 of type FAQ under “StoneGate Technical Documentation” for
more information).
RPC queries are sent from the firewall to TCP port 111 of the external host. You can use either
the sunrpc services configured for TCP and UPD, or the Portmapper combined service with both
sunrpc services. We recommend you to insert the following rule that allows connections to allow
such connection without the Protocol Agent above any other Portmapper rules:
Table 40.18 Rule for RPC Queries
Firewall engine IP address SunRPC (TCP)

Any Allow
(NDIs on clusters) SunRPC (UDP)

 To configure the SunRPC Proxy options
Protocol field and select SunRPC ([TCP|UDP]).
Protocol Agent:
Table 40.19 SunRPC Protocol Parameters
Option Explanation
Learn RPC Yes Protocol Agent is enabled.
program
number to port
mapping for
future RPC No Protocol Agent is disabled.
service
matches
3. Click OK.
Defining TCP Proxy Protocol Parameters

The TCP Protocol Agent is a proxy agent that allows closing connections after a set amount of
idle time.
Certain TCP based applications do not properly handle closing of connections but instead leave
them open for a long period of time, unnecessarily consuming resources. For such situations,
the TCP proxy agent can be used to actively close the connections after a certain idle time. The
TCP Proxy Agent can also close a connection if connection closing initiated by one of the
communicating parties does not complete in a timely manner.
Apply this Protocol Agent strictly to those TCP connections that require this feature. Proxy
operations use more resources than normal TCP connection handling and therefore increase the
firewall’s load.
 To configure the TCP Proxy options

Protocol field and select TCP Proxy.
Protocol Agent:
Table 40.20 TCP Proxy Protocol Parameters
Option Explanation
Timeout in seconds for aborting a connection counted from when
the connection closing is initiated by one of the communicating
Abort on close parties. The connection is aborted by sending TCP Reset packets
to the unresponsive endpoint. Setting this value to 0 disables
this timeout (connections are left open).

Table 40.20 TCP Proxy Protocol Parameters (Continued)
Option Explanation
Timeout in seconds for closing a connection after the latest
Idle Timeout transmission. Setting this value to 0 disables this timeout
(connections are left open).
On Protocol Agent is enabled.

Use Proxy
3. Click OK.
Defining TFTP Protocol Parameters

Trivial File Transfer Protocol (TFTP) Protocol Agent transfers data using dynamically assigned
ports. The TFTP protocol (RFC 1350) does not limit the port range that can be used. This
Protocol Agent is available on firewalls and sensors. The TFTP Protocol Agent supports NAT
operations (firewall only).
A TFTP Agent is attached to a UDP connection established between the client and the server.
The client opens the control connection from a dynamically selected source port to the fixed
destination port 69/udp on the server. A separate UDP data connection is established between
the client and the server after the client has sent a “read” of “write” command to the server.
The server opens a data connection from a dynamic source port to the client’s destination port,
which is same as the one used as the source port of the control connection.
The parameters in this protocol are for firewalls only.
 To configure the TFTP Protocol options

Protocol field and select TFTP.
Protocol:
Table 40.21 TFTP Protocol Parameters
Option Explanation
Yes Allows file transfer from server to client (downloads)
Allow ‘read’
No Downloads are not allowed.
Allows control connections to be opened with the data

Allow Related On
connection.
Connections
Yes Allows file transfer from client to server (uploads).

Allow ‘write’
No Uploads are not allowed.

Table 40.21 TFTP Protocol Parameters (Continued)
Option Explanation
Names of transferred files and their paths are included in
Log filenames Yes
generated log entries.
and paths
No File and path information is not available in logs.
3. Click OK.

C HAPT ER 41
DEFINING SITUATIONS
Situations are the central element in the Inspection rules in Firewall and IPS policies.
Situations define the patterns that recognize interesting events in the traffic.
Getting Started With Situations (page 596)

Creating New Situation Elements (page 597)
Defining Context Options for Situations (page 599)
Defining Context Options for Correlation Situations (page 602)
Defining Tags for Situations (page 607)
Working With Vulnerabilities (page 609)
595
Getting Started With Situations
Prerequisites: None
Situations are elements that define deep inspection patterns.

What Situations Do
Situations define a pattern in traffic that the system looks for. The pattern is defined by
selecting a Context for the situation and filling in the required parameters, for example, a
StoneGate regular expression.
The Inspection rules in firewall and IPS policies define how the Situations are matched to traffic
and what kind of a action the system takes when a match is found.
Correlation Situations are Situations that IPS analyzers use to examine the raw event data
stream sent by the sensors. The Correlation Situations do not look for patterns in traffic, but for
patterns in the events (logs) that the sensors send to the analyzer based on the patterns the
sensors detect in traffic.
Situations link to relevant external information (CVE/BID/MS/TA) in the form of a Vulnerability
element attached to the Situation.
Situations use a special grouping system called Tags. The Tag elements are shown as branches
in the Situations tree and they can be used in policies to represent all Situations that are
associated with that Tag.
Example Using the Tag “Windows” in a rule means that the rule matches to all Situations in the system
that are classified as concerning Windows systems.
Associating a Situation with a Situation Type includes the Situation in the Rules tree in
Inspection rules, which is grouped according to the Situation Type.
Limitations
The Firewall deep inspection currently supports the IMAP, HTTP, POP3, SIP, and SMTP protocols.
Deep inspection of other protocols requires StoneGate IPS.
596 Chapter 41 Defining Situations

Tags
Situation Type
Context IPS Policy

Situation
Vulnerability
1. Create a new Situation element as explained in Creating New Situation Elements

(page 597)).
2. Give the Situation a Context, and fill in the context information according to the patterns
in traffic that you want to match as explained in Defining Context Options for Situations
(page 599)
3. (Optional) Associate the Situation with the relevant Tags as explained in Defining Tags for
Situations (page 607)
4. (Optional) Associate the custom situation description with a relevant Vulnerability as
explained in Working With Vulnerabilities (page 609).
Creating New Situation Elements

Prerequisites: None
The predefined Situation elements in your system are updated through dynamic update
packages that you should frequently activate in your system (automatically or manually). You can
create new Situation elements in addition to the predefined ones to fine-tune the patterns that
the IPS looks for in the traffic. You can create a Situation element for sensors and firewalls or a
Correlation Situation for Analyzers.
Note – Creating custom Situations requires that you have a basic understanding of the
protocols involved and a clear picture of the patterns of traffic that you want to look for.
 To create a new Situation

from the menu.
2. Expand the Other Elements branch and right-click the Situations branch in the tree view.
3. Select either NewSituation or NewCorrelation Situation. The Situation Properties
dialog opens.
Creating New Situation Elements 597

Illustration 41.2 Situation Properties - General
4. Give the Situation a unique Name and, optionally write a Comment to describe the element
for your reference.
• With the exception of whitelisted URLS in URL Filtering, Situations are identified in the
system only by the element name. Creating multiple Situations that match the same
pattern can make the policy difficult to read and manage.
• The comment is only shown in the element properties and in the Info panel.
5. (Optional) Click Select and select the Situation Type with which to associate this Situation.
You can only select on Situation Type for each Situation. The Situation Type specifies the
branch of the Rules tree under which the Situation is included.
6. Use the Description field to describe the traffic pattern that the Situation represents. This
description is shown, for example, in log entries.
7. Select a Severity for the Situation. The Severity is shown in the logs and can be used in
Alert Policies as a criteria for alert escalation.
8. (Optional) Select how the Attacker and VIctim are determined when the Situation matches.
This information is used for blacklisting and in log entries.
• None does not define the Attacker and VIctim information, so blacklisting entries cannot
be created using the Attacker and Victim options.
• IP Source and IP Destination are the IP addresses of the (last) packet that triggers the
Situation. Since the packet can be a request or a reply, make sure to select the option
correctly based on the pattern that the situation detects to avoid reversed labeling.
• Connection Source and Connection Destination IP addresses depend on which host
opened the connection and provide a constant point of reference to the client and server
in the communications.
What’s Next?
 Depending on the type of Situation element, proceed to Defining Context Options for
Situations (page 599) or Defining Context Options for Correlation Situations (page 602).

Defining Context Options for Situations
Prerequisites: Creating New Situation Elements
The Context information gives the Situation the information on which kind of patterns you want it
to match in the traffic, for example that you want to look for a certain character sequence in an
HTTP stream from the client to the server.
The Context gives you a set of options or a field for entering a regular expression that you can
use to define the pattern you want to look for in the traffic (see Regular Expression Syntax
(page 947)).
Note – With the exception of whitelisted URLS in URL Filtering, Situations are identified in
the system only by the element name. Avoid matching the same pattern in different
Situation elements. Situations with duplicate patterns can make the policy difficult to read
and manage.
These instructions are for Firewall and Sensor Situations. For Analyzer Situations, see Defining
Context Options for Correlation Situations (page 602).
 To define the Context options for a Situation

1. In the Situation properties, switch to the Context tab.
2. Click the Select button. The available Context categories are shown.
3. Select the Context you want to associate with this Situation. The options for that Context
are added to the Situation Properties.
• Right-click any Context in the dialog and select Properties to view a description and/or
usage instructions for the context.
• Contexts may be updated in dynamic update packages, so the context properties contain
the most current information available.
What’s Next?
 To fill in HTTP URL Filter options, see Defining HTTP URL Filter Options
(page 600).
 To fill in scan detection options, see Defining Port/Host Scan Detection
Options (page 600).
 For many Contexts, you must type in a regular expression, see Regular
Expression Syntax (page 947).
 In other cases, open the Properties dialog for the Context element for more
information. When you have configured the necessary context information,
proceed to Adding Tags to One Situation at a Time.
Related Tasks
 Defining Context Options for Correlation Situations (page 602)
Defining Context Options for Situations 599

Defining HTTP URL Filter Options
HTTP URL Filtering Situations allow you to define lists of URLs that blacklist (block) access to
the specified URLs. When used in combination with category-based web filtering, these types of
lists can additionally be used to whitelist (allow) individual URLs that are included in an
otherwise blocked category. URL whitelisting only affects URL-based filtering, and it does not
exclude the traffic from other inspection checks.
Note – To be able to filter HTTPS URLs, you must first decrypt the traffic (see Getting
Started with HTTPS Inspection (page 656)).
 To configure Website Access Control

1. Create a new Situation element with the appropriate basic properties (see Creating New
Situation Elements (page 597) for more information).
2. Switch to the Context tab and select the Context: Application ProtocolsHTTPHTTP
URL Filter.
3. Click the Add button below the entry panel. You can add up to 20 URLs per Situation.
4. Double-click the newly added row and enter the URL without specifying the protocol, for
example, www.example.com.
• Each URL can be a maximum of 64 characters long.
• To block or allow access to an exact URL, type: www.example.com/index.html
• To block or allow access to a domain, type: example.com
• An asterisk (*) can be used at the beginning of the URL. For example: *.example.com
(matches requests for www.example.com and extranet.example.com but not the
shorter variant example.com).
5. Add Tags as you see necessary to organize this Situation and click OK.
What’s Next?
 Adding Tags to One Situation at a Time (page 607)
Defining Port/Host Scan Detection Options

The Scan Started Event Context options can be used to define the bounds for normal traffic,
allowing action to be taken when the values are exceeded. For more information on detecting
scans, see the IPS Reference Guide.
The table below explains the options for the Scan Started Event Context.
Table 41.1 Scan Detection Parameters
Port scan is reported if any of the thresholds is exceeded within
Port scan start period (seconds)
this time limit.
Port scan is assumed finished if the originator makes no scan

Port scan idle timeout (seconds)
attempts within this time limit.
Defines how often an interim status of ongoing port scans is

Port scan status delay (seconds)
reported.

Table 41.1 Scan Detection Parameters (Continued)
Defines how many TCP connections that proceed normally
Maximum normal TCP
according to the protocol definitions are allowed before action is
connections
taken.
Maximum allowed open TCP Number of SYN+ACK replies that are allowed during the tracking
ports before action is taken.
Maximum unreplied TCP Number of unreplied TCP connections that are allowed during the
connections tracking before action is taken.
Maximum allowed closed TCP Number of RST replies that are allowed during the tracking before
ports action is taken.
Maximum TCP segments with no Number of TCP segments with no SYN or ACK flag that are allowed
SYN or ACK before action is taken.
Delay for judging if a TCP connection is a successful port scan or

Wait time for TCP connections
an unreplied connection attempt.
Maximum UDP packet Number of UDP destinations that are allowed per host during the
destinations tracking before action is taken.
Maximum bidirectional UDP Number of bidirectional UDP transfers that are allowed per host
transfers during the tracking before action is taken.
Allowed number of UDP destinations that have not replied or have

Maximum unidirectional UDP
replied with ICMP error during the tracking period before action is
transfers
taken.
Maximum allowed closed UDP Number of ICMP Port Unreachable replies that are allowed per host
ports during the tracking before action is taken.
Maximum ICMP requests per Number of ICMP request destinations that are allowed per host
host during the tracking before action is taken.
Maximum unreplied ICMP Number of ICMP request destinations that have not replied during
request destinations the tracking that are allowed per host before action is taken.
Maximum ICMP Echo Request Number of ICMP Echo Request (ping) destinations that are allowed
destinations per host during the tracking before action is taken.
Number of ICMP Echo Request (ping) destinations that have not

Maximum unreplied ICMP Echo
replied during the tracking that are allowed per host before action
Requests
is taken.
Maximum ICMP Timestamp Number of ICMP Timestamp Request destinations that are allowed
Request destinations per host during the tracking before action is taken.
Number of ICMP Timestamp Request destinations that have not

Maximum unreplied ICMP
Timestamp Requests
is taken.
Maximum ICMP Netmask Number of ICMP Netmask Request destinations that are allowed
Request destinations per host during the tracking before action is taken.
Defining Context Options for Situations 601

Table 41.1 Scan Detection Parameters (Continued)
Number of ICMP Netmask Request destinations that have not
Maximum unreplied ICMP
Netmask Requests
is taken.
What’s Next?
 Adding Tags to One Situation at a Time (page 607)
Defining Context Options for Correlation Situations

Correlation Situations are used by Analyzers to conduct further analysis to events detected by
Sensors. Correlation Situations do not handle traffic directly, but they analyze the events
generated by sensors (matches to Situations found in traffic).
 To set Context information for Correlation Situations

1. In the Situation properties, switch to the Context tab.
2. Click the Select button and click Correlations in the dialog that opens.
• If all items are greyed out, the Situation you are editing is not a Correlation Situation.
3. Select the Context you want to associate to this Situation:
• Compress combines repeated similar events into the same log entry, reducing the
number of log entries. If you select this context, continue in Configuring Compress
Contexts (page 603).
• Count finds recurring patterns in traffic by counting the times certain Situations occur
within a defined time period. The Situation matches if the threshold values you set are
exceeded. If you select this context, continue in Configuring Count Contexts (page 604).
• Group finds patterns in traffic by following if all events in the defined set of Situations
match at least once in any order within the defined time period. If you select this context,
continue in Configuring Group Contexts (page 604).
• Match allows filtering event data using Log Filters. If you select this context, continue in
Configuring Match Contexts (page 605).
• Sequence finds patterns in traffic by following if all events in the defined set of Situations
match in a specific order within a defined time period. If you select this context, continue
in Configuring Sequence Contexts (page 606).
Related Tasks
 If you would like to set options for a Firewall or Sensor Situation instead, see Defining
Context Options for Situations (page 599).

Configuring Compress Contexts
Tip – Tooltips are shown when you place you mouse pointer over a field or a field name and hold it
there for a while.
Caution – Be careful when defining the Compress Context options. You must make sure
that all event data you compress are truly parts of the same event, or you risk losing
valuable event information.
 To configure the Compress context parameters

1. Browse to the Situation(s) you want to count in the left panel of the dialog and drag and
drop them into the Correlated Situations field.
2. Type in the Time Window in seconds. The matches to the Situation(s) selected are
combined to a common log entry when they are triggered within the defined time from each
other.
3. Type in the Events per Window. This defines the maximum number of events that are
forwarded within the Time Window defined.
4. Select an option for Log Fields Enabled:
• Select means including matching items: events triggered by the selected Situations are
considered the same when the values are identical in the Log Fields you place in Log
names.
• Ignore means excluding matching items: events triggered by the selected Situations are
considered the same except when the values are identical in the Log Fields you place in
Log names.
5. Click the Log names field to show the correct elements in the left panel and drag and drop
the desired log field(s). The selected log fields are used by the matching option you
selected in the previous step.
6. Select a setting for Location to determine the execution order of the Compress operation
you define here in relation to other Compress operations. The operations that share the
same Location are executed in parallel; each compress operation receives the same
events as the other compress operations in the same Location. The next Location receives
only those events that are left after the compression. The possible Locations are:
• Very Early: before “Early”.
• Early: before any other correlation (non-compress) operations. After this Location,
remaining events are processed by other correlation operations before the analyzer
continues with further Compression operations.
• Late: after all other correlation (non-compress) operations.
• Very Late: after “Late”.
Caution – Be careful when using the Early or Very Early Locations, because the
compression may then affect the other types of correlation tasks. Using Early and Very
Early can improve performance if the Analyzer load is constantly high.
7. Select a Compress Filter for filtering data to be included in the compression.
What’s Next?
 Proceed to Adding Tags to One Situation at a Time (page 607).
Defining Context Options for Correlation Situations 603

Configuring Count Contexts
there for a while.
 To configure the Count context parameters

2. Type in the Time Window in seconds. This is the period of time within which the matches to
the Situation must occur the specified number of times.
3. Type in the Alarm Threshold number. This is the number of times that the Situation must
occur.
4. Select an option for Log Fields Enabled:
• Select means including matching items: events triggered by the selected Situations are
considered the same when the values are identical in the Log Fields you place in Log
names.
• Ignore means excluding matching items: events triggered by the selected Situations are
considered the same except when the values are identical in the Log Fields you place in
Log names.
5. Click the Log names field to show the correct elements in the left panel and drag and drop
the desired log field(s). The selected log fields are used by the matching option you
selected in the previous step.
What’s Next?
Configuring Group Contexts

there for a while.
The group context has a table that allows you to define log filters and log fields for selecting
which details are considered when events are grouped. In this context, the order in which the
events occur is not considered. If you would like the order of the events to matter, use the
Sequence context instead (see Configuring Sequence Contexts (page 606)).
 To configure the Group context parameters

1. Drag and drop a Filter from the left panel to the Event Match cells for each Member. This
selects the events for examination. You can add and remove members using the buttons to
the right (to remove a member, first select a cell within that member’s column).
2. Type in the Needed Number for each Member to define how many occurrences of the Event
Match are required for the events to be grouped.
3. Drag and drop a log field from the left panel to the Binding cell. You can add and remove
Bindings using the buttons to the right.
• You must select log fields that may receive the same type of value for each Binding row.
The grouping is done per Binding row if the selected events have identical values in the
Log Fields you select.

Example A grouping is possible if Member #1 includes an IP source address field for Binding #1 and
Member #2 includes an IP destination address field for Binding #1, since both fields may
receive an IP address as their value.
4. Drag and drop the relevant Situation(s) to the Correlated Situations field.
5. Select whether you want to Keep and Forward Events:
• Selecting Yes makes the Situation examine the events and trigger the desired response
defined in the Inspection rule but does not combine the matching events into a single
event. All the individual events are still available for further inspection, even though they
have already triggered a response.
• Selecting No makes the Situation combine the matching events together, so that only the
response defined for the one matching inspection rule is triggered, and no further
processing is done on the individual events.
6. Type in the Time Window Size in seconds. This is the period when the events must occur to
be considered a match.
7. Select whether you want to trigger Continuous Responses:
• Selecting Yes makes the analyzer respond as defined in the Inspection rule to each
occurrence of the defined event within the selected Time Window (several times if the
events occur frequently).
• Selecting No makes the analyzer respond only to the first occurrence of the defined event
within the selected Time Window (only once per each time period, even if the events occur
more frequently).
What’s Next?
Configuring Match Contexts

there for a while.
 To configure the Match context parameters

2. Click the Filter field to display filters in the left panel and drag and drop the Filter for finding
a pattern in the event data.
What’s Next?
Defining Context Options for Correlation Situations 605

Configuring Sequence Contexts
there for a while.
The Sequence context has a table you can use to define, in order from left to right, the events
that comprise a sequence. This allows detecting events such as when a request from a client
triggers one pattern and the response from a server triggers a second pattern.
The table has grey and white cells; white cells must be filled, grey cells are left empty. If you
would like to match events regardless of the order in which they occur, use the Group context
instead (see Configuring Group Contexts (page 604)).
 To configure the Sequence context parameters

1. Drag and drop a filter from the left panel to the Event Match cell for the Entry to #1
column to define the first event in the sequence.
2. Drag and drop a log field from the left panel to the Binding #1 cell in the Exit from #1
column. You can add and remove Bindings using the buttons to the right.
• You must select log fields that may receive the same type of value for each Binding row.
The sequencing is done per Binding row if the selected events have identical values in the
Log Field(s) you define.
Example A sequence can be detected if Exit from #1 includes an IP source address field for Binding #1
and Entry to #2 includes an IP destination address field for Binding #1, since both fields may
receive an IP address as their value.
3. After adding the necessary number of Binding rows, define the Event Match field for Entry
to #2 in the same way as for Entry to #1.
4. Define the Binding rows for the Entry to #2 column. As explained above, the type of value
this field may contain must be the same as in other columns on the same Binding row.
5. (Optional) To make a more complex sequence, add a stage using the buttons to the right. A
stage adds the necessary Exit column for the previous stage and an Entry column for a new
event you can add to the sequence. The further sequences are filled in the same way as
described above.
6. When you are finished defining the sequence, drag and drop the relevant Situation(s) in the
Correlated Situations field below the table.
7. Select whether you want to Keep and Forward Events:
• Selecting Yes makes the Situation examine the events and trigger the desired response
defined in the Inspection rule but does not combine the matching events into a single
event. All the individual events are still available for further inspection, even though they
have already triggered a response.
• Selecting No makes the Situation combine the matching events together, so that only the
response defined for the one matching inspection rule is triggered, and no further
processing is done on the individual events.
8. Type in the Time Window Size in seconds. This is the period when the events must occur.
What’s Next?

Defining Tags for Situations
Proceed to one of the following topics:

• Creating a New Tag (page 607)
• Adding Tags to One Situation at a Time (page 607)
• Adding Tags to Several Situations at Once (page 608)
• Removing Tags from Situations (page 608)
Creating a New Tag

Tag elements collect together several Situations that have something in common (for example,
Situations that detect threats against a particular Operating System). Tags are shown as
branches in the Situations tree. Tag elements help you organize the tree, and you can use the
Tags in Inspection rules to easily match the rule to all Situations that reference the Tag.
 To Create a new Tag

from the menu.
2. Expand the Other ElementsSituations branch of the element tree.
3. Right-click the By Tag branch under Situations and select one of the following from the
menu that opens:
• NewApplication.
• NewHardware.
• NewOperating System.
• NewSituation Tag.
4. Type in a Name and optionally a Comment for the new Tag and click OK. The new Tag is
added to the tree under the main category you selected in the previous step.
What’s Next?
 To use this Tag to organize Situations, continue to Adding Tags to One Situation at a
Time (page 607) or Adding Tags to Several Situations at Once (page 608).
Adding Tags to One Situation at a Time

When you are editing the Situation properties, you can add tags as explained directly below. You
can also add tags through the right-click menu for a Situation, allowing you to add the same tags
to several Situations at once, see Adding Tags to Several Situations at Once (page 608).
 To add Tags in the Situation properties

1. In the Situation properties, switch to the Tags tab.
2. Click Add Tags and select a Tag type from the list that opens. The Add dialog opens.
3. Select the Tags you want to use with this Situation and click Select.
4. Repeat the steps to add more Tags of any Type.
5. Click OK to confirm the Situation properties change.
Defining Tags for Situations 607

If you just created a new Situation, you may want to associate appropriate Vulnerability
information to it, see Working With Vulnerabilities (page 609).
Adding Tags to Several Situations at Once

You can add any number of Tags of different types to each Situation.
 To add tags from the element tree

from the menu.
2. Expand the Other ElementsSituations branch of the element tree and one of the
branches below that contains the Situations you want to edit.
3. Ctrl- or Shift-select the Situations that you want to tag.
4. Right-click one of the selected Situations and select Add Tag. The tag types are shown in a
submenu.
Illustration 41.3 Adding Tags to Several Situations at Once
5. Select the type of Tag you want to add from the submenu and select the Tags you want to
attach to the Situation(s) in the Add dialog that opens.
Removing Tags from Situations

The default Tags in System Situations (provided in Update Packages) cannot be removed. You
can only remove those Tags that administrators have added in your system.
 To remove a Tag association from a Situation

from the menu.
2. Expand the Other ElementsSituations branch of the element tree and one of the
branches below that contains the Situations you want to edit.
3. Right-click the correct Situation and select Properties.
4. Switch to the Tags tab.
5. Right-click the Tag you want to remove and select Remove.
6. Click OK.

Working With Vulnerabilities
Prerequisites: None
Vulnerabilities provide a short description of the event that has matched and a reference to
external vulnerability information (CVE/BID/MS/TA). When a Situation element refers to a
Vulnerability, the vulnerability information is included in the log entries when the Situation
matches traffic. You can also use the vulnerability codes in the element search to find Situation
and Vulnerability elements in the system that refer to the code.
Vulnerability information is included in dynamic update packages, so Situations provided by
Stonesoft are already linked to a Vulnerability when appropriate. You can associate Situations
with an existing Vulnerability or add a custom Vulnerability element.
Related Tasks
 Creating New Vulnerability Elements (page 609)
 Associating Vulnerabilities With Situations (page 610).
Creating New Vulnerability Elements

 To create a new Vulnerability element
from the menu.
2. Expand the Other ElementsSituations branch of the element tree.
3. Right-click the By Vulnerability branch in the tree view and select NewVulnerability from
the menu. The Vulnerability Properties dialog opens.
4. Give the Vulnerability a descriptive name and optionally a comment.
• The Comment is not shown in the Logs view. Use the Description field to write
information to be shown in the logs.
5. To create a reference to external vulnerability information, select one or more reference
systems in the Reference System section and type in the ID this vulnerability has in that
system:
• Mitre: vulnerability ID format is CVE-YYYY-XXXX
• SecurityFocus: vulnerability ID format is BID-XXXXX
• Microsoft: vulnerability ID format is MSYY-XXX
• Us-Cert: vulnerability ID format is TAYY-XXXX
6. After you have entered the vulnerability ID, click Show next to the ID field to view the
information about the vulnerability in the reference system.
7. Type or copy-paste a short description of what the vulnerability is about into the Description
field.
8. Under Situations, browse to the correct Situation elements, select them (one or several at
a time) and click the Add button to associate them with this Vulnerability. The selected
Situations are added to the Content field on the right.
9. When you are finished adding Situations, click OK. The selected Situations are now
associated with this vulnerability, and a link to this Vulnerability is added on the Situations’
properties dialog.
Working With Vulnerabilities 609

Associating Vulnerabilities With Situations
 To add/remove a Vulnerability from Situation elements
from the menu.
2. Expand the Other ElementsSituationsBy Vulnerability.
3. Right-click the correct Vulnerability in the tree and select Properties from the menu. The
Vulnerability Properties dialog opens.
4. Select the Situation elements (one or several at a time) and click the Add or Remove
button to change the selection in the Content field on the right.
5. When you are finished adding Situations, click OK. The selected Situations are now
associated with this vulnerability, and a link to this Vulnerability is added on the Situations’
properties dialog.

C HAPT ER 42
DEFINING USER RESPONSES
The User Response element allows you to send a customized reply to the user instead of just
ending the connection when an HTTP connection is refused, terminated, or blacklisted. User
Responses can be used in IPS Access Rules, and in Firewall and IPS Inspection rules.
Getting Started with User Responses (page 612)

Creating User Responses (page 612)
Defining User Response Entries (page 613)
611
Getting Started with User Responses
Prerequisites: None
What User Responses Do

User Responses allow you to define custom responses that are sent to the user when an HTTP
or HTTPS connection is not allowed to continue. This makes it possible to explain to the user
why the connection was stopped, instead of simply closing the connection with no notification.
User Responses help administrators differentiate cases where a connection was blocked by the
IPS from cases where a technical problem prevented the connection from going through.
Limitations of User Responses
On firewalls, User Responses can only be used in the Inspection rules. For this reason, firewalls
cannot use User Responses when a connection is blacklisted or refused by an Access rule.
1. Create a User Response element as explained in Creating User Responses (page 612).
2. Define the responses that are sent to the users when a connection is not allowed to
continue. See Defining User Response Entries (page 613).
3. Use the User Response element in the Access rules and Inspection rules as required.
See Editing Access Rules (page 518) and Editing Inspection Rules (page 531).
Creating User Responses

Prerequisites: None
 To create a User Response

1. Select ConfigurationConfigurationIPS or Firewall from the menu. The Configuration
view opens.
2. Browse to Other ElementsIPS Properties or Firewall PropertiesUser Responses.
3. Right-click User Responses and select New User Response. The User Response
4. Enter a unique Name.
What’s Next?
 Customize the responses that are sent to the users. Proceed to Defining User
Response Entries (page 613).
612 Chapter 42 Defining User Responses

Defining User Response Entries
Prerequisites: Creating User Responses
You can define a different User Response entry for each of the following cases in which an HTTP
or HTTPS connection is not allowed to continue:
• Connection blacklisted: the connection was discarded according to a rule with the Apply
Blacklist action. See Getting Started with Blacklisting (page 678) for more information.
• Connection refused by Access rule: the connection was dropped according to an Access
rule with the Refuse action.
• Connection terminated by inspection rule: the connection was terminated according to an
Inspection rule with the Terminate action.
• URL not allowed: the connection was terminated by one of the special URL filtering
situations. See Getting Started with Web Filtering (page 652) for more information.
• Virus found (Firewall): the firewall’s anti-virus feature found a virus in the web page. See
Configuring Anti-Virus Settings (page 424) for more information.
 To define a User Response entry

1. Switch to the HTTP(S) tab of the User Response Properties dialog.
Illustration 42.1 User Response Properties - HTTP(S) Tab
2. Click Edit for the entry you want to change. The User Response Entry Properties dialog
opens.
Defining User Response Entries 613

Illustration 42.2 User Response Entry Properties
3. Select one of the following responses:

• TCP Close: The connection is closed. No response is sent to the user.
• URL Redirecting: Enter the URL to which the connection is redirected. The URL must
begin with http://
• HTML Page: Enter the HTML source code to display to the user. The HTML source code
must be a complete HTML page, including the <html> and <body> tags.
4. Click OK.
What’s Next?
 Select the User Response element in the Action options of Access rules and
Inspection rules as required. See Editing Access Rules (page 518) and Editing
Inspection Rules (page 531).
614 Chapter 42 Defining User Responses

C HAPT ER 43
QUALITY OF SERVICE (QOS)
The Quality of Service (QoS) features allow you to manage bandwidth and prioritize
connections on the firewall. QoS features are available on firewalls.
Getting Started with QoS (page 616)

Creating QoS Classes (page 617)
Defining QoS Policies (page 618)
Matching QoS Rules to Network Traffic (page 620)
Defining Interfaces’ Speed and QoS Policy (page 621)
615
Getting Started with QoS
Prerequisites: None
QoS (Quality of Service) allows you to manage the available network bandwidth and ensure that
important network services are given priority over less important traffic.
What QoS Does
The firewall QoS features help you in the following ways:
• You can set up a Guarantee for minimum bandwidth for a type of traffic that must always be
allowed through quickly.
• You can set up a Limit for maximum bandwidth for a type of traffic that must never use more
than a certain share of the available bandwidth.
• You can set a Priority value for the traffic. Higher priority traffic is sent forward to its
destination before lower priority traffic if the firewall needs to queue packets due to
congestion.
• You can also create QoS rules that read or write the priorities in DiffServ Code Point (DSCP)
type of service (ToS) fields, so that StoneGate obeys the priorities set by other network
equipment and other equipment know the priorities set in StoneGate.
Limitations
QoS features have the following notable limitations:
• QoS is available on firewalls’ Physical interfaces, VLAN interfaces, and ADSL interfaces only.
QoS is not available on Modem interfaces.
• It is not possible to apply a bandwidth guarantee to incoming Internet traffic on your Internet
link. By the time the firewall sees the traffic, the bandwidth has already been used. If you
want guaranteed bandwidth for a specific portion of your incoming Internet traffic, contact
your ISP and ask if they can enforce this guarantee for you.
• If you want to create QoS rules for both incoming and outgoing traffic, you must assign a QoS
policy to at least two interfaces. Incoming traffic is processed according to the firewall policy
and then the QoS policy is applied to the allowed traffic on the outgoing interface.
Make clear to yourself at which point the QoS rules are applied:
• Any priorities, limits, and guarantees are applied and DSCP codes are written to outgoing
packets on the interface that the traffic uses to exit the firewall according to the QoS policy
and interface speed defined for that interface.
• For packets that enter the firewall, the QoS policy on that interface is only used for reading
DSCP codes and matching them to QoS Classes for further use. This is the only QoS
operation that is done on the interface that the traffic uses to enter the firewall.
Example If a new packet enters the firewall through interface A and leaves the firewall through
interface B, any priorities, guarantees, and limits are configured and applied on interface B.
The priorities, guarantees, and limits configured on interface A are ignored for packets in this
direction. If the packet contains a DSCP code when entering the firewall, the DSCP code is
read and matched to a StoneGate QoS Class on interface A, but if a new DSCP codes is
(over)written in the packet, the new code is written on interface B.
616 Chapter 43 Quality of Service (QoS)

QoS Policy Firewall
QoS Class
Firewall Policy
1. Create a QoS Class element for each type of traffic that you want to handle differently on
any single network interface. See Creating QoS Classes (page 617).
2. Create one or more QoS Policies to define how each type of traffic is handled on the
interfaces. See Defining QoS Policies (page 618).
3. Assign QoS Classes to different types of traffic in your Access rules. See Matching QoS
Rules to Network Traffic (page 620).
4. Define the speed of each interface and the QoS Policy each interface uses. See Defining
Interfaces’ Speed and QoS Policy (page 621).
What’s Next?
 To create your custom QoS scheme, proceed to Creating QoS Classes (page 617).
 If the default QoS Policy is sufficient for you, proceed to Matching QoS Rules to Network
Traffic (page 620).
Creating QoS Classes

Prerequisites: None
QoS classes link QoS rules to Access rules in firewall policies. They can also be used in
Outbound Multi-Link elements to adjust the load balancing of different types of connections.
You must create one QoS Class for each rule you plan to add in any single QoS Policy, as the
QoS policy cannot contain any overlapping rules.
There is a default QoS Policy and three QoS Classes in the system that can be used as such to
set priorities for high, normal, and low priority traffic without any bandwidth guarantees or limits.
Tip – You can also create new QoS Classes from within the QoS Policy in a similar manner as
described below.
 To create a QoS Class

view opens.
2. Expand the Other Elements branch of the tree.
3. Right-click QoS Classes and select New QoS Class. The QoS Class Properties dialog
opens.
Creating QoS Classes 617

4. Give the QoS Class a Name.
5. Click OK. The new QoS Class is added to the resources and can now be used in policies.
Create one QoS class for each rule you plan to add in the QoS Policy.
Defining QoS Policies

Prerequisites: Creating QoS Classes
QoS policies determine the rules that the firewall follows when it decides which traffic is given
priority and how the available bandwidth is divided. One QoS policy can be assigned for each
physical or VLAN interface. You can assign the same QoS policy to several interfaces. To be able
to use the same policy on interfaces with different speeds, enter bandwidth limits and
guarantees as percentages of the total available bandwidth.
Most definitions in the QoS Policy are only applied when the traffic needs to be queued, so it is
applied on each interface to packets that exit the firewall. The exception to this is mapping
DSCP codes present in traffic to QoS Classes in StoneGate, which is done to packets entering
the firewall.
Creating New QoS Policies

 To create a new QoS Policy
view opens.
2. Expand the Other Elements branch of the tree.
3. Right-click QoS Policies in the tree and select New QoS Policy. The QoS Policy Properties
dialog opens.
4. Type in a Name and click OK. The new QoS policy opens.
What’s Next?
 Fill in the policy by Editing QoS Rules (page 619).

Editing QoS Rules
Follow these general guidelines when editing QoS rules:
• The order of the rules in a QoS policy does not affect how traffic is handled by the firewall, as
the match is made only based on the QoS Class.
• Use percentages instead of absolute speed values if you want to share the same QoS Policy
between interfaces that have different throughputs.
• A DSCP Match operation is always made according to the matching rule in the QoS Policy that
is assigned to the interface that the traffic uses to enter the firewall.
• All other operations are always made according to the matching rule in the QoS Policy that is
assigned to the interface that the traffic uses to exit the firewall.
• The rules do not need to cover all traffic. Traffic that is not covered is given a priority of 8
without limits or guarantees.
 To edit a QoS rule

1. To add a new QoS rule, right-click an existing rule (or the default Normal Processing rule)
and select Add Rule Before or Add Rule After. A new blank rule is added.
2. Click the QoS Class cell in the new rule and select the QoS class.
3. Define how StoneGate handles traffic in this QoS Class using any combination of the
following options (each is optional):
• Guarantee: Sets the minimum bandwidth given to this type of traffic under any conditions.
Enter a number as kilobits per second (for example, 300) or as a percentage of the
available bandwidth (for example, 10%). You can also use the shorthands M or G to enter
the value in megabytes or gigabytes respectively (for example, 3M for three megabytes).
• Limit: Sets the maximum bandwidth that this type of traffic is allowed to consume at any
one time. Enter a number as kilobits per second (for example, 300) or as a percentage of
the available bandwidth (for example, 10%). You can also use the shorthands M or G to
enter the value in megabytes or gigabytes respectively (for example, 1G for one gigabyte).
• Priority: Assigns this type of traffic a number that is used to determine the order in which
the firewall sends queued packets onwards or drops them if the queue fills up. Enter a
number between 1 (highest priority) and 16 (lowest priority).
4. (Optional) In DSCP Mark, define the DSCP code you want to give to traffic matching to this
rule (ToS field). This allows you to:
• Communicate the priority of this traffic to other devices that support QoS.
• Convert the packet to use a different classification scheme if the QoS Class was originally
assigned to matching traffic by a DSCP match in the source interface’s QoS Policy.
• Clear the DSCP classification set by other devices by entering 0 as the value (shown in
the policy as 0x00).
• The DSCP code is applied to the outer packet in encapsulated communications (like VPN).
5. Save the QoS Policy.
What’s Next?
 If you added new QoS rules, insert the corresponding QoS Classes into the firewall
Access rules as explained in Matching QoS Rules to Network Traffic.
 If the necessary QoS Classes are already in the firewall Access rules, but you have not
defined the QoS Policy and interface speed for all physical or VLAN interfaces, proceed
to Defining Interfaces’ Speed and QoS Policy (page 621).
 Otherwise, you are done. Refresh the firewall’s policy to transfer the changes.
Defining QoS Policies 619

Matching QoS Rules to Network Traffic
Prerequisites: Creating QoS Classes, Defining QoS Policies
The QoS rules are linked to different types of traffic using the QoS classes. QoS Classes are
matched to traffic in the firewall Access rules with following actions:
• Rules with the Allow action to set a QoS class for traffic matching that rule.
• Rules with the Continue action to set a QoS class for all subsequent matching rules that
have no specific QoS class defined.
• Rules with the Use VPN action to set a QoS class for VPN traffic. Incoming VPN traffic may
also match a normal Allow rule after decryption. Note that QoS is not applied to encapsulated
traffic. For outgoing traffic, encryption is done before the QoS Policy is checked. For incoming
traffic, decryption is done after the QoS Policy is checked.
However, if you want to read and use DSCP markers set by other devices, the QoS Class is
assigned using the QoS Policy.
Note – If traffic is assigned a QoS Class using a DSCP Match rule, the same traffic must
not match any Access rule that assigns a different QoS Class to the same traffic. Such
Access rules override the QoS Class set using a DSCP Match.
 To match a QoS rule to network traffic

1. Open the Firewall Policy for editing.
2. Click the QoS Class cell of a rule that allows traffic through the firewall (or a Continue rule)
and drag and drop one QoS Class element into the cell.
• The QoS Class links connections to a QoS rule. There can be different rules in different
QoS Policies for the same QoS Class.
• Packets in both directions of a connection are assigned the same QoS Class (when the
connection is handled statefully, that is, connection tracking is active for the rule).
• The applied QoS Class is shown in the logs, and reports can also be generated based on
this information.
What’s Next?
 If you have just created a new QoS policy, define the interface speeds and select this
QoS policy for the relevant interfaces. See Defining Interfaces’ Speed and QoS Policy
(page 621).
 Otherwise, you are done. Refresh the firewall’s policy to transfer the changes.
Related Tasks

Defining Interfaces’ Speed and QoS Policy
Prerequisites: Creating QoS Classes, Defining QoS Policies
To implement your QoS rules, define which QoS Policy each physical or VLAN interface uses. If
you want to enforce bandwidth limits and guarantees in your policy, also define the bandwidth
that each interface provides. Each physical or VLAN interface has separate QoS settings:
• DSCP read operations are done on the interface that the packets use to enter the firewall.
• All other QoS operations are done on the interface that the packets use to exit the firewall.
Example Traffic from the internal network to the Internet (uploads) match the QoS Policy of the
interface that connects to your ISP. Traffic from the Internet to an internal network
(downloads) matches the QoS Policy of the interface that connects to your internal router.
If you want to use any QoS-related settings on an interface, you must also define the throughput
for the interface.
 To set the bandwidth and QoS policy for a physical or VLAN interface
1. Double-click a Firewall element. The properties dialog for that firewall opens.
3. Double-click a physical or VLAN interface. The properties dialog for that interface opens.
• If there are VLANs on a physical interface, the settings are only available in the properties
of each VLAN.
4. Set the QoS Policy that this interface uses.
5. Enter the Throughput in kilobits per second.
• You can also use the shorthands M or G to enter the value in megabits or gigabits
respectively (for example, 3M for a 3 megabit throughput).
• In a Multi-Link configuration with more than one ISP link behind a single physical firewall
interface, enter the total bandwidth of all active ISP links (NetLinks) on the same
interface.
Caution – Make sure you set the Throughput correctly. When the throughput is set, the
firewall always scales the total amount of traffic to the Interface speed you defined. This is
regardless of whether you have set any bandwidth limits or guarantees for any traffic.
6. Click OK. Repeat as necessary for other interfaces. Interfaces with QoS in use are marked
with Q in the Interfaces table’s Mode column.
7. Click OK to close the firewall properties
What’s Next?
 The configuration is now finished. Refresh the firewall’s policy to transfer the changes.
Defining Interfaces’ Speed and QoS Policy 621

C HAPT ER 44
SETTING UP USER AUTHENTICATION
You can implement user authentication to control which resources different end-users can
access. Authentication can be used as an additional access requirement in IPv4 Access rules
in Firewall policies. IPS components do not perform user authentication. Both internal and
external user storages and user authentication servers can be used.
Getting Started with User Authentication (page 624)

Integrating External LDAP Databases (page 626)
Integrating External Authentication Services (page 634)
Defining User Accounts for Authentication (page 637)
Defining Authentication Rules (page 642)
Managing User Information (page 644)
Authenticating to a StoneGate Firewall (page 647)
Customizing the User Authentication Dialog (page 648)
Monitoring and Testing User Authentication (page 649)
623
Getting Started with User Authentication
Prerequisites: None
Authentication means requiring users proof of their identity before giving access to a network
resource. Authentication is mandatory with client-to-gateway VPNs. You can require
authentication for any non-VPN connections as well.
What User Authentication Does
With user authentication, you can:
• Maintain separation of internal networks with different security levels in cases where the
confidentiality of the information that is accessed does not need to be strictly enforced (for
example, as an additional access control measure for applications that exchange the
information securely).
• Allow secure and confidential access from any location to any internal resources for users
with VPN clients.
Limitations
• Users are automatically prompted to authenticate if they have the StoneGate IPsec VPN client
installed. Non-VPN authentication does not support automatic authentication prompts.
• Authentication without establishing a client-to-gateway VPN uses Telnet, which transfers
usernames and passwords in cleartext. A one-time password scheme is required for a secure
solution, and this requires setting up an external authentication server. After the users
authenticate, their communications are also transferred as cleartext in this case.
• The internal LDAP user database does not allow external authentication servers to query user
information. An external user database is always required if you want to use external
authentication servers with StoneGate.
• The internal LDAP database limits the length of the User and User Group DN (distinguished
name) to a maximum of 254 characters. Check the restrictions of external LDAP servers from
the external server’s documentation.
• If there are administrative Domains configured, the internal user database is always in the
Shared Domain and the user accounts stored in the internal database are also always in the
Shared Domain. If you want to limit the visibility of end-user accounts, you must configure
external LDAP database(s) separately for each Domain.
• User authentication is only possible with IPv4 addresses. All elements used in User
Authentication must have an IPv4 address. User Authentication can only be configured in the
IPv4 Access rules.
Authentication requires a user database that stores the user information and an authentication
service that inspects credentials and grants or denies the access.
StoneGate has an internal user database and internal authentication methods. Alternatively, you
can use external LDAP user databases and/or external RADIUS or TACACS+ compatible
authentication servers such as IAS, RSA Authentication Manager (SecurID), or StoneGate SSL
VPN appliances.
See the Firewall/VPN Reference Guide for more information on the different configuration
options.
624 Chapter 44 Setting up User Authentication

Authentication User
Server
Authentication Service
Firewall Policy User Group
1. (Optional) Integrate an external LDAP user database:

1a. Define an LDAP Server or Active Directory Server element. See Integrating External
LDAP Databases (page 626). The Active Directory Server element also contains the
settings for IAS authentication; generic LDAP Server elements define a user storage only.
1b. (Optional) Define an LDAP Domain. See Defining LDAP Domains (page 633).
2. (Optional, not applicable to Microsoft AD/IAS) Integrate external authentication servers:
2a. Define an Authentication Server element for each external authentication server. See
Defining an Authentication Server (page 635).
2b. Define a new Authentication Service for each authentication method (may include
several authentication servers). See Defining an Authentication Service (page 637).
3. Define the User Group and User information:
3a. To import existing user information from some other Management Server, see
Importing and Exporting User Information (page 644).
3b. To create new accounts or modify accounts stored in an external LDAP database, see
Defining User Accounts for Authentication (page 637).
4. Add an authentication requirement to the relevant IPv4 Access rules. See Defining
Authentication Rules (page 642).
4a. Add specific Users or User Groups to the rule.
4b. Define which Authentication Services the rule accepts (out of Authentication Services
that are defined for the included users).
5. (Optional) Install the VPN client software on the users’ computers. See the VPN Client
Administrator’s Guide.
6. (Optional) Customize the authentication prompt users see when they authenticate using a
Telnet client. See Customizing the User Authentication Dialog (page 648).
Related Tasks
 Authenticating to a StoneGate Firewall (page 647).
Getting Started with User Authentication 625

Integrating External LDAP Databases
Prerequisites: None
You can use an external LDAP database to store user group and user information instead of or
in addition to the internal user database. Additionally, an external LDAP server can be used to
perform simple password authentication for externally stored user accounts.
The Management Server and the firewall engines both have an integrated LDAP client that can
query the external user directory. To take full advantage of user authentication features, you
should configure access to the LDAP database for both the Management Server and the firewall.
Configuring access to the external LDAP directory for both the firewall and the Management
Server allows the following:
• There is no need to manually duplicate user account information. User and User Group
elements are automatically added to the SMC from the LDAP database.
• Externally stored user accounts are shown in the Management Client and can be used to
create different rules for different users.
• In most cases, users can be also added, removed, and modified through the Management
Client.
• Internal authentication methods can be used to authenticate externally stored users.
Configuring external LDAP access for the firewall engines only without configuring access for the
Management Server allows the following:
• You can authenticate externally stored users against an external authentication service. In
this case, internal authentication methods are not available for externally stored users.
• A single element (User element named *external*) is used to represent all externally stored
users in the firewall’s policy, so it is not possible to create different rules for different
externally stored users.
You can view user information and use it for authentication against an external authentication
service just by allowing the StoneGate components to connect to the LDAP database. To be able
to authenticate users with an LDAP password or to be able to modify information in the LDAP
directory through the Management Client, you must add parameters for StoneGate on the LDAP
server by configuring schema files.
What’s Next?
 To use all LDAP-related features, proceed to Configuring Schema Files on External LDAP
Servers (page 627).
 To configure view-only access to the user information and/or use the LDAP database
with some external authentication service only, proceed to Defining a Generic LDAP
Server Element (page 629).

Configuring Schema Files on External LDAP Servers
The schema file defines the attributes (individual pieces of data) that an account can contain.
Extending the external server’s schema with StoneGate-specific attributes is optional if you are
using a Microsoft Active Directory Server; you can view the information without doing this, but
extending the schema allows you to also add StoneGate-specific information to Users and User
Groups through the Management Client. With other types of LDAP servers, you must always
extend the schema if you want to integrate the database with the Management Server.
This task varies depending on which LDAP server you are using and is done outside the
Management Client. In general, the schema update means that you to add the StoneGate-
specific attributes to the existing user information on the external LDAP server. These include
attributes for the StoneGate-specific user name, password, and allowed authentication services
for the user. These are documented in more detail in Schema Updates for External LDAP
Servers (page 973).
What’s Next?
 If your external user database is strored on a Microsoft Active Directory Server, continue
by Defining an Active Directory Server Element (page 627).
 For other types of LDAP servers, see Defining an Active Directory Server Element
(page 627) or Defining a Generic LDAP Server Element (page 629).
Defining an Active Directory Server Element

The Active Directory Server element contains both the user directory and authentication service
options needed to use a Microsoft Active Directory server to store and authenticate users.
 To define an Active Directory server element

view opens.
2. Browse to Other ElementsUser Authentication in the tree view.
3. Right-click LDAP Servers and select NewActive Directory Server from the menu. The
Active Directory Server Properties dialog opens.
4. Specify a unique Name and IP Address for the server. Only IPv4 addresses are supported.
5. A Location and Contact Addresses are needed if there is a NAT device between a firewall
and the Active Directory server, so that the firewall cannot connect directly to the IP
address defined for the Active Directory server in the previous step. For more information,
see Defining Locations (page 61) and Defining Contact IP Addresses (page 62).
6. Define the Timeout for how long StoneGate components wait for the server to reply. The
default is 10 seconds.
What’s Next?
 Continue by configuring the LDAP settings as instructed in Configuring the Active
Directory Server’s LDAP Settings.
Related Tasks
Integrating External LDAP Databases 627

Configuring the Active Directory Server’s LDAP Settings
The Active Directory Server element’s LDAP settings include an account that StoneGate uses to
connect to the Active Directory server. The Management Server and the firewall engines query
the Active Directory based on this user account, which must exist in the Active Directory. Make
sure the account you use has the privileges to manage other user accounts.
There are also values for some attributes that StoneGate looks for in the Active directory which
you may need to change or fill in according to the Active Directory’s configuration.
We recommend that you do not use special characters or accented letters in Distinguished
Names or user IDs. Currently, Active Directory has a limit of 24 characters for a UID (user ID)
and 64 characters for the OU (organizational unit).
 To configure LDAP user services

1. Switch to the LDAP tab of the Active Directory Server Properties dialog.
2. In Base DN, enter the domain under which the authenticating users’ accounts are stored.
Currently, Active Directory has a limit of 160 characters for this field.
Example ou=ExampleInc,dc=example,dc=com
3. In the Bind User ID field, define the Distinguished Name of the User ID that the firewalls
and Management Servers use to connect to the Active Directory server.
Example cn=StoneGate,ou=Administrators,dc=example,dc=com
4. In Bind Password, enter the password for the user account you defined in the previous
step. Deselect Hide if you want to view the password in this dialog.
5. Select the correct option for Schema according to whether you have decided to update the
Active Directory server’s schema file with StoneGate-specific attributes (see Configuring
Schema Files on External LDAP Servers (page 627)):
• Standard: select this option if you have not updated the schema.
• Updated with sg Object Classes: select this option if you have updated the schema.
6. If the UserId Attribute and Group Member Attribute have been changed in your Active
Directory server’s schema to use non-default attributes, enter the custom attribute names.
7. If the users are identified by their e-mail address in certificate authentication, enter the
name of the Active Directory attribute for the users’ e-mail address in the Email Attribute
field. The default Active Directory name for this attribute is mail.
8. (Optional) Define the LDAP on Port number if you want to override the default port (TCP
port 389).
Note – The Default firewall template allows the engines to connect to the default port. If
you change to a custom port, you must add a new Access Rule to allow the traffic.
9. (Recommended, requires Firewall version 5.1 or higher) Select LDAP StartTLS to enable
Transport Layer Security (TLS) for connections to the server.
What’s Next?
 Continue by Configuring Active Directory Server’s Authentication Settings (page 629).

Related Tasks
 For more information on configuring AD, consult Microsoft’s documentation at
http://technet.microsoft.com/.
Configuring Active Directory Server’s Authentication Settings

The firewalls can use the Internet Authentication Service (IAS) in previous Windows Server
versions or the Network Policy Server (NPS) in Windows Server 2008 to authenticate end-users.
Active Directory authentication uses the RADIUS protocol. The IAS/NPS is configured as a
RADIUS server, and you must define each firewall engine that users contact for authentication
as a separate RADIUS client for IAS/NPS (use the NDI addresses on a cluster). StoneGate does
not support the Message-Authenticator attribute option available in the IAS/NPS and is not NAP-
capable (option available in NPS). Only PAP authentication is supported.
To be able to work in this role, the IAS/NPS must have access to user information in the Active
Directory. The user accounts must have remote access permissions. Set up the IAS/NPS as
explained in the Microsoft Server documentation (see the Related Tasks below for links).
 To configure the authentication settings

1. In the Active Directory Server properties dialog, switch to the Authentication tab.
2. Make sure that the Port Number is correct for your Windows server’s IAS/NPS.
3. Enter the Shared Secret that you have defined for the StoneGate RADIUS clients on the
Windows server. Deselect Hide if you want to view the password in this dialog.
4. Specify the Number of Retries. If a StoneGate component’s attempt to connect to the
authentication server fails, it tries to connect again the specified number of times before
giving up on the authentication.
5. Click OK.
What’s Next?
 Continue by Defining LDAP Domains (page 633).
Related Tasks
 For more information on configuring IAS, consult Microsoft’s documentation at
http://technet.microsoft.com/en-us/library/cc783725%28WS.10%29.aspx.
 For more information on configuring NPS, consult Microsoft’s documentation at
http://technet.microsoft.com/en-us/library/cc753394%28WS.10%29.aspx.
Defining a Generic LDAP Server Element

The LDAP Server element can be used to configure access to any LDAP server as a user
database for the firewalls and/or the Management Server. Microsoft Active Directory servers
have their own element that combines both the user directory and authentication features. See
Defining an Active Directory Server Element (page 627).
 To define an LDAP Server element

view opens.

3. Right-click LDAP Servers and select NewLDAP Server from the menu. The LDAP Server
Illustration 44.2 LDAP Server Properties - General Tab
4. Enter a unique Name and IP Address for the server. Only IPv4 addresses are supported.
5. A Location and Contact Address are needed if NAT is applied between a firewall or
Management Server and the IAS/NPS, so that the firewall and Management Server cannot
connect directly to the IP address defined for the interface. For more information, see
Defining Locations (page 61) and Defining Contact IP Addresses (page 62).
6. (Optional) Define the LDAP on Port number if you want to override the default port (TCP
port 389).
7. (Recommended, requires Firewall version 5.1 or higher) Select LDAP StartTLS to enable
Transport Layer Security (TLS) for connections to the LDAP server.
8. Use the Timeout field to define for how long StoneGate components wait for the server to
reply. The default is 10 seconds.
9. (Optional) Switch to the Secondary IP addresses tab and add one or more secondary IP
addresses for the server. These are included when used in rules in policies, but StoneGate
components never use the addresses when initiating contact with the server.
What’s Next?
 Continue by Configuring the LDAP Server’s User Services.

Configuring the LDAP Server’s User Services
Make sure you do not enter values that exceed the length allowed for the corresponding values
on the LDAP server (check the documentation of your LDAP server). We recommend that you do
not use special characters and accented letters in Distinguished Names or user IDs. Attributes
are entered as defined in the LDAP Server’s schema file.
 To Configure LDAP User Services

1. Switch to the User Services tab of the LDAP Server Properties dialog:
Illustration 44.3 LDAP Server User Services
2. In Base DN, enter the LDAP tree under which the authenticating users’ accounts are
stored.
Example (DNS-based tree)
dc=example,dc=com
Example (“O-based” tree used, for example, in Novell eDirectory)
ou=astronauts,o=goverment,st=Florida,c=US
3. In the Bind User ID field, define the Distinguished Name of the User ID that the firewalls
and Management Servers use to connect to the LDAP server.
Example (DNS-based tree)
uid=StoneGate,ou=Administrators,dc=example,dc=com
Example (“O-based” tree used, for example, in Novell eDirectory)
uid=StoneGate,ou=Administrators,ou=astronauts,o=goverment,st=Florida,c=US
4. In Bind Password, enter the password for the user account you defined in the previous
step. Deselect Hide if you want to view the password in this dialog.
5. If necessary, change the name that the server uses for the UserID Attribute. By default,
the attribute is set to cn (common name).
6. If necessary, change the name that the server uses for the Group Member Attribute. By
default, the attribute is set to member.
7. If the users are identified by their e-mail address in certificate authentication, enter the
name of the attribute for storing the users’ e-mail address in the Email Attribute field.

8. If necessary, change the Authentication Attribute (for storing the authentication service
information). By default, the attribute is set to sgauth (part of StoneGate-specific schema,
see Configuring Schema Files on External LDAP Servers (page 627)).
What’s Next?
 If you do not want to add object classes, click OK and you are done.
 Otherwise, continue in Adding Object Classes for the LDAP Server.
Adding Object Classes for the LDAP Server

If your LDAP server has object classes (for users or groups) that are not defined in StoneGate by
default, you must add those object classes to the list in StoneGate. This way, the existing
classes on the LDAP server can also be used for authentication.
 To add a UserObjectClass or GroupObjectClass

1. Switch to the User ObjectClass or Group ObjectClass tab.
Illustration 44.4 LDAP Server UserObjectClass
2. Enter the name of the object class and click Add. The object class appears in the list.
3. Repeat the previous steps to add more object classes.
4. Click OK.
What’s Next?
 To integrate the Management Server with the LDAP server, continue by Defining LDAP
Domains (page 633).
 If you want to skip Management Server integration, continue by Integrating External
Authentication Services (page 634) or (if you already have the external authentication
configured) by Defining User Accounts for Authentication (page 637).

Defining LDAP Domains
Each LDAP server has its own LDAP domain in StoneGate. One LDAP domain can be selected as
the default LDAP domain, so that users can leave out this information when they authenticate
(can type “username” instead of “username@domain”). Users that are stored under non-
default LDAP domains must always include the domain in the username.
If administrative Domains have been configured, you can create separate LDAP Domains for
each administrative Domain and select one LDAP Domain in each administrative Domain as the
Default. Alternatively, you can select one of the LDAP Domains in the Shared Domain as the
Default LDAP Domain across all the administrative Domains.
 To define a new LDAP Domain

view opens.
2. Browse to Other ElementsUser AuthenticationUsers in the tree view.
3. Right-click Users and select New LDAP Domain from the menu. The LDAP Domain
Illustration 44.5 LDAP Domain Properties
4. Enter the Name for the new LDAP Domain.

• If the LDAP Domain you are creating is not to be the default LDAP Domain, users must
type in the domain name when they authenticate.
5. Select Default LDAP Domain if this LDAP Domain will be used for all or most
authentications.
• Only one LDAP Domain can be the default LDAP Domain, so the selection is automatically
cleared from the previous default LDAP Domain.
6. The defined LDAP Servers that have no LDAP Domain yet are shown on the left. Select the
correct server and click Add to bind the LDAP Server to the LDAP Domain.

7. (Optional) Switch to the Default Authentication tab and click Select to define the allowed
Authentication Services for all accounts in this LDAP Domain.
• You can override the default setting by selecting different Authentication Service(s) in
the User Group or User properties.
• We recommend that you set a default authentication method. If the Authentication
Service you are planning to use is not defined yet, you can return to this dialog to
complete the information after your custom Authentication Service is created.
8. Click OK.
You have now completed all of the steps required for setting up your external LDAP server in
StoneGate.
What’s Next?
 If you plan to use an external authentication service (Active Directory Server or some
other RADIUS or TACACS+ capable server) proceed to Integrating External
Authentication Services (page 634).
 If you plan to use StoneGate’s internal authentication services, continue the
configuration by Defining User Accounts for Authentication (page 637).
Integrating External Authentication Services

Prerequisites: None
External authentication servers are integrated with the help of Authentication Server and
Authentication Service elements. The Authentication Server elements define the settings
necessary for connecting to an external authentication server. The Authentication Service
elements define an authentication method, and can include several Authentication Servers that
support the method and can be used as backups to each other.
What’s Next?
 If you are using a previously defined Active Directory Server with IAS settings and user
accounts correctly configured, continue by Defining Authentication Rules (page 642).
 If you want to configure a new Active Directory Server element or reconfigure an existing
element’s IAS settings, continue by Defining an Active Directory Server Element
(page 627).
 Otherwise, start by Defining an Authentication Server (page 635).

Defining an Authentication Server
You can authenticate end-user access through firewalls and administrator’s logins to the SMC
against external authentication servers that support either the RADIUS or the TACACS+
protocol. These are generic communications protocols for user authentication, so the actual
authentication methods that the servers provide are mostly irrelevant.
You can use many different types of authentication services through the RADIUS and TACACS+
authentication protocols, for example, RSA SecurID authentication (see the Related Tasks for
more information).
If you use a Windows Server’s IAS/NPS service for authentication, see Defining an Active
Directory Server Element (page 627) instead of the steps below.
 To define an Authentication Server element

view opens.
3. Right-click Authentication Servers and select NewRADIUS Authentication Server or
NewTACACS+ Authentication Server. The Authentication Server Properties dialog
opens.
Illustration 44.6 RADIUS and TACACS+ Authentication Server Properties
4. Specify a unique Name and the IP Address for the server in the fields provided. Only IPv4
addresses are supported.
5. A Location and Contact Address are needed if there is a NAT device between a firewall and
the authentication server (used for authentication), so that the firewall cannot connect
Integrating External Authentication Services 635

directly to the IP address defined for the interface. For more information, see Defining
Locations (page 61) and Defining Contact IP Addresses (page 62).
6. The Port Number field has default ports predefined. If the server uses a different port,
enter it here.
7. Enter the secret key (for communication with the authentication server) in the Shared
Secret field. Deselect Hide if you want to view the password in this dialog.
8. Use the Number of Retries field to define the number of times firewalls try to connect to
the server in case connecting fails.
9. Define the Timeout for how long firewalls wait for the server’s reply. The default is 15
seconds.
10.(TACACS+ servers, optional) Select the Clear Text Replies option to make the firewall
accept replies that are not encrypted from the authentication server.
11.(Optional) Switch to the Secondary IP Addresses tab and define additional IP addresses.
These are used in rules and routing, but firewalls always use only the main IP address when
they contact the authentication server. Only IPv4 addresses are supported.
12.Click OK.
13.Configure the external authentication server to accept connections from your StoneGate
firewall engines:
• Take special care to ensure that the shared secret is entered identically in StoneGate and
on the external server.
• The identity that the firewall announces to the server is equal to the IP address of the
interface that has been selected as the value for the Identity for Authentication
Requests option in the properties of the Firewall element’s Interface Options.
Note – The IP address used as the identity is a “name” only. The interface and IP address
used for the authentication-related connections is selected based on the firewall’s routing
information just like for any other connection.
The connections to the authentication server are allowed in the Default firewall policy template.
Make sure your IPv4 Access and NAT rules are configured correctly for these connections.
What’s Next?
 To use the Authentication Server for User Authentication, continue by Defining an
Authentication Service (page 637).
 If you want to use the server for authenticating administrators’ Management Client
logins, see Authenticating Administrators Using RADIUS (page 226).
Related Tasks
 Setting up User Authentication (page 623)
 For information on integrating StoneGate with RSA SecurID authentication, see
http://www.rsa.com/rsasecured/product.aspx?id=1850.

Defining an Authentication Service
An Authentication Service represents an authentication method. Each Authentication Service
element includes one or more Authentication Server elements. If several servers are included,
firewall engines can try a different server if a server does not reply. Alternative servers are used
only if a server does not respond: firewalls do not try alternative servers when the
authentication server reports that the authentication has failed.
The internal authentication methods and IAS authentication have default Authentication
Services that are already available in the system. Use the default element if you are configuring
an authentication method that has a default Authentication Service.
 To define a new authentication service

view opens.
2. Browse to Other ElementsUser AuthenticationAuthentication Services in the tree
view.
3. Right-click Authentication Services and select New Authentication Service from the
menu. The Authentication Service dialog opens.
4. Enter the Name of the new Authentication Service.
5. Select the authentication service Type using the radio buttons. The Internal service type is
not available; the available internal services are all predefined.
6. Click Add to select an Authentication Server for this Authentication Service. You can add
several servers of the same type.
Note – If you select more than one Authentication Server, all selected servers must provide
an identical service (the exact same credentials must be valid on all included servers).
What’s Next?
 Assign the new Authentication Service to users (required even if the user information is
not available to StoneGate). See Defining User Accounts for Authentication.
Defining User Accounts for Authentication

Prerequisites: See Configuration Overview for more information
The User Group and User elements define the user account information for end-users. They can
be inserted in IPv4 Access rules to add a requirement for authentication as a condition of
matching rules to the end-users’ connections.
Options for Adding User Accounts
If you are using the Management Server’s internal user database:
• If you have existing user accounts stored in another StoneGate user database, you can
export/import the information between the databases (see Importing and Exporting User
Information (page 644)).
• Otherwise, create the User Groups and Users individually.
If you are using an external user database:
Defining User Accounts for Authentication 637

• If the LDAP database is integrated with the Management Server, you can see the user
information in the Management Client. However, for the accounts to be valid in Access rules,
you must configure at least one Authentication Service as allowed for the users. This can be
done as a default setting for the LDAP Domain (see Defining LDAP Domains (page 633)) and/
or (if the configuration allows account modifications) for the User Groups and Users.
• If the LDAP database is not integrated with the Management Server, the user accounts are
not shown in the Management Client and are not available for configuration. To be able to add
an authentication requirement to rules, you must create a special User element to represent
all externally authenticated users. This User must be named *external* and must be a part
of some User Group (such as the default “stonegate” group), as you cannot use the
*external* User directly in IPv4 Access rules. You must also define the correct external
authentication method(s) for the *external* User.
What’s Next?
 If you want to create User Groups for organizing the individual users, see Defining User
Groups.
 If you do not need new User Groups or your user database is not integrated with
StoneGate, you can proceed directly to Defining Users (page 640).
Defining User Groups

If you have many users, you may want to organize your users into several different User Groups.
You may organize the groups, for example, according to different services. A single user can
belong to several groups at the same time.
You must have at least one User Group.
 To create a User Group

view opens.
3. Expand the branch of the LDAP Domain that represents the correct user database. The
internal database is represented by the default LDAP Domain InternalDomain.
Illustration 44.7 Defining a New User Group
4. Right-click the parent group below the LDAP Domain (this is called “stonegate” for the
internal database) and choose NewUser Group from the menu. The User Group

Illustration 44.8 User Group Properties - General Tab
5. Type a Name and an optional Comment for the User Group.

• The name is used as the common name (CN) for the group.
• The distinguished name (DN) is inherited from the LDAP Domain to which this User Group
belongs.
6. (Optional) Enter a number of days after which the User Group expires in the Expiration
After field. When the User Group expires, it stays in the system but is invalid and does not
allow authentication until it is re-enabled.
7. Switch to the Authentication tab.
Illustration 44.9 User Group Properties - Authentication Tab
8. Click Add to select the one or more Authentication Services in the Select Element dialog
that opens.
• If you select several Authentication Services for the User Group, you can further restrict
the Authentication Services allowed in the User element properties and in each Access
rule that requires authentication.
9. Click OK.
What’s Next?
 Continue by Defining Users (page 640).

Defining Users
The User element is a way to tell StoneGate who your users are and how they can identify
themselves to get access to certain networks and services as defined in your IPv4 Access rules.
When using the internal user database, you can create the users one by one or import users
from an .ldif file to transfer the user information from another StoneGate internal user database
(see Importing Users from an LDIF File (page 644)).
If you utilize an external user database that is not integrated with StoneGate, create a User
called *external* in some User Group and use the User Group in rules to represent all users.
You must also define the correct authentication method for the *external* User.
 To define a new User

view opens.
3. Right-click a User Group (to add the user to that group) or an LDAP Domain (to create a User
that is not in any User Group) and select NewUser or NewUser. The User Properties
dialog opens.
Note – Although you cannot edit User Group memberships in the User element properties,
the user can belong to several User Groups. After creating the User element, drag and drop
it to other User Groups to add more group memberships.
Illustration 44.10 User Properties - General Tab
4. Enter a unique Name and an optional Comment for the User.

• The name is used as the common name (CN) for the group.
• The distinguished name (DN) is inherited from the LDAP Domain to which the User
belongs.
5. (Optional) In the Activation options, deselect Always Active to define when the account is
activated and/or when it expires:
5a. (Optional) Select the Activation Date.

5b. (Optional) Define when the account becomes inactive in one of the following ways:
• Select Inherit Expiration Period to use the setting defined for the User Group.
• Select Expiration After to define the number of days the account is valid starting
from the Activation Date.
• Select Expiration Date to define a specific date.
Illustration 44.11 User Properties - Authentication Tab
7. Click Add to select the Authentication Services for the user.

• You can add more than one authentication method for each user. This way, you can put
the User in more than one User Group when the User Groups have different
authentication methods.
8. Define the properties for the selected Authentication Service:
• If you selected an external authentication service for the user, there are no options to
configure.
• To use IPsec Certificate authentication, fill in the Alternative Subject Name or CN field
(for example, “fred.stone@stonesoft.com” or 192.168.42.103). The value you enter here
must match the value entered in the corresponding field of the certificate request.
• To use User Password authentication, type in and confirm the user’s password in the
appropriate fields.
Caution – Use strong passwords that are at least eight characters long and that contain
numbers, letters, and special characters. Do not base passwords on personal information
such as names, birthdays, ID numbers, phone numbers, street names, registration plate
numbers, relatives’ names, not even if spelled backwards or partially.
• To use Pre-Shared Key Method authentication with third-party VPN clients, type in and
confirm the pre-shared key.
9. Click OK.

The new user account is created. If the user is stored in the internal LDAP database, the
information is automatically synchronized to the local databases on the firewalls without further
action, unless user database replication has been disabled in your system.
What’s Next?
 Insert User Groups or individual User elements in IPv4 Access rules to enforce user
authentication. See Defining Authentication Rules (page 642).
Related Tasks
 Integrating External Authentication Services (page 634)
Defining Authentication Rules

Prerequisites: Defining User Accounts for Authentication or Defining an Active Directory Server Element
User authentication involves two types of connections: the connection that users make to
authenticate and the subsequent connections that users launch to access services. In Firewall
IPv4 Access rules, the Users cell and the Authentication cell are used as matching criteria for
accessing a particular service and for setting options for the authentication. Connections from
users that have not successfully authenticated or whose authentication has expired do not
match the rules with an authentication requirement (the connection matching continues to rules
further down in the policy). The authentication part in a rule is configured in the same way
regardless of whether VPN encryption is involved.
Caution – Only a VPN ensures confidential information exchange. An authentication

requirement without a VPN does not significantly increase the security of external-to-
internal access.
For information on how to create VPN Client rules, see Creating Basic Rules for VPN Client
Connections (page 750).
 To define an authentication rule

1. Open the Firewall Policy for editing.
2. Add an IPv4 Access rule and define the Source, Destination and Service as usual.
3. Right-click the Action cell and set it to Allow (or Use VPN if you want to direct connections
into a VPN).
4. Click the User cell to display the correct elements in the tree view and drag and drop User
or a User Group elements into the cell.
• If you are authenticating users that are not known to StoneGate, add the User Group you
created (the User Group that contains the User *external*).

5. Click the Authentication cell and drag and drop an Authentication Service from the tree
view into the cell, or right-click and select Set to ANY to allow any authentication method
defined in the system.
• There are default elements for the internal authentication methods and IAS. Other
authentication methods are represented by custom Authentication Service elements.
Note – If you allow more than one Authentication Service for any one user, the credentials
supplied by the user must be identical in all cases.
• Even when the Authentication cell is set to ANY, only the Authentication Services allowed
for the Users included in the rule are valid (as defined in the LDAP Domain, User Group,
and/or the individual User element).
6. Double-click the Authentication cell. The Authentication Parameters dialog opens.
Illustration 44.12 Authentication Parameters
7. Select the authentication Methods:

• Require Authentication: The users are required to authenticate themselves. The request
is sent to the appropriate authentication service and evaluated.
• Firewall-initiated Authentication: The firewall establishes a connection to the remote
system, and the client software then prompts the user for their ID and password. The
request is sent to the appropriate authentication service and evaluated. This method
requires that the VPN client software is installed on the remote system.
8. Select one of the authorization types:
• Connection authorization is granted for a single connection. Each connection requires
that the users type in their credentials again. This option is useful for granting restricted
access to a particular service that does not open many separate connections.
• Client IP authorization permits connections from the client’s IP address for as long as
indicated in the Timeout setting in seconds. The default Timeout is 3600 seconds. This
option is better if you want to grant access to several services or a service that opens
many connections during a single session.
9. Click OK to close the authentication Parameters dialog. The rule is now finished.
Defining Authentication Rules 643

This concludes the User Authentication configuration. Install the policy to transfer the changes
to the firewall.
What’s Next?
 See Authenticating to a StoneGate Firewall (page 647) for an explanation on what the
users need to do to authenticate in non-VPN authentication.
 See Customizing the User Authentication Dialog (page 648) if you want to change the
text that the users see when they authenticate themselves using Telnet.
Managing User Information

Prerequisites: None
Adding/Removing Users From User Groups

 To add Users to new User Groups
 Drag and drop the User element on a User Group in the element tree. The User remains
a member of the current User Group and becomes a member of the new group.
 To remove Users from User Groups

1. Browse into the User Group from which you want to remove the User.
2. Right-click the User element and select ToolsRemove. A confirmation message is shown.
3. Click Yes to remove the user from the User Group.
Importing and Exporting User Information

Import and export operations allow you to transfer user and user group information from one
StoneGate internal LDAP user database to another StoneGate internal LDAP user database. The
internal LDAP user database is represented by the default LDAP Domain InternalDomain.
Importing Users from an LDIF File

To be able to import user information successfully, the information must meet two conditions:
• The distinguished name (DN) must always be of type
dn: cn=cn-of-the-user-or-group,dc=stonegate.
• All user groups must be directly attached below the dc=stonegate top-level group.
The import feature is meant for importing users exported from another StoneGate internal LDAP
database. The import is not meant to work with other LDIF files.
 To import users from an LDIF file

1. Select FileImportImport Users from the menu. The Import File Browser dialog opens.
2. Select the correct file and click Import. A new tab opens showing the progress of the
import.
3. When the import is finished, check the messages for any warnings before you close the
tab.
• If warnings were displayed, select ConfigurationConfigurationFirewall to open the
Firewall Configuration view and browse to Other ElementsUser

AuthenticationUsersInternalDomain to check the properties for those Users/User
Groups.
Related Tasks
 Importing Elements (page 76)
Exporting Users to an LDIF File

You can export the user information stored in one StoneGate internal user database into an .ldif
file to transfer it to another StoneGate internal user database.
 To export users to an LDIF file

view opens.
2. Browse to
Other ElementsUser AuthenticationUsersInternalDomain.
Illustration 44.13 Exporting Users from the Internal User Directory
3. Right-click the correct user group under InternalDomain and select ToolsExport
StoneGate Users from the menu.The Export File Browser dialog opens.
4. Select the correct location, type in the filename, and click Export. A new tab opens showing
the progress of the export.
5. When the export is finished, check the messages for any warnings before you close the tab.
Related Tasks
 Exporting Elements (page 75)
Managing User Information 645

Changing Users’ Passwords
If you use LDAP password authentication, you can reset and change a user’s password as
necessary through the Management Client.
 To change a user’s password

view opens.
2. Browse to Other ElementsUser AuthenticationUsers and then to the correct LDAP
Domain and User Group.
3. Right-click the User element and select ToolsChange Password. The Change Password
dialog opens.
4. Type in the new password in both fields and click OK. The new password becomes valid
immediately.
Clearing Users’ Authentication Settings

You can quickly remove all the authentication settings of a user without deleting the user from
the system. This is useful, for example, when a user’s account is known to have been
compromised and access rights need to be revoked very quickly.
 To clear a user’s authentication attributes

view opens.
2. Browse to Other ElementsUser AuthenticationUsers and then to the correct LDAP
Domain and User Group.
3. Right-click the User element and select ToolsClear Authentication Attributes.
4. Click Yes in the Confirmation message.
Resetting the Firewalls’ Local User Database

If you use StoneGate’s internal user database, the user information is stored centrally on the
Management Server. When changes are made, they are incrementally replicated to each firewall
node to ensure fault-tolerant authentication if user database replication is on for the Firewall
(see Setting User Database Replication to Firewalls on or off (page 647)). If necessary, you can
perform a full synchronization manually as instructed below.
 To reset a firewall engine’s local user database

1. Right-click a single firewall or individual node(s) of a firewall cluster and select
CommandsReset User Database.
2. Click Yes in the Confirmation message. The engine’s local copy of the user database is
replaced by a new copy of the main LDAP database on the Management Server.

Setting User Database Replication to Firewalls on or off
By default, StoneGate’s internal user database (for end-user authentication) is replicated
automatically to the firewall engines, so that the engines can perform the authentication without
a connection to the Management Server. If you have some special need to do so, you may turn
off the replication as explained below.
Caution – If you want to prevent users from authenticating, follow the instructions in
Clearing Users’ Authentication Settings (page 646) instead of turning off the replication.
Turning off the replication prevents any new users you add after the operation from
authenticating, but may not prevent existing users from doing so.
 To set user database replication on or off for a firewall

 Right-click a single firewall or firewall cluster and select/deselect OptionsUser DB
Replication.
Authenticating to a StoneGate Firewall

Prerequisites: Defining User Accounts for Authentication, Defining Authentication Rules
Users can authenticate either using the StoneGate IPsec VPN client or by connecting to the
StoneGate gateway using a standard Telnet client. If the users are authenticating for VPN
access, they must authenticate using the IPsec VPN client; the Telnet option is not valid for that
case. See the StoneGate IPsec VPN Client User’s Guide for information on how to authenticate
using the StoneGate IPsec VPN client.
Caution – When using Telnet, the username and password are transported as cleartext,
readable to anyone who can intercept the transmission. Use a one-time password scheme
to reduce the risk of unauthorized access.
The message shown to users connecting with a Telnet client can be customized, see
Customizing the User Authentication Dialog (page 648).
 To authenticate using Telnet

1. Connect to the StoneGate gateway using a Telnet client on port 2543 (TCP). An
authentication dialog opens requesting a Login.
• This procedure depends on your configuration, but in most environments, you can simply
type on the command line (or launch a script that contains):
telnet <firewall’s IP address> 2543
2. Type in the User name when Login is prompted. If only the User name is entered, the
default LDAP Domain is assumed. If this User does not belong to the default LDAP Domain,
add also the LDAP Domain to the User name with an @-character as a separator.
• For example, type “fred@mobileusers” for user “fred” in the LDAP Domain
“mobileusers”.
3. Press Enter to confirm the username (and LDAP Domain). The authentication dialog asks
for a password.
4. Type in the passcode (password, SecurID code, etc.) and press Enter. A message displaying
if access was granted or denied is displayed and the Telnet connection is closed.
Authenticating to a StoneGate Firewall 647

Customizing the User Authentication Dialog
Prerequisites: None
Anyone who is allowed to connect to the firewall with a Telnet client on port 2543 (TCP) is
greeted with an authentication message. If you use a customized top-level template, make sure
that access to this port is allowed from all desired source addresses. Only IPv4 addresses are
supported as source addresses.
Note – The Default firewall template policy allows access from any source to port 2543 on
the firewall. The Access rules that use the authentication requirement as one access
criteria must always also have specific Source and Destination definitions that limit access.
By default, the authentication dialog states “StoneGate firewall <IP address>”. The IP address
shown is the IP address of the interface that has the option Identity for Authentication
Requests set. You can replace the message by creating a simple text file on the firewall node as
explained below. You can also create a single text file and then transfer it (for example, by using
a USB memory stick, SSH etc.) to all firewall nodes that handle user authentication if you have
many such nodes (see the directions below for information on the file contents and location).
 To customize the authentication message

1. Login to the firewall node using SSH or a serial cable.
• SSH access can be enabled and disabled and the password for the user Root can be
changed through each node’s right-click menu under Commands.
2. Create a text file for the message by typing vi /data/config/base/auth-message and
pressing Enter. This launches a text editor.
3. Type a to switch to the editing mode.
4. Type in the message you want to show to your users.
• Only the first line of the text file (excluding the newline) is used as the message.
• There has to be some text on the first line of the file for it to be used.
• The message may contain the format string “%IP”, which is replaced with the IP address
(as in the default message) when shown to users.
5. When you are done, press the Esc key on your keyboard and type ZZ to save the changes
and exit the text editor.
6. Reboot the firewall node to begin using the new message (for instructions, see Rebooting
Nodes (page 191)).
7. Repeat the whole procedure for all nodes in a cluster.
If you delete the auth-message file from /data/config/base/auth-message, the default
banner “StoneGate firewall (%IP)” is used.
See Authenticating to a StoneGate Firewall (page 647) for an explanation on what the users
need to do to authenticate.
Related Tasks
 Changing Default Rules (page 560)

Monitoring and Testing User Authentication
Prerequisites: See Configuration Overview
Successful and failed user authentication attempts as well as StoneGate’s own connections to
external authentication servers can be followed in the logs and you can create reports based on
this data. There is no separate viewer for checking the currently active authenticated users.
If there are problems with integration with external components, you can activate more detailed
diagnostics logging for Authentication. See Enabling/Disabling Firewall/VPN Diagnostics
(page 193).
Monitoring and Testing User Authentication 649

C HAPT ER 45
FILTERING WEB ADDRESSES
Web filtering allows you to filter web access based on categories of content and/or lists of
individual websites. Web filtering is supported on Firewall/VPN engines that are licensed for
deep packet inspection and on IPS sensors. Category-based web filtering is a separately
licensed feature.
Getting Started with Web Filtering (page 652)

Blacklisting/Whitelisting Web URLs Manually (page 653)
Creating Web Filtering Rules (page 654)
651
Getting Started with Web Filtering
Prerequisites: None
What Web Filtering Does

Web filtering prevents users from intentionally or accidentally accessing most websites that
provide content that is objectionable (for example, pornographic or violent imagery), potentially
harmful (for example, various scam sites), or leisure-oriented (for example, entertainment
news). This type of content filtering can increase network security and enforce an organization’s
policy on acceptable use of resources.
Web filtering compares URLs seen in clients’ requests to lists of URLs that you want to match.
The lists of URLs can be defined as manual blacklists and/or as dynamically-populated content
categories provided by a categorization service. Currently, you can use categorizations provided
by the BrightCloud service for category-based filtering. When category-based filtering is active,
you can additionally use the manual URL lists as whitelists of individual addresses that must
not be blocked by category-based filtering. You can check the category BrightCloud has assigned
to a URL at http://www.brightcloud.com/support/lookup.php.
Limitations
• Category-based web filtering (BrightCloud) is a separately licensed feature.
• Web filtering and CIS redirection cannot be done for the same traffic. See Getting Started
with External Content Inspection (page 670) for more information about CIS redirection.
• Category-based web filtering is based on the classifications of the external service, so it is
not possible to manually add or directly edit the web filtering categories. Use the manual
blacklisting/whitelisting feature and the Inspection rules to make your adjustments.
Situations Inspection Rules Firewall
1. (For category-based filtering) Make sure that the engine and the network are set up so that
the engine can fetch the lists of URLs directly from the BrightCloud servers.
• Make sure that DNS server(s) are defined on the Advanced tab in the engine’s
properties. See Getting Started with Advanced Engine Settings (page 416).
• Make sure that the engines have access to the DNS server (UDP port 53, Service
element “DNS (UDP)”), and to the BrightCloud servers (TCP port 2316, Service element
“BrightCloud update”). The Default firewall policy template allows these connections from
the firewall engine on which the policy is installed, but not from other components.
2. (Optional) Create User Responses to notify users about matches that are found. See
Getting Started with User Responses (page 612).
3. (Optional when using category-based filtering) Define lists of individual URLs that you want
to filter. See Blacklisting/Whitelisting Web URLs Manually (page 653).
4. Add Inspection rules. See Creating Web Filtering Rules (page 654).
652 Chapter 45 Filtering Web Addresses

Blacklisting/Whitelisting Web URLs Manually
Prerequisites: To use on a firewall, check that the firewall is licensed for deep inspection
HTTP URL Filtering Situations allow you to define lists of URLs that blacklist (block) access to
the specified URLs. When used in combination with category-based web filtering, these types of
lists can additionally be used to whitelist (allow) individual URLs that are included in an
otherwise blocked category. URL whitelisting only affects URL-based filtering. It does not exclude
the traffic from other inspection checks.
Note – To be able to filter HTTPS URLs, you must decrypt the traffic. See Getting Started
with HTTPS Inspection (page 656).
 To configure Website Access Control

1. Create a new Situation element with the appropriate basic properties (see Creating New
Situation Elements (page 597) for more information). Leave the Situation Type selection
empty if you are creating a whitelist.
2. Switch to the Context tab and select the Context: Application ProtocolsHTTPHTTP
URL Filter.
3. Click the Add button below the entry panel. You can add up to 20 URLs per Situation.
4. Double-click the newly added row and enter the URL without specifying the protocol, for
example, www.example.com.
• Each URL can be a maximum of 64 characters long.
• To block or allow access to a domain, type: example.com
• To block or allow access to an exact URL, type: www.example.com/index.html. Users
can still access other pages such as www.example.com/main.html.
• An asterisk (*) can be used at the beginning of the URL. For example: *.example.com
(matches a request for www.example.com but not the shorter variant example.com).
5. Add Tags as you see necessary to organize this Situation and click OK.
What’s Next?
 Creating Web Filtering Rules (page 654)
Blacklisting/Whitelisting Web URLs Manually 653

Creating Web Filtering Rules
Prerequisites: Category-based web filtering is a separately licensed feature
Firewalls do not deep inspect traffic by default, so make sure there is an Access rule that
matches HTTP traffic and has the Deep Inspection option selected in the Action options.
The actual URL filtering is configured in the Inspection rules. Category-based filtering Situations
are listed in the Rules tree under Web Filtering. The categories are updated through dynamic
update packages.
Add your whitelist in the Exceptions table in a rule that is set to use the Permit action. Your
manual URL lists can be found under SituationsCustom Situations. The whitelist must be in
the Exceptions table to be able to override category-based filtering settings in the Rules tree
(which is the purpose of whitelisting).
Blacklists can be included as an Exception or added to the Rules tree (by selecting a Situation
Type for the Situation).
You may also want to include a User Response in the rule to display warnings or notes in the
users’ browsers when Web Filtering prevents access. See Editing Inspection Rules (page 531)
and Getting Started with User Responses (page 612) for more information.
What’s Next?
 Refresh the policy of the firewall or sensor to activate the configuration.
654 Chapter 45 Filtering Web Addresses

C HAPT ER 46
SETTING UP HTTPS INSPECTION
The HTTPS Inspection feature allows you to decrypt HTTPS connections so that they can be
inspected for malicious traffic. HTTPS Inspection is available on firewalls and sensors.
Getting Started with HTTPS Inspection (page 656)

Configuring Server Protection (page 658)
Configuring Client Protection (page 659)
Defining Trusted Certificate Authorities for HTTPS Inspection (page 662)
Activating HTTPS Inspection on the Engine (page 665)
Excluding Domains from HTTPS Inspection (page 666)
Defining a Custom HTTPS Service (page 667)
Creating Access Rules for HTTPS Inspection (page 668)
655
Getting Started with HTTPS Inspection
Prerequisites: None
What HTTPS Inspection Does

HTTPS is used to secure HTTP connections. However, the encrypted HTTPS connection can also
be used to obscure web-based attacks. The HTTPS Inspection feature decrypts HTTPS traffic so
that it can be inspected in the same way as unencrypted HTTP traffic, and then re-encrypts the
traffic before sending it to its destination.
The HTTPS Inspection feature helps you in the following ways:
• Server protection allows you to inspect incoming HTTPS connections to servers in the
protected network.
• Client protection allows you to inspect outgoing HTTPS connections initiated by users in the
protected network.
You can use client protection alone, server protection alone, or client and server protection
together.
Limitations
HTTPS Inspection has the following notable limitations:
• HTTPS is available on firewalls and sensors starting from version 5.0.
• Sensors must be deployed in inline mode to use HTTPS Inspection. HTTPS Inspection cannot
be done for traffic picked up through Capture interfaces.
• HTTPS inspection cannot be used on redundant single inline sensors deployed alongside a
firewall cluster using dispatch clustering.
• HTTPS inspection and CIS redirection cannot be done for the same traffic. See Getting
Started with External Content Inspection (page 670) for more information about CIS
redirection.
• Default Trusted Certificate Authority elements are automatically added to the system from
dynamic update packages and cannot be edited or deleted.
• Traffic that uses HTTPS may be protected by laws related to the privacy of communications.
Decrypting and inspecting this traffic may be illegal in some jurisdictions.
• Because the HTTPS communications mediated by the engine are decrypted for inspection,
and because the private keys of the servers are stored unencrypted in the Server Protection
Credentials elements on the Management Server and on the engine, you must carefully
consider security precautions when using HTTPS Inspection. The following recommendations
are general guidelines for ensuring the security of the engine and the Management Center:
• Run the Management Server on a hardened operating system.
• Disable SSH access to the engine’s command line if it is not needed regularly.
• Ensure that the engine’s Control interface is in a controlled network.
• Save Management Server backups as encrypted files.
656 Chapter 46 Setting up HTTPS Inspection

HTTPS Service Server Protection
Credentials
HTTPS Inspection Client Protection

Exceptions Certificate Authority
Access Rules
1. If you want to configure server protection, create Server Protection Credentials elements.
See Configuring Server Protection (page 658).
2. If you want to configure client protection, create Client Protection Certificate Authority
elements. See Configuring Client Protection (page 659).
3. (Optional) Define custom Trusted Certificate Authority elements in addition to the default
system elements. See Defining Trusted Certificate Authorities for HTTPS Inspection
(page 662).
4. Activate client protection and/or server protection in the properties of the firewall or
sensor. See Activating HTTPS Inspection on the Engine (page 665).
5. (Optional) Define an HTTPS Inspection Exceptions element to exclude certain domains
from decryption and inspection. See Excluding Domains from HTTPS Inspection
(page 666).
6. Create a custom HTTPS Service that enables HTTPS inspection. See Defining a Custom
HTTPS Service (page 667).
7. Create Access rules to select traffic for HTTPS inspection. See Creating Access Rules for
HTTPS Inspection (page 668).
What’s Next?
 If you want to configure server protection, proceed to Configuring Server Protection
(page 658).
 Otherwise, proceed to Configuring Client Protection (page 659).
Getting Started with HTTPS Inspection 657

Configuring Server Protection
Prerequisites: None
The Server Protection Credentials element stores the private key and certificate of an internal
HTTPS server. The private key and certificate allow the firewall or sensor to decrypt HTTPS traffic
for which the internal server is the destination so that it can be inspected. The certificate and
the associated private key must be compatible with OpenSSL and be in PEM format. Make sure
that the server’s private key and certificate are accessible from the computer where you use the
Management Client.
 To define a Server Protection Credentials element

1. Select ConfigurationConfigurationFirewall or Configuration ConfigurationIPS
2. Browse to Other ElementsFirewall Properties or Other ElementsIPS Properties.
3. Right-click Server Protection Credentials and select New Server Protection Credentials.
The Server Protection Credentials Properties dialog opens.
Illustration 46.2 Server Protection Credentials Properties

5. Click the Import button for the Private Key field and browse to the server’s private key.
• If the private key is encrypted, you are prompted to enter the password.
6. Click the Import button for the Certificate field and browse to the server’s certificate.
7. Click OK.
What’s Next?
 If you want to inspect connections between internal clients and external HTTPS servers,
proceed to Configuring Client Protection (page 659).
 Otherwise, proceed to Activating HTTPS Inspection on the Engine (page 665).

Configuring Client Protection
Prerequisites: None
When an internal client makes a connection to an external HTTPS server, the engine generates
a substitute certificate that allows it to establish a secure connection with the internal client.
The engine adds a Netscape Certificate Comment to the Extensions in the substitute certificate
to indicate that the certificate is a dynamically created certificate for StoneGate SSL/TLS deep
inspection. The Client Protection Certificate Authority element contains the credentials the
engine uses to sign the substitute certificate it generates. If the engine does not use a signing
certificate that is already trusted by users’ web browsers when it signs the substitute
certificates it generates, users receive warnings about invalid certificates. To avoid these
warnings, you must either import a signing certificate that is already trusted, or configure users’
web browsers to trust the engine’s signing certificate.
Note – Traffic that uses HTTPS may be protected by laws related to the privacy of
communications. Decrypting and inspecting this traffic may be illegal in some jurisdictions.
Creating Client Protection Certificate Authority Elements

 To create a Client Protection Certificate Authority element
3. Right-click Client Protection Certificate Authorities and select New Client Protection
Certificate Authority. The Client Protection Certificate Authority Properties dialog opens.
Illustration 46.3 Client Protection Certificate Authority Properties

5. (Optional) Enter the Validity time (in minutes) for the substitute certificates the engine
creates.
• Each substitute certificate expires at the end of the validity time, and the engine
automatically generates a new certificate. This may produce warnings or error messages
in the users’ web browsers. To avoid excessive warnings, define a sufficiently long validity
time, for example several hours.
Note – All fields except the Name and Validity time on the General tab are greyed out. The
greyed out fields are always filled in automatically based on information contained in the
certificate you generate or import, and you cannot change them.
Configuring Client Protection 659

What’s Next?
 If you want to import an existing certificate, proceed to Importing a Private Key and
Signing Certificate for HTTPS Client Protection (page 660).
 If you want to generate a new certificate for the Client Protetction Certificate Authority,
proceed to Generating a Private Key and Signing Certificate for HTTPS Client Protection.
Importing a Private Key and Signing Certificate for HTTPS

Client Protection
If you already have a certificate authority that is trusted by users’ web browsers, you can import
its private key and signing certificate for the engine to use when it signs the substitute
certificates it creates. This removes the need to separately configure users’ web browsers to
trust the engine’s signing certificate. You can also import a private key and signing certificate
that you generated outside of StoneGate even if you do not already have a certificate authority
that is trusted by users’ web browsers. The certificate and the associated private key must be
compatible with OpenSSL and be in PEM format. Make sure that the private key and certificate
are accessible from the computer where you use the Management Client.
 To import a private key and signing certificate for HTTPS client protection
1. Switch to the Certificate tab.
Illustration 46.4 Client Protection Certificate Authority Properties - Certificate Tab
2. Click the Import button for the Private Key field and browse to the private key.
3. Click the Import button for the Certificate field and browse to the certificate.
If users’ web browsers are not already configured to trust the certificate authority whose signing
certificate you imported here, you must add it to the list of certificate authorities that are
trusted by users’ web browsers when you are finished configuring HTTPS Inspection in
StoneGate.
What’s Next?
 Proceed to Activating HTTPS Inspection on the Engine (page 665).

Generating a Private Key and Signing Certificate for HTTPS
Client Protection
If you do not already have a private key and signing certificate for the engine, you can generate
a private key and signing certificate in the Client Protection Certificate Authority properties.
When you generate a private key and signing certificate in StoneGate, you must export the
certificate and add it to the list of certificate authorities that are trusted by users’ web
browsers.
 To generate a private key and signing certificate for HTTPS client protection
2. Click Generate. The Signing Certificate Details dialog opens.
Illustration 46.6 Signing Certificate Details
3. Enter the Certificate Authority’s Common Name.

4. (Optional) Select the Public Key Length.
5. Specify the date and time the signing certificate is Valid Until.
6. Click OK. The Signing Certificate Details dialog closes, and a private key and signing
certificate are generated.
What’s Next?
 Export the engine’s signing certificate so that it can be added to the list of certificate
authorities that are trusted by users’ web browsers. Proceed to Exporting an HTTPS
Client Protection Certificate (page 662).
Configuring Client Protection 661

Exporting an HTTPS Client Protection Certificate
If users’ web browsers are not configured to trust the engine’s signing certificate, users receive
warnings about invalid certificates. If you generated the signing certificate for client protection in
StoneGate, you must export the certificate and add it to the list of certificate authorities that
are trusted by users’ web browsers.
These instructions assume that you already have the Client Protection Certificate Authority
Properties dialog open.
 To export an HTTPS client protection certificate

2. Click the Export for the Certificate field and browse to the location where you want to save
the file.
When you are finished configuring HTTPS Inspection in StoneGate, add the exported certificate
to the list of certificate authorities that are trusted by users’ web browsers.
What’s Next?
Defining Trusted Certificate Authorities for HTTPS Inspection

Prerequisites: Configuring Client Protection
Trusted Certificate Authority elements represent the certificates that identify certificate
authorities. There are default Trusted Certificate Authority elements for many major certificate
authorities. When a client in the protected network connects to an HTTPS server, the engine
checks whether the certificate authority that signed the server’s certificate is one of the Trusted
Certificate Authorities. If the certificate was signed by one of the Trusted Certificate Authorities,
the engine makes a substitute certificate that matches the server's certificate and signs it with
the Client Protection Certificate Authority signing certificate. If the server’s certificate is not
signed by a Trusted Certificate Authority, the engine makes a new self-signed certificate, and
users receive a warning that the issuer of the certificate is not trusted. In both cases, client
protection continues to function normally.
If you are using client protection and users need to connect to domains whose certificates are
not signed by one of the default Trusted Certificate Authorities, you can define a Trusted
Certificate Authority element to represent it. When you define a CA as trusted, all certificates
signed by that CA are considered valid until their expiration date.

Creating Trusted Certificate Authority Elements
 To create a Trusted Certificate Authority element
3. Right-click Trusted Certificate Authorities and select New Trusted Certificate Authority.
The Trusted Certificate Authority Properties dialog opens.
Illustration 46.8 Trusted Certificate Authority Properties
Note – All fields except the Name on the General tab are greyed out. The greyed out fields
are always filled in automatically based on information contained in the certificate you
import and you cannot change them.
Importing a Trusted Certificate Authority Certificate for

HTTPS Inspection
Make sure that the certificate authority’s certificate is accessible from the computer where you
use the Management Client.
 To import a Trusted Certificate Authority certificate

Illustration 46.9 Trusted Certificate Authority Properties - Certificate Tab
Defining Trusted Certificate Authorities for HTTPS Inspection 663

2. Click Import. A file browser dialog opens.
3. Browse to the certificate and click Open.
What’s Next?
 If you want to configure certificate revocation list (CRL) checks for this certificate
authority, proceed to Configuring Certificate Revocation List Checks for HTTPS
Inspection (page 664).
 Otherwise, click OK to close the Trusted Certificate Authority Properties dialog and
proceed to Activating HTTPS Inspection on the Engine (page 665).
Configuring Certificate Revocation List Checks for HTTPS

Inspection
You can optionally set up StoneGate to query certificate revocation lists (CRLs) on which the
certificate authority lists certificates that are cancelled, for example, because they have been
compromised. By default, the system Refresh Certificate Revocation Lists Task runs daily. The
Management Server connects to the specified CRL servers, checks the CRL information, and
transfers the updated CRLs to the engines. The Management Server must have an Internet
connection to connect to external CRL servers.
 To configure certificate revocation list checks

1. Switch to the Validation tab.
Illustration 46.10 Trusted Certificate Authority Properties - Validation Tab
2. Select Check Validity on Certificate-Specified CRLs.

3. Click Add and select Manual Server Address. The Add CRL Server dialog opens.
Illustration 46.11 Add CRL Server
4. Enter the URL of the CRL server and click OK.

Example http://example.com

5. Add any other CRL servers in the same way, then click OK to close the Trusted Certificate
Authority Properties dialog.
What’s Next?
Activating HTTPS Inspection on the Engine

Prerequisites: Configuring Server Protection, Configuring Client Protection
Depending on the elements you select in the engine properties, you can activate the capability
for client protection alone, server protection alone, or client and server protection together.
 To specify HTTPS inspection options in engine properties

2. Click Firewalls or IPS Engines. A list of engines opens on the right.
3. Right-click the engine and select Properties. The Engine Properties dialog opens.
4. Switch to the HTTPS Inspection tab.
Illustration 46.12 Engine Properties - HTTPS Inspection Tab
5. (For client protection) Click Select and select the Client Protection Certificate Authority
element.
6. (For server protection) Select the Server Protection Credentials element(s) and click Add.
The selected elements are added to the list.
7. Click OK to close the engine properties dialog.
What’s Next?
 If you want to exclude certain domains from HTTPS decryption and inspection, proceed
to Excluding Domains from HTTPS Inspection (page 666).
 Otherwise, proceed to Defining a Custom HTTPS Service (page 667).
Activating HTTPS Inspection on the Engine 665

Excluding Domains from HTTPS Inspection
Prerequisites: None
The HTTPS Inspection Exceptions element is a list of domains that are excluded from decryption
and inspection. Traffic to and from the specified domains is matched against the Access and
Inspection rules as encrypted HTTPS traffic.
 To exclude domains from HTTPS inspection

2. Browse to Other ElementsHTTPS Inspection Policies.
3. Right-click HTTPS Inspection Exceptions and select New HTTPS Inspection Exceptions.
The HTTPS Inspection Exceptions Properties dialog opens.
Illustration 46.13 HTTPS Inspection Exceptions Properties
4. Click Add. The Add Non-decrypted Domain dialog opens.

5. Enter the domain name or NetBIOS name and click OK. The domain is added to the list of
non-decrypted domains.
Caution – The domain name or NetBIOS name must exactly match the DNSName or
IPAddress fields in the Subject Alternative Name or Common Name in the certificate of the
server you want to exclude from decryption. Otherwise, the domain is not excluded from
decryption and inspection.
6. Repeat these steps for any additional domains, then click OK.
What’s Next?
 Create a custom HTTPS Service that enables HTTPS inspection and select the HTTPS
Inspection Exceptions in the Protocol Parameters. Proceed to Defining a Custom HTTPS
Service (page 667).

Defining a Custom HTTPS Service
Prerequisites: (Optional) Excluding Domains from HTTPS Inspection
By default, HTTPS Inspection is not enabled in the HTTPS Service. To enable HTTPS Inspection,
you must create a custom HTTPS Service. You can optionally also specify the HTTPS Inspection
Exceptions to exclude domains from decryption and inspection.
 To define a custom HTTPS Service

2. Browse to Other ElementsServicesTCP. A list of TCP Services opens on the right.
3. Right-click the default HTTPS Service and select NewDuplicate. The TCP Service
Properties dialog opens with the properties of the HTTPS Service.
4. Enter a unique Name for the custom Service.
Illustration 46.14 TCP Service Properties - Protocol Parameters Tab
6. (Optional) Click the Select button for the HTTPS Inspection Exceptions field and select the
HTTPS Inspection Exceptions element in the dialog that opens.
7. Select Yes for HTTPS Decryption and Inspection.
8. Click OK.
What’s Next?
 Use the custom HTTPS Service in an Access rule to select HTTPS traffic for inspection.
Proceed to Creating Access Rules for HTTPS Inspection (page 668).
Defining a Custom HTTPS Service 667

Creating Access Rules for HTTPS Inspection
Prerequisites: Activating HTTPS Inspection on the Engine, Defining a Custom HTTPS Service
To select HTTPS traffic for inspection, you must create Access rules that use the custom HTTPS
Service that you have created. You must select Deep Inspection in the Action options of the
Firewall Access rules to enable inspection of matching traffic. Deep Inspection is enabled by
default in the IPS Access rules. Traffic that matches the Access rules for HTTPS inspection is
decrypted and matched against HTTP Situations in the Inspection rules in the same way as
unencrypted HTTP traffic. Any traffic that is allowed to continue by an Inspection rule is re-
encrypted and sent to its destination.
 To create Access rules for HTTPS inspection

1. (Client Protection) Add a rule with the following properties to select traffic from clients in the
internal network for inspection:
Table 46.1 Access Rules for Client Protection

Allow
The elements that represent The elements that represent the Deep
Your custom
clients in your internal HTTPS server(s) to which internal Inspection
HTTPS Service
network or ANY. clients connect, or ANY. selected in the
Action options.
2. (Server Protection) Add a rule with the following properties to select traffic to internal
servers for inspection:
Table 46.2 Access Rules for Server Protection

Allow
The elements that represent Deep
The elements that represent your Your custom
the clients that connect to Inspection
internal HTTPS server(s). HTTPS Service
your HTTPS server, or ANY. selected in the
Action options.
What’s Next?
 Define Inspection rules to match the decrypted traffic against HTTP Situations. Proceed
to Editing Inspection Rules (page 531).
 Otherwise, if you are finished editing the policy, save and install the policy to start using
the new configuration.
Related Tasks

C HAPT ER 47
EXTERNAL CONTENT INSPECTION
Content inspection, such as virus scanning or URL filtering, can be done by integrating an
external content inspection server (CIS) in the traffic inspection process. Any single or
clustered firewalls can be configured to forward traffic to an external CIS.
Getting Started with External Content Inspection (page 670)

Defining a Content Inspection Server Element (page 671)
Defining a Service for CIS Redirection (page 672)
Defining Access Rules for CIS Redirection (page 674)
Defining NAT Rules for CIS Redirection (page 675)
669
Getting Started with External Content Inspection
Prerequisites: Install and configure the CIS server before you configure CIS redirection in StoneGate
You can redirect traffic to an external content inspection server (CIS), such as a virus scanning
server, for content screening before the traffic continues to its final destination.
What CIS Redirection does
Connections arriving at the firewall can be redirected (using NAT) to a content inspection server
that works as a proxy. The content inspection server filters out unwanted traffic before
inspected traffic is forwarded through the firewall toward its original destination (possibly with a
second NAT operation).
Limitations
• Only the FTP, HTTP, and SMTP Protocol Agents can be used for redirecting traffic to a content
inspection server.
• You can apply either external content inspection (CIS redirection) or internal content
inspection (HTTPS inspection, Web Filtering, internal virus scanning, deep inspection) on
traffic. It is not possible to use both forms of content inspection simultaneously on the same
connection.
• Only IPv4 addresses are supported in CIS redirection.
CIS Server
Protocol Service Firewall Firewall

Agent Policy
1. Define the CIS Server element to define the IP address and services the server inspects.
See Defining a Content Inspection Server Element (page 671).
2. Create a custom Service element that includes the CIS Server. See Defining a Service for
CIS Redirection (page 672).
3. Define the Access rules that select traffic for CIS redirection. See Defining Access Rules
for CIS Redirection (page 674).
4. Define the NAT rules for CIS redirection. See Defining NAT Rules for CIS Redirection
(page 675).
670 Chapter 47 External Content Inspection

Defining a Content Inspection Server Element
Prerequisites: Install and configure the CIS server before you configure CIS redirection in StoneGate
The CIS Server element defines the IP address and the ports for the service(s) on the server.
 To define a CIS Server element

view opens.
3. Right-click Servers and select NewCIS Server. The CIS Server Properties dialog opens.
Illustration 47.2 Content Inspection Server Properties - General Tab
4. Specify a unique Name and the IP Address of the server.

5. (Optional) Specify the Location and the NAT addresses for the server.
• The Location and NAT addresses need to be modified if there is a NAT device between a
firewall and the server, so that the firewall cannot connect directly to the IP address
defined for the interface. For more, see Defining Locations (page 61) and Defining
Contact IP Addresses (page 62).
6. (Optional) Enter a Secondary IP Address for the server.
• StoneGate associates the secondary IP address to the correct element when the IP
address is used as the source or destination address in pass-through communications,
but the secondary IP address is never used as the destination address when StoneGate
initiates the communications.
7. Switch to the Services tab.
Defining a Content Inspection Server Element 671

Illustration 47.3 CIS Server Properties - Services Tab
8. Select the protocol to be inspected and enter the Port Number that the server uses for the
service.
9. Click OK.
What’s Next?
 Continue the configuration by Defining a Service for CIS Redirection (page 672).
Defining a Service for CIS Redirection

Prerequisites: Defining a Content Inspection Server Element
Creating a Service for CIS Redirection

 To define a service for CIS redirection
view opens.
2. Browse to Other Elements and expand the Services branch.
3. Right-click the TCP branch and select NewTCP Service. The TCP Service Properties
dialog opens.
Illustration 47.4 TCP Service Properties

5. Enter the destination port or port range in Dst. Ports and/or enter the source port or port
range in Src. Ports. Leave fields empty as necessary.

6. Click the Select button for the Protocol field and select the Protocol Agent.
• The FTP, HTTP, or SMTP Protocol Agents can be used for CIS redirection.
What’s Next?
 Continue the configuration by Defining Protocol Parameters for CIS Redirection
(page 673).
Defining Protocol Parameters for CIS Redirection

 To define CIS redirection protocol parameters
2. Click the Edit button for Redirect Connections to CIS. The CIS Server Entry dialog opens.
Illustration 47.5 CIS Server Entry
3. Select the CIS Server.

4. Specify the IP Address Translation Range and the Port Translation Range used for source
NAT of the CIS-redirected connections. When the traffic is sent from the firewall to the CIS
server, the addresses are translated as defined here.
• To specify a single IP address, enter the same IP address in both fields. Only IPv4
addresses are supported in CIS redirection.
Note – NAT is mandatory for CIS redirection to forward the traffic to the CIS server. Your
NAT rules must not contain overlapping definitions.
5. Click OK. The CIS Server Entry dialog closes.

6. Click OK. The TCP Service Properties dialog closes.
What’s Next?
 Continue the configuration in Defining Access Rules for CIS Redirection (page 674).
Defining a Service for CIS Redirection 673

Defining Access Rules for CIS Redirection
Prerequisites: Defining a Content Inspection Server Element, Defining a Service for CIS Redirection
Typically, two IPv4 Access rules are needed when the traffic to and from the CIS server goes
through the firewall. One rule redirects the matching traffic to the CIS server and another rule
allows the forward connection from the CIS server to the actual destination.
 To create IPv4 Access rules for CIS redirection

view opens.
2. Right-click the policy and select Edit Firewall Policy. The policy opens for editing.
3. Add a new IPv4 Access rule that redirects the traffic to the CIS server:
Table 47.1 Access Rule for Redirecting Traffic to CIS Server

Original source address of Original destination
Your custom Service
the traffic to be inspected address of the traffic
element with the CIS Allow
(such as clients in the (such as a Web
redirection.
internal network). server).
4. Add a new rule that allows forward connections from the CIS server to the actual
destination. This rule is not needed if the forward connection does not go through the
firewall.
Table 47.2 Access Rule for Forwarding Traffic From CIS Server

Normal service element
without CIS redirection.
Original destination (The Agent with
CIS server’s address. address (such as a redirection is used only Allow
Web server). for the connection that is
redirected, not the
forward connection).
What’s Next?
 Continue the configuration in Defining NAT Rules for CIS Redirection (page 675).

Defining NAT Rules for CIS Redirection
Prerequisites: See Getting Started with External Content Inspection
The address translation defined in your custom Service for CIS redirection must not overlap with
NAT rules. The NAT rules outlined here ensure that no duplicate NAT is applied and define the
NAT applied when connections return from the external server.
 To create NAT rules for CIS redirection

1. Add a “no-NAT” rule for the CIS redirection to ensure that no conflicts with NAT rules can
occur. Place the following rule as the first rule in the IPv4 NAT rules table:
Table 47.3 No-NAT Rule
Source Destination Service NAT

The original source
address of the traffic to
The original destination
be redirected (such as Any Service that Leave empty to ensure
address of the traffic
clients in the internal matches the traffic that no NAT is applied.
(such as a Web server).
network, source
network, etc.).
2. If NAT is needed for the forward connection from the CIS server to the actual destination,
add a second NAT rule:
Table 47.4 NAT Rule for Inspected Traffic
Source Destination Service NAT

Define the NAT that
would be used even
The original destination without CIS redirection
The CIS server’s Any Service that
address of the traffic (such as dynamic
address. matches the traffic
(such as a Web server). source NAT with
NetLinks for outbound
connections.)
This concludes the CIS configuration in StoneGate.
What’s Next?
 If your CIS server is ready to inspect the traffic, save and install the policy to
start using the new configuration.
Related Tasks
Defining NAT Rules for CIS Redirection 675

C HAPT ER 48
BLACKLISTING TRAFFIC
Blacklists contain entries for blocking traffic temporarily based on traffic patterns that the IPS
system detects or on administrator input. Both firewalls and inline sensors can use a blacklist
for blocking traffic.
Getting Started with Blacklisting (page 678)

Enabling Blacklist Enforcement (page 680)
Configuring Automatic Blacklisting (page 681)
Blacklisting Traffic Manually (page 684)
677
Getting Started with Blacklisting
Prerequisites: None
Blacklisting is a response that temporarily bans some traffic on a firewall or inline sensor.
What Blacklisting Does
Blacklisting adds the ability to temporarily stop traffic:
• without editing and installing policies
• based on events detected by analyzers
• on a different engine than the one that detects an event
• on multiple engines with a single administrator action or a single detected event.
Example If an inspection rule detects a serious attack against a single host in your internal network,
you may want the rule to blacklist connections from that host to any other host in your
internal networks. However, potential benefits have to be weighed against the potential risk of
legitimate communications being blocked in the process (especially if the attacker uses
spoofed IP addresses).
Blacklist entries can be generated automatically based on Inspection rules (Exceptions) on
analyzers and sensors, and manually in the Management Client. Analyzers (automatic
blacklisting) and the Management Server (manual blacklisting) relay the requests to firewalls
and inline sensors that use them as defined in their policies.
Limitations of Blacklisting
• Only IPv4 addresses can be blacklisted.
• Firewalls do not generate blacklist entries. Firewalls can only receive blacklist entries.
What Should I Know Before I Begin?
By default, the blacklist is not enforced at all. To enforce the blacklist, you must define the
point(s) at which the blacklist is checked in the IPv4 Access rules. If a connection is allowed by
a rule placed above the blacklist rule, the connection is allowed regardless of the blacklist
entries. In effect, that traffic is whitelisted.
Automatic blacklisting can have unintended consequences that could disrupt business-critical
traffic. Legitimate traffic can be incorrectly identified as malicious if the pattern for detecting
malicious traffic is inaccurate. If an attacker uses spoofed IP addresses, a legitimate IP address
may be blacklisted instead of the attacker’s actual IP address, causing a self-inflicted denial of
service (DoS). Use automatic blacklisting with careful consideration.
678 Chapter 48 Blacklisting Traffic

Interface
Firewall
1
2
Firewall Access
rules
Analyzer
IPS Access IPS

rules Inspection
rules
Interface
Inline Sensor
Blacklisting is configured as follows:

1. Define which traffic is matched against the blacklist in your IPv4 Access rules. See
Enabling Blacklist Enforcement (page 680).
2. (Automatic blacklisting only) Configure which Firewall and Sensor interfaces the Analyzer
uses as destination for sending blacklist requests. See Defining Destination Interfaces
for Automatic Blacklisting (page 681).
3. (Automatic blacklisting only) Define the traffic that you want to blacklist in the IPS
Inspection rule exceptions. See Defining Which Traffic is Blacklisted Automatically
(page 682).
After blacklisting is configured, you can monitor the currently active blacklist as explained in
Monitoring Open Connections and Blacklists (page 97).
Getting Started with Blacklisting 679

Enabling Blacklist Enforcement
Prerequisites: None
A Firewall or inline sensor can be configured using the IPv4 Access rules to select which traffic
is inspected against the blacklist. By default, the blacklist is not enforced at all. To enforce the
blacklist, you define the point(s) at which the blacklist is checked in the IPv4 Access rules. Only
traffic that matches such a rule is checked against the blacklist entries. If the traffic checked
against the blacklist does not match any of the blacklist entries, the next rule in the policy is
checked as usual.
You can have several Apply Blacklist rules with different matching criteria at different points in
the policy.
Example A template can apply the blacklist above an insert point to some types of connections and
then below the insert point to all connections. Rules added to the insert point in a policy can
then ‘whitelist’ some, but not all types of traffic.
 To enable blacklist enforcement

1. Right-click the Firewall or IPS Policy and select Edit Firewall Policy or Edit IPS Policy. The
policy opens for editing.
2. Switch to the IPv4 Access tab, and define which Sources, Destinations, and Services are
compared with the blacklist.
3. Select Apply Blacklist as the Action.
4. (Optional) If you want to restrict which StoneGate components are allowed to send blacklist
requests, right-click the Action cell and select Edit Options. The Select Rule Action Options
dialog opens.
5. Select Restricted.
6. Select the elements from Available Blacklisters that you want to add as Allowed
Blacklisters and click Add.
• Add the Management Server to allow manual blacklisting through the Management
Clients.
• Add a Sensor element to allow it to send a blacklist request to itself.
7. Click OK.
Install the policy on the firewall or sensor to activate the changes.
What’s Next?
 If you want to configure dynamic blacklisting based on events detected by your
StoneGate IPS, see Configuring Automatic Blacklisting (page 681).
 Otherwise, you may want to test the blacklisting by Blacklisting Traffic Manually
(page 684).
Related Tasks

Configuring Automatic Blacklisting
Sensors and analyzers trigger blacklisting based on the Blacklist Scope options in the IPS
Inspection rule exceptions. The analyzer forwards all blacklist entries for the detected events
(including those triggered by sensors) to a StoneGate firewall or inline sensor. The firewall or
sensor enforces the blacklisting according to its policy. Only IPv4 addresses and elements that
contain IPv4 addresses can be blacklisted.
The Default firewall template, the IPS System Template, and the IPS Strict Template contain a
rule that allows the blacklisting connections to the firewall or sensor that is the request
recipient. If your policy is not based on an unmodified default template, or if there are other
firewalls or inline sensors in the communications path, make sure the IPv4 Access rules allow
the blacklisting connections.
What’s Next?
 Start by Defining Destination Interfaces for Automatic Blacklisting.
Defining Destination Interfaces for Automatic Blacklisting

 To define the destination interface for blacklisting connections
1. Right-click the Analyzer and select Properties. The Properties dialog opens.
2. Switch to the Blacklisting tab.
Illustration 48.2 Blacklisting Tab in Analyzer Properties
3. Click the correct engine in the Security Engine Blacklist Interfaces list on the left. The
network interfaces of the engine are displayed.
4. (Optional) Select the network interface you want to use for the blacklisting connection and
click Add. The selected interface is added to the list on the right. If you do not to select the
interface, the system decides the interface based on the routing information. If there is no
explicit route, a best guess is made and a warning is shown at policy installation.
5. Repeat the steps for each firewall or inline sensor to which you want this analyzer to be
able to send blacklist entries.
6. Click OK when you are done.
What’s Next?
 To define which events trigger a blacklist entry, proceed to Defining Which Traffic is
Blacklisted Automatically.
Configuring Automatic Blacklisting 681

Defining Which Traffic is Blacklisted Automatically
You can define blacklisting as an option for IPS Inspection rule exceptions. Both sensors and
analyzers may generate blacklist entries based on the patterns they detect in the traffic flow.
The blacklist entry that is sent identifies traffic based on IP addresses and possibly also the
Protocol and port.
The blacklist entries can be configured to include whole networks, even if the detected events
that trigger them are related to a single source or destination IP address.
Adding a Rule for Blacklisting

 To add a rule for blacklisting
1. Right-click the IPS policy and select Edit IPS Policy. The IPS policy opens for editing.
2. Switch to the Inspection tab.
3. Add an Exception Rule with the Situation, Source, Destination, and Protocol that match
traffic you want to blacklist and select Terminate as the Action.
4. Right-click the Action cell and select Edit Options. The Select Rule Action Options dialog
opens.
What’s Next?
 Proceed to Defining Blacklisting Rule Action Options (page 683).

Defining Blacklisting Rule Action Options
 To define blacklisting rule Action options
1. Switch to the Blacklist Scope tab.
Illustration 48.3 Blacklist Scope Tab in Rule Action Options
2. Select Override collected values set with “Continue” rules.

3. Select the type of Blacklist entry to create:
• Select Terminate the Single Connection to create a Blacklist entry that just cuts the
current connection using the default options. Proceed to Step 8.
• Select Block Traffic Between Endpoints to block the traffic for defined duration and set
the options as explained below.
4. Define the Duration to specify how long the blacklist entry is kept on the receiving
firewall(s) or inline sensor(s).
5. Select the type of Address to blacklist for Endpoint 1 and Endpoint 2:
• Any: Matches any IP address.
• Attacker/Victim: Matches the IP address identified as the originator/target of an attack
by the Situation element that is triggered.
• IP Source/IP Destination: Matches the IP address that is the source/destination of the
packet(s) that trigger the detected situation.
• Connection Source/Connection Destination: Matches the IP address that is the
source/destination of the TCP connection that triggers the detected situation.
• Predefined: Matches only the fixed IP address you enter in the field to the right of the
Address type list.
Configuring Automatic Blacklisting 683

6. (Optional) Change the Netmask for Endpoint 1 and Endpoint 2 to define the range of IP
addresses in the same network as the source IP address that is blacklisted.
• For example, the netmask 255.255.255.0 blacklists all the addresses in the same C-
class network.
• The default netmask 255.255.255.255 blacklists only one specific IP address.
7. Select the Port type to blacklist for Endpoint 1 and Endpoint 2:
• Ignored: Matches any IP traffic regardless of the protocol or port.
• From traffic: Matches the IP protocol and the port number in the traffic that triggered the
blacklist entry.
• Predefined TCP: Matches only TCP traffic through the TCP port or the range of TCP ports
• Predefined UDP: Matches only UDP traffic through the UDP port or the range of UPD ports
8. Select the Blacklist Executors (the engines where the blacklist entry is sent) and click
Add.
9. (Optional) Select Include the Original Observer into the List of Executors to include an
inline sensor that detects the situation in the list of blacklist executors.
10.Click OK.
Related Tasks
 Blacklisting Connections Manually (page 198)
Blacklisting Traffic Manually

You can blacklist traffic manually by creating blacklist entries in the Blacklist view, Connections
view, Monitoring view, and Logs view. Manual blacklisting requires that IPv4 Access rules have
an Apply Blacklist rule with the Management Server as an Allowed Blacklister. See Blacklisting
Connections Manually (page 198).
Related Tasks

V IRTUAL P RIVATE
N ETWORKS
In this section:
Basic VPN Configurations - 687
Configuring IPsec VPNs - 715
Managing VPN Certificates - 755
Reconfiguring Existing VPNs - 767
VPN Client Settings - 781
685
686
C HAPT ER 49
BASIC VPN CONFIGURATIONS
The basic VPN configurations outline specific examples for common VPN configuration
scenarios as a quick-start alternative to the complete configuration instructions in Configuring
IPsec VPNs (page 715).
Getting Started With Basic VPN Configuration (page 688)

Configuration 1: Basic VPN Between StoneGate Gateways (page 688)
Configuration 2: Basic VPN With a Partner Gateway (page 692)
Configuration 3: Basic VPN for Remote Clients (page 701)
Configuration 4: Basic VPN Hub (page 709)
687
Getting Started With Basic VPN Configuration
Prerequisites: None
The basic VPN configurations provide instructions for creating some common types of VPNs. You
may use these examples when setting up your own VPNs and then extend the configuration with
other features as necessary once you have the basic scenario configured and working.
Alternatively, you can follow the complete workflow for creating any type of VPN in Configuring
IPsec VPNs (page 715).
The following basic configurations are explained in this section:
• Configuration 1 is for creating a VPN between two or more StoneGate firewalls that are
managed through the same Management Server. A default set of VPN settings are used to
simplify the configuration. See Configuration 1: Basic VPN Between StoneGate Gateways
(page 688).
• Configuration 2 is for creating a VPN between a StoneGate firewall and an IPsec compatible
VPN gateway that is not managed through the same StoneGate Management server. A
customized set of VPN settings is created, as this is typically mandatory. A pre-shared key is
used for authentication. See Configuration 2: Basic VPN With a Partner Gateway (page 692).
• Configuration 3 is for creating a VPN between a StoneGate firewall and StoneGate VPN
Clients installed on individual computers. A default set of VPN settings are used to simplify
the configuration. See Configuration 3: Basic VPN for Remote Clients (page 701).
• Configuration 4 is for creating a VPN in which several remote sites connect to a hub gateway,
which then forwards connections to the other remote gateways as necessary. A default set of
VPN settings are used to simplify the configuration. See Configuration 4: Basic VPN Hub
(page 709).
Configuration 1: Basic VPN Between StoneGate Gateways

Prerequisites: None
This basic configuration scenario walks you through creating a secure VPN connection through
the Internet between two or more StoneGate firewall/VPN engines that are managed through the
same Management Center. This example VPN requires that all the firewalls have a fixed IP
address (not DHCP- or PPPoE-assigned).
The address spaces protected by the different Gateways must not overlap within any single VPN.
If you use the same IP addresses at the different locations, you must apply NAT to the
communications and define the Sites using the translated IP addresses (the addresses that are
actually used inside the VPN tunnels).
This scenario uses the default VPN-A Suite VPN Profile that contains the VPN settings specified
for the VPN-A cryptographic suite in RFC 4308. The profile uses pre-shared keys for
authentication.
What’s Next?
 This scenario has three parts. Start the configuration in Creating Gateway Elements for
Configuration 1 (page 689).
688 Chapter 49 Basic VPN Configurations

Creating Gateway Elements for Configuration 1
This basic configuration scenario does not explain all settings related to Gateway elements. For
more information, see Defining Security Gateways (page 720).
Following these instructions, your VPN will use all interfaces that contain the default “Any
Network” element (the default route) as endpoints for the VPN.
 To create Gateway elements for configuration 1

1. Select ConfigurationConfigurationVPN from the menu. The VPN Configuration view
opens.
2. Right-click Gateways in the element tree and select NewInternal Security Gateway. The
Internal Security Gateway Properties dialog opens.
Illustration 49.1 Internal Security Gateway Properties - General
3. Select the Firewall engine the Gateway element represents in VPNs.

4. (Optional) Change the Name that was added based on the Firewall element’s name.
Illustration 49.2 Internal Security Gateway Properties - Sites
5. If you plan to use NAT to translate the IP addresses of the hosts that make connections
through this VPN, switch to the Sites tab and drag and drop the network(s) for the NAT
address space on top of the (top-level) automatic Site element on the right.
• The Sites must include only internal networks. Interfaces with the Any Network element
are therefore not included by default and you must not add them in this type of VPN.
6. Click OK to close the Internal Security Gateway Properties.
Configuration 1: Basic VPN Between StoneGate Gateways 689

To create an element for another firewall/VPN engine that takes part in the VPN, repeat the
steps from Step 2 (you must have at least two gateways configured).
What’s Next?
 When you have at least two Gateways configured, proceed to Creating a VPN Element
for Configuration 1 (page 690).
Creating a VPN Element for Configuration 1

This basic configuration scenario does not explain all settings related to VPN elements. For
more information, see Defining a VPN Element (page 742).
 To create a VPN element for configuration 1

1. Right-click VPNs in the element tree and select New VPN. The VPN Properties dialog
opens.
Illustration 49.3 VPN Profile Properties
2. Give the new element a unique Name.

3. Select VPN-A Suite from the VPN Profile list.
• The VPN Profile defines most of the IPsec settings. For instructions on creating your own
VPN Profiles, see Defining VPN Profiles (page 734).
4. If you want to apply NAT rules to the communications that go through the VPN, select the
Apply NAT Rules to Traffic That Uses This VPN option. This does not affect the
communications that the two internal gateways have with each other to set up and maintain
the VPN; those are always matched to the NAT rules.
5. Click OK. The VPN editing view opens on the Overall Topology tab.
Illustration 49.4 VPN Editing View - Overall Topology

6. Drag and drop the Gateways you want to include in this VPN into either of the two panels to
define which Gateways can create a VPN with each other.
• If you add a Gateway under Central Gateways, the Gateway can establish a VPN with any
other Gateway in this VPN (both Central and Satellite).
• If you add a Gateway under Satellite Gateways, the Gateway can establish a VPN only
with Gateways defined as Central in this VPN.
• Add two or more Gateways in this view to create a VPN. You must add at least one of the
Gateways under Central Gateways. You do not have to add any Gateways under Satellite
Gateways (all Gateways can be Central).
Note – Be careful that you do not accidentally drop Gateways on top of other Gateways.
This creates a hub topology where the top-level Gateway forwards connections from other
components to the lower-level Gateway.
7. Switch to the Tunnels tab.

8. Check that the Validity column in the Gateway<->Gateway and the End-Point<->End-Point
tables has a green check mark to indicate that there are no problems.
• If the Validity column of a tunnel has a warning icon, see the Issues panel to check what
the problem is (if the panel is not displayed, you can open it through the View menu or
the right-click menu for the Validity cell of a rule). If Issues are displayed, correct them as
indicated. Long issues are easiest to read by hovering over the issue text so that the text
is shown as a tooltip.
9. Save the VPN.
Creating Rules for VPN Configuration 1

The rules in this example allow protected hosts to open connections both ways. Two rules are
created here to allow the different directions of traffic separately. VPN rules are matched based
on Source, Destination, and Service like any other rules.
This basic configuration scenario does not explain all settings related to VPN Access rules. For
more information, see Creating VPN Rules (page 748).
 To create Access rules for configuration 1

1. Open the policy of one of the firewall/VPN engines involved in the VPN for editing.
2. Add two IPv4 Access rules in a suitable location in the policy.
• Make sure that the rules for sending traffic through the VPN are above any other rules
that match the same traffic with Allow, Discard, or Refuse as their action.
• Traffic that you do not want to send through the VPN must not match these rules. Traffic
that is not routable through the VPN is dropped if it matches these rules.
3. Fill in the rules as outlined below. If NAT is enabled in the VPN, keep in mind that the
Access rules are checked before the translations defined in the NAT rules are applied to the
source and/or destination IP addresses in the packets.
Table 49.1 Example VPN Rules

Select Use VPN, then switch Action to
Local internal Remote internal
Set as needed. Enforce and click Select to add the
networks. networks.
VPN element you created.
Configuration 1: Basic VPN Between StoneGate Gateways 691

Table 49.1 Example VPN Rules (Continued)

Select Use VPN, then switch Action to
Remote internal Local internal
Set as needed. Enforce and click Select to add the
networks. networks.
VPN element you created.
4. Save the policy.

5. Add the same rules in the policies of all firewalls involved in the VPN.
Caution – If you continue to use this VPN, change the pre-shared key periodically (for
example, monthly) to ensure continued confidentiality of your data. See Renewing or
Generating Pre-Shared Keys (page 773). Alternatively, you can switch to certificate-based
authentication by creating a custom VPN profile.
Refresh the policies of all firewalls involved in the VPN to activate the new configuration. The
VPN is established when some traffic matches the Access rules.
What’s Next?
 If NAT is required for this VPN, add the NAT rules as well. See Creating NAT Rules for
VPN Traffic (page 752).
Related Tasks
 Monitoring VPNs (page 753)
 Troubleshooting VPNs (page 911)
Configuration 2: Basic VPN With a Partner Gateway

Prerequisites: None
the Internet between one StoneGate firewall/VPN engine under your management and one
external VPN gateway that is not managed through the same Management Center. To be able to
configure this example VPN, your local firewall must have a fixed IP address (not DHCP- or
PPPoE-assigned).
The address spaces protected by the different Gateways must not overlap within any single VPN.
If you use the same IP addresses at the different locations, you must apply NAT to the
communications and define the Sites using the translated IP addresses (the addresses that are
actually used inside the VPN tunnels).
You can create VPNs with IPsec compliant gateway devices from many different manufacturers.
This allows you to create VPNs with partner organizations that use a VPN solution other than
StoneGate. The authentication and encryption options to use must be decided beforehand in co-
operation with the administrator of the other gateway. See the VPN Configuration chapter in the
StoneGate Reference Guide for listings of the supported options for StoneGate.

This scenario creates a new VPN Profile that contains the VPN settings that you match with
settings defined on the external VPN gateway.
What’s Next?
 This scenario has six parts. Start the configuration in Creating an Internal Gateway
Element for Configuration 2.
Creating an Internal Gateway Element for Configuration 2

If you have already configured a VPN for the firewall engine, reuse the same element for this
VPN. There is no need to change any of the settings.
 To create an internal Gateway element for configuration 2

1. Select ConfigurationConfigurationVPN from the menu to switch to the VPN
Configuration view.

4. Use the Firewall list to select which firewall/VPN engine the Gateway element represents in
VPNs.
5. If the firewall has a dynamic IP address on an interface that faces the Internet, switch to
the End-Points tab and double-click the interface in the table. The Internal End-Point
Properties dialog opens:
• In the Phase 1 ID section at the bottom of the dialog, type in an e-mail address in the ID
value field and click OK. This can be any address that is not used as an ID in any of your
other end-points.
• The address entered here is used only as an identification, not for actually sending e-mail.
6. Switch to the Sites tab. A Site element is displayed with each internal network interface on
the engine as the content.
• The Sites represent the addresses that are routable through the VPN. This does not grant
any host access directly; your Access rules define the allowed connections.
• Leave the Include and update addresses based on routing option selected. This option
automatically updates this information based on routing changes. You can exclude some
Configuration 2: Basic VPN With a Partner Gateway 693

of the interfaces whilst keeping the others automatically updated as explained in the next
step.
7. (Optional) Select the internal networks that you want to exclude from the VPN by disabling
the interface they are under in the automatic site. Disabled interfaces are greyed-out.
• If you want to include some individual network that is under an otherwise disabled
interface, drag and drop it from under the disabled interface onto the Site element to copy
the element to the higher level. Note that the copied definition is not updated
automatically.
• The Sites must include only internal networks. Interfaces with the Any Network element
are therefore not included by default and you must not add them in this type of VPN.
8. If you plan to use NAT to translate the IP addresses of the hosts that make connections
through this VPN, drag and drop the network(s) for the NAT address space on top of the
(top-level) automatic Site element on the right.Click OK to close the Gateway properties.
Creating an External Gateway Element for Configuration 2

 To create an external Gateway element for Configuration 2

1. Right-click Gateways in the element tree and select NewExternal Security Gateway. The
External Security Gateway Properties dialog opens.
Illustration 49.7 External Security Gateway Properties - General

3. Click Select for Gateway Profile and choose the profile Default (All Capabilities) for non-
StoneGate gateways, or the appropriate version-specific profile for StoneGate gateways.
4. Switch to the End-Points tab.
5. Click the Add button below the table. The External End-Point Properties dialog opens.

6. Define the IP address for the end-point:
• If the end-point has a static (manually defined) IP address, type in the IPv4 Address.
• If the end-point has a a dynamic (DHCP-assigned) IP address, select Dynamic.
7. If the external gateway has a dynamic IP address:
• In the Phase 1 ID section at the bottom of the dialog, change the ID Type to Email.
• Type in an e-mail address in the ID value field. This can be any address that is not used
as an ID in any of your other end-points. The address entered here is used only as an
identification, not for actually sending e-mail.
• Click OK and repeat if you have other Internet-facing interfaces with a dynamic IP address.
Note – Make sure that the ID Type and ID Value match the identity configured on the
external gateway device. If the device has a static IP address, make sure that the device is
configured to use it as its identity in this VPN (the most common default configuration) or
change the StoneGate configuration as outlined above.
Leave the properties dialog open and continue to the next section.
Defining a Site for External Gateway in Configuration 2

 To define Site properties for external gateway in configuration 2
1. Switch to the Sites tab in the external Gateway’s properties.
2. Double-click the New Site element on the right. The Site Properties dialog opens.
Illustration 49.8 Site Properties
3. Give the Site a descriptive Name.

4. Select/create the elements that represent the protected IP addresses behind the Gateway
in the left panel and click the Add button to include them.
• For a connection to or from the VPN tunnel to work, the internal IP address used as the
source or destination address must be included in the Site of the Gateway. Other traffic
cannot use the VPN.
5. Click OK in both open dialogs.
Creating a VPN Profile for Configuration 2

This basic configuration scenario does not explain all settings related to VPN Profiles. For more
information, see Defining VPN Profiles (page 734).
 To create a VPN Profile for configuration 2

1. Expand the Other Elements branch in the element tree.
2. Right-click Profiles in the element tree and select NewVPN Profile. The VPN Profile
 To define IKE (Phase 1) settings for configuration 2

1. Switch to the IKE (Phase 1) tab.
Illustration 49.9 VPN Profile Properties - IKE (Phase 1) Tab
2. Select the Cipher Algorithm (encryption method) that matches the settings of the external
gateway device. We recommend that you limit the selection to as few choices as possible.1
• Do not select DES unless you are required to do so. DES is no longer considered secure,
since it is relatively easy to break DES encryption with modern computers.
• 3DES (Triple-DES) has a relatively high overhead compared to other protocols with a
comparable level of security and is therefore not a good choice when high throughput is
required.
3. Select the Message Digest Algorithm (integrity checking method) that matches the
settings of the external gateway device.
1.The Russian product version has no strong encryption algorithms.

4. Select the Diffie-Hellman Group (used for key exchange) that matches the settings of the
external gateway device.
• We recommend that you do not select group 1 if the external Gateway can use a higher
level of protection. Group 1 is not considered sufficiently secure in all cases.
5. Adjust the SA Lifetime to match the settings of the external gateway device.
6. If one of the Gateways has a dynamic IP address, change the Negotiation Mode to
Aggressive.
 To define IPsec (Phase 2) settings for configuration 2

1. Switch to the IPsec (Phase 2) tab.
Illustration 49.10 VPN Profile Properties - IPsec (Phase 2) Tab
2. Select the Cipher Algorithm (encryption method) that matches the settings of the external
gateway device.2
• Do not select the Null option. This option disables encryption, allowing anyone to view the
data in transit.
• Do not select the DES option unless you are required to do so. DES is no longer
considered secure, since it is relatively easy to break DES encryption with modern
computers.
required.
3. Select the Message Digest Algorithm (integrity checking method) that matches the
settings of the external gateway device.

4. Make sure the Compression Algorithm is set to None. The external gateway must not use
compression.
5. Adjust the IPsec Tunnel Lifetime to match the settings of the external gateway device.
6. Select the Security Association Granularity that matches the settings of the external
gateway device.
7. (Recommended) Select Use PFS with Diffie-Hellman Group if the external gateway device
can use PFS, and select the Diffie-Hellman Group to use with PFS.
• We recommend that you do not select group 1 if the external Gateway can use a higher
level of protection. Group 1 is not considered sufficiently secure in all cases.
• PFS is recommended especially when pre-shared keys are used, as in this example.
8. Click OK.


1. Right-click VPNs in the element tree and select New VPN. The VPN Profile selection dialog
opens.
• If you have not created VPNs before, the VPN Profile selection dialog may open first. If
that happens, select your newly created profile to continue.
Illustration 49.11 VPN Properties

3. Select the correct profile from the VPN Profile list.
4. If you want to apply NAT to the traffic going through the tunnels, select the Apply NAT Rules
to Traffic That Uses This VPN option.
6. Drag and drop the Internal Gateway element under Central Gateways.
7. Drag an drop the External Gateway element under Satellite Gateways.

Illustration 49.12 Example Topology for Configuration 2
Illustration 49.13 Tunnel for Internal to External Gateway Connection
9. Double-click the Key cell for the tunnel displayed in the Gateway<->Gateway panel. The
Preshared Key dialog opens.
10.To match the pre-shared key between the two gateways:
• To use the key that is automatically generated in StoneGate, click Export and transfer the
key in the resulting text file securely to the external gateway.
• To use a different key, replace the displayed key with the one that you have agreed on with
the administrator of the external gateway device.
the pre-shared key periodically (for example, monthly).
11.Click OK to close the Pre-Shared Key dialog.

12.Check that the Validity column in the Gateway<->Gateway and the End-Point<->End-Point
13.Save the VPN.

Creating Rules for Configuration 2
The rules in this example allow protected hosts to open connections both ways. Two rules are
created here to allow the different directions of traffic separately. VPN rules are matched based
on Source, Destination, and Service like any other rules.
 To create Access rules for example 2

1. Open the policy of the firewall/VPN engine involved in the VPN for editing.
2. Add two IPv4 Access rules in a suitable location in the policy.
• Make sure that the rules for sending traffic through the VPN are above any other rules
that match the same traffic with Allow, Discard, or Refuse as their action.
• Traffic that you do not want to send through the VPN must not match these rules. Traffic
that is not routable through the VPN is dropped if it matches these rules.
3. Fill in the rules as outlined below. If NAT is enabled in the VPN, keep in mind that the
Access rules are checked before the translations defined in the NAT rules are applied to the
source and/or destination IP addresses in the packets.

Select Use VPN, then change the
Set as needed. Action to Enforce and click Select to
networks. networks.
add the VPN element you created.

networks. networks.
4. Save the policy.
VPN is established when some traffic matches the Access rules created here.
What’s Next?
Related Tasks
 Monitoring VPNs (page 753)
 Troubleshooting VPNs (page 911).

Configuration 3: Basic VPN for Remote Clients
Prerequisites: None
the Internet between a StoneGate firewall/VPN engine and any number of IPsec VPN Clients that
support the settings selected. To ensure compatibility, we recommend using StoneGate IPsec
VPN Clients. To be able to configure any client-to-gateway VPN, the firewall must have a fixed IP
address (not DHCP- or PPPoE-assigned).
Depending on the desired configuration, you can add VPN client access to an existing gateway-
to-gateway VPN as well, but in this example scenario, a separate VPN is created for VPN clients
since this approach works in all cases.
This scenario assumes that automatic Site management is used in the VPN without any need
for modifications in this VPN (or in other VPNs where the same Gateway is used).
In this scenario, the VPN settings are defined in a copy of the default VPN-A Suite VPN Profile
that contains the VPN settings specified for the VPN-A cryptographic suite in RFC 4308.
What’s Next?
 This scenario has six parts. Start the configuration in Managing VPN Client Addresses
in Configuration 3.
Managing VPN Client Addresses in Configuration 3

VPN clients cannot use their local IP address in the internal corporate network. In this scenario,
NAT is used to solve this problem. This address management method allows connection
opening from the VPN client end only. This method is simpler to set up for testing, since it does
not require an external DHCP server. However, this method has some restrictions:
• It does not allow connections to be opened from hosts in the internal network to the VPN
clients.
• It prevents the StoneGate IPsec VPN Clients from using internal DNS servers.
You may want to change the IP address allocation method to Virtual IP after you have tested the
basic VPN connectivity with the configuration explained here (as explained in Configuring Virtual
IP Addressing for VPN Clients (page 787)).
This basic configuration scenario does not explain all settings related to VPN Client address
management. For more information, see Getting Started With VPN Client Settings (page 782).
 To add address translation settings for VPN Clients for configuration 3

1. Open the properties of the Firewall element for the firewall/VPN gateway to which the VPN
clients connect.
3. Click the VPN Settings button in the Traffic Handling section on the right. The VPN
Settings dialog opens.
Configuration 3: Basic VPN for Remote Clients 701

Illustration 49.14 VPN Settings in Firewall Properties
4. Select Translated IP address (using NAT Pool) and enter the IP Range of addresses and
the Port Range you wish to use for translating VPN client traffic.
• The VPN clients use these IP addresses when they connect to services in your internal
network. Make sure these IP addresses are not used elsewhere in your network.
• The translation is dynamic, so the number of IP addresses you enter does not need to
correspond to the number of clients connecting. Typically, each connection a VPN client
user opens to a resource reserves one port from whichever IP address has unreserved
ports within the configured range.
• The reverse NAT for the reply packets is done automatically.
5. Click OK to both open dialogs.
Creating Gateway Elements for Configuration 3

The same Gateway element can be used in several VPNs. If you have previously created a
Gateway element for the firewall/VPN engine to which the VPN Clients connect, use the existing
element instead of creating a new one. Open the Properties dialog for the existing gateway and
check that the configuration of the existing Gateway is correct starting from Step 5 below.
Changes in the Gateway element affect all VPNs where the same Gateway element is used.
 To create a Gateway element for configuration 3

1. Select ConfigurationConfigurationVPN from the main menu to switch to the VPN
Configuration view.

4. Select which Firewall engine the Gateway element represents in VPNs.
5. Make sure Automatic Certificate Management is selected. The gateway must have a
certificate for a client-to-gateway VPN.
6. Switch to the Sites tab. A Site element is displayed with each internal network interface on
the engine as the content.
• The Sites represent the internal addresses that VPN clients can reach through the VPN.
This definition alone does not grant access to any hosts; your Access rules define the
allowed connections.
• Leave the Include and update addresses based on routing option selected. This option
automatically updates this information based on routing changes. You can exclude some
of the interfaces whilst keeping the others automatically updated.
• If you need to make changes in the Sites (add or remove destination addresses that VPN
clients route through the VPN), see Defining Sites for VPN Gateways (page 729).
7. Click OK.
Adding VPN Client Settings for Configuration 3

This basic configuration scenario does not explain all settings related to authenticating VPN
client users. For more information, see Defining VPN Client Settings (page 740).
 To add the VPN Client Settings for Configuration 3

1. Expand the Other ElementsProfiles branch in the element tree and select VPN Profiles.
The defined VPN Profiles are displayed.
2. Right-click VPN-A Suite and select NewDuplicate. The settings from the default profile
are copied into the VPN Profile Properties dialog that opens.
3. Give this new VPN Profile a unique Name.
4. Switch to the IKE (Phase 1) tab.3

Illustration 49.17 VPN-A Profile Properties - IKE (Phase 1)s
5. Make sure that Negotiation Mode is set to Main. This helps ensure that the usernames
and passwords of the VPN Client users remain confidential.
6. Switch to the VPN Client tab.
Illustration 49.18 VPN-A Profile Properties - VPN Client
7. Make sure the Authentication Method is set to RSA Signatures.

8. Select Allow Hybrid Authentication. Hybrid authentication means that the Gateway
authenticates itself to the VPN clients using a Certificate and the VPN clients are
authenticated by the user’s username and password.
9. Make sure that the Security Association Granularity is set to SA Per Net.
10.Click OK.


1. Right-click VPNs in the element tree and select New VPN.
• If you have not created VPNs before, the VPN Profile selection dialog may open first. If
that happens, select your newly created VPN Profile to continue.

3. Select your newly created VPN Profile from the VPN Profile list.
4. Select Apply NAT Rules to Traffic That Uses This VPN. This applies the NAT rules in the
policy and, more importantly, also the global NAT definition for the gateway (which you
configured in the first part of this scenario).
6. Drag and drop the element for the internal gateway to Satellite Gateways.
• Configuring the gateway as a satellite prevents gateway-to-gateway tunnels from being
generated if you add several gateways that offer VPN client access, since this example
VPN is purely meant for client-to-gateway access.
7. Drag and drop the default IPsec Client Gateway element to Central Gateways.
Illustration 49.20 Example Topology for Configuration 3

10.Save the VPN.
Creating Users for VPN Configuration 3

This basic configuration scenario does not explain all settings related to user authentication. For
more information, see Getting Started with User Authentication (page 624).
User authentication is configured in the same way for VPN client connections and normal,
unencrypted connections. The same User elements (user accounts) can be used for both. When
the VPN is set to use the Main mode for IKE (Phase 1) like in this example, the passwords
entered in the VPN client are encrypted so that they remain confidential while they are
transferred over the Internet.
 To create User elements for VPN Client users for configuration 3

view opens.
2. Expand the Other ElementsUser AuthenticationUsersInternalDomainstonegate
branch in the element tree.
3. Right-click stonegate and select NewUser. The User Properties dialog opens.
Illustration 49.21 User Properties - General
4. Enter the user Name the end-user uses to authenticate to the VPN.
5. (Optional) Type the real name of the user in the Comment field.

Illustration 49.22 User Properties - Authentication
7. Click Add in the Authentication Service section. The Select Element dialog opens.
8. Select User Password and click Select. This default element allows user password
authentication against the internal LDAP database.
9. Enter the same password in the Password and Confirm Password fields in the User
properties. Make a note of the password so that you can communicate it to the user.
• The pre-shared key method is meant for third-party VPN clients. It is not supported by
StoneGate clients and it is not valid for this VPN.
10.Click OK. The information is added in the Management Server’s internal LDAP user
database.
Add additional users in the same way.

The authentication connection from VPN clients is allowed in the Default Policy Template.
Authentication is always required to establish the VPN tunnel. VPN client connections are
matched based on Source, Destination, and Service like any other traffic. The example rule
matches only specific users, and only after the users have already successfully authenticated.
We recommend always adding the authentication requirement to rules that are specific to VPN
clients.
After the VPN tunnel is established, any connection from the VPN clients to the internal network
is matched against the Access rules as usual. The example rule that is created here allows
these connections.

1. Open the policy of one of the firewall/VPN engines involved in the VPN for editing.
2. Add an IPv4 Access rule in a suitable location in the policy and fill in the rule as outlined
below:
• If NAT is active and applied to translate the destination, keep in mind that the Access
rules are checked before the translations defined in the NAT rules are applied to the
destination IP addresses in the packets.
• The source address translation for VPN clients (using the NAT Pool) is done before the
Access rules are checked and you can use the translated virtual IP address in the Access
rules.
Table 49.3 Example VPN Rule
Source Destination Service Action Authentication Users

Select Use VPN, then
Set to ANY or Local change the Action to Set to ANY or to The stonegate
Set as
the Virtual IP internal Enforce and click Select some particular User Group (in
needed.
address range. networks. to add the VPN element method. InternalDomain
you created.
3. Save the policy.

VPN is established when some traffic matches the Access rules created here.
What’s Next?
 Make sure that your NAT rules do not apply a second NAT operation to the VPN clients’
IP addresses (defined the NAT Pool for VPN clients in Managing VPN Client Addresses in
Configuration 3 (page 701)), see Editing NAT Rules (page 545).
 Install and configure the VPN clients as instructed in the VPN client’s documentation.
Note that many settings that affect how the client behaves are configured through the
Management Center. To further explore the available options you can define for VPN
Clients in the Management Center, see Getting Started With VPN Client Settings
(page 782). The clients download a configuration file from each gateway they connect
to.
 After testing the basic connectivity, you may want to change the IP address allocation
method to use the Virtual Adapter to allow queries from the clients to your
organization’s internal DNS servers, see Configuring Virtual IP Addressing for VPN
Clients (page 787).
Related Tasks
 Monitoring VPNs (page 753).
 Getting Started with User Authentication (page 624).
 Troubleshooting VPNs (page 911).

Configuration 4: Basic VPN Hub
Prerequisites: None
In a VPN hub configuration, a gateway is configured to forward VPN traffic between different VPN
tunnels. The gateway that does this forwarding is called a hub gateway. The gateways that
contact each other through a hub are called spoke gateways.
The hub gateway must be set up specifically as a hub. The hub configuration is reflected in the
topology, the Site definitions, and the VPN rules. The spoke gateways do not require any hub-
specific configuration. Following this example configuration, VPN tunnels are established from
all spoke gateways to the hub gateway, and all networks of all gateways are configured as
reachable through the hub (but actual connections are allowed only as defined in the Firewall
Access rules).
Note – There must not be duplicate end-point-to-end-point tunnels in different VPNs. If

there are existing VPNs between the firewall/VPN engines involved in the hub, overlapping
configurations must be removed.
This basic configuration scenario explains a configuration in which all connections are defined
within the same VPN element, which is usually simpler to set up and maintain than forwarding
traffic between VPN tunnels defined in different VPN elements. In this scenario, all Gateways are
Internal Gateways (StoneGate firewall/VPN engines controlled by the same Management
Server). SOHO Gateway Groups and External Gateways can be added to this configuration even
though their creation is not covered in detail in this workflow. SOHO Gateway Groups can only be
added as spokes.
What’s Next?
 This scenario has four parts. Start the configuration in Creating Gateway Elements for
VPN Configuration 4.
Creating Gateway Elements for VPN Configuration 4

If there is a previously configured Gateway element for a Firewall/VPN engine you plan to use in
this configuration, use the existing element instead of creating a new one.
Following these instructions, the VPN will use all interfaces that contain the default “Any
Network” element (the default route) as endpoints for the VPN.
 To create Gateway elements for configuration 4

1. Select ConfigurationConfigurationVPN from the main menu to switch to the VPN
Configuration view.
Configuration 4: Basic VPN Hub 709

3. Select the Firewall engine the Gateway element represents in VPNs.

4. (Optional) Change the Name that was added based on the Firewall element’s name.
Create further Gateway elements so that each firewall/VPN engine involved in this VPN is
represented.
Creating a VPN Element for VPN Configuration 4


1. Right-click VPNs in the element tree and select New VPN. The VPN Properties dialog
opens.
Illustration 49.24 VPN Profile Properties

3. Select VPN-A Suite from the VPN Profile list.
4. If you want to apply NAT rules to the communications that go through the VPN, select Apply
NAT Rules to Traffic That Uses This VPN. This does not affect the communications that
the two internal gateways have with each other to set up and maintain the VPN. Those are
always matched to the NAT rules.
6. Drag and drop the hub Gateway to Central Gateways.

Hub Gateway
Spoke Gateways
7. Drag and drop the other Gateways on top of the hub Gateway so that the Gateways are
added as branches (spokes) under the hub Gateway as in the illustration above. These can
include any other Internal or External Gateways.
8. Save the VPN, but do not close the VPN editing view yet. This intermediate save is required
to store the changes in the database for the next operation.
Defining Site Properties for VPN Configuration 4

This basic configuration scenario does not explain all settings related to Site elements. For
more information, see Defining Sites for VPN Gateways (page 729).
 To define a Hub Site for configuration 4

1. Right-click the hub Gateway and select NewSite. The Site Properties dialog opens.
Illustration 49.26 Site Properties - General Tab
3. Add all networks protected by the spoke gateways to the Site contents (the panel on the
right).
• After you do this, the Site should contain all remote IP addresses that are used in spoke-
to-hub traffic that is forwarded from the hub to other spokes.
• The Site should not contain the hub gateway’s local networks. These are defined using
the automatic Site management features in this example.
4. Switch to the Site References tab.
5. Select Enable for this VPN element and deselect it for all other VPNs. Note that the Site is
still shown in all VPNs, but is greyed-out (disabled) and not included in the configuration.
6. Select Hub as the Mode. This activates VPN hub-related features for the Gateway.

7. Click OK to close the dialog and return to the main VPN editing view.
10.Save the VPN.

The rules in this example allow connections between hosts in protected networks of all
Gateways to connect to all other protected networks. VPN rules are matched based on Source,
Destination, and Service like any other rules.

1. Open the policy of the firewall/VPN engine that is configured as the hub gateway in the VPN
for editing.
2. Add an IPv4 Access rule in a suitable location in the policy.
• Make sure that rules for sending traffic through the VPN are above any other rules that
match the same traffic with Allow, Discard, or Refuse as their action.
• Traffic that you do not want to send through the VPN must not match this rule. Traffic that
is not routable through the VPN is dropped if it matches this rule.
3. Fill in the rule as outlined below.
• If NAT is enabled in the VPN, keep in mind that the Access rules are checked before the
translations defined in the NAT rules are applied to the source and/or destination IP
addresses in the packets.
• To ensure this rule does not match other traffic, you can add the VPN you created in the
Source VPN cell.
Table 49.4 Example VPN Rule for Spoke-to-Spoke Forwarding

Remote internal Remote internal
Set as needed. Action to Forward and click Select to
networks. networks.

4. Add two more rules in a suitable location in the policy to allow traffic between the hub
Gateway’s local protected networks to the spoke Gateway’s protected networks. Two rules
are created here to allow the different directions of traffic.

networks. networks.

networks. networks.
5. Save the policy.

6. Add rules in the policies of all firewall/VPN engines involved as outlined in Step 4.
VPN is established when traffic matches the Access rules.
What’s Next?

C HAPT ER 50
CONFIGURING IPSEC VPNS
IPsec (Internet Protocol Security) VPNs (Virtual Private Networks) allow creating secure,
private connections through networks that are not otherwise secure.
Getting Started With IPsec VPNs (page 716)

Defining Gateway Profiles (page 718)
Defining Security Gateways (page 720)
Defining Sites for VPN Gateways (page 729)
Defining VPN Profiles (page 734)
Defining a VPN Element (page 742)
Creating VPN Rules (page 748)
Monitoring VPNs (page 753)
715
Getting Started With IPsec VPNs
Prerequisites: If you want to allow access to VPN clients: Getting Started with User Authentication
VPNs in StoneGate Firewall/VPN are implemented according to the IPsec standard (an
extension of the IP protocol). For more background information on IPsec and the VPN
configuration in StoneGate, see the Reference Guide. For information about the StoneGate SSL
VPN product, see the StoneGate SSL VPN Administrator’s Guide.
What VPNs Do
A virtual private network (VPN) extends a secured private network over public networks by
encrypting connections so that they can be transported over insecure links without
compromising confidential data. For this purpose, the devices that create the VPN check the
identity of the other parties by the way of authentication. A VPN also includes integrity checking
to ensure the communications are not tampered with.
In StoneGate, you can create two main types of VPNs:
• You can create a VPN between two or more gateway devices that provide VPN access to
several hosts in their internal networks. We call this a gateway-to-gateway VPN.
• You can create a VPN between a gateway device at a site and a VPN client running on an
individual computer, like a laptop of a travelling user or a desktop PC at a home office. We call
this a client-to-gateway VPN. The recommended option is to use the StoneGate VPN Client
(available on Windows). Third-party IPsec-compatible VPN clients can also be used.
Note – VPN clients that are a part of a vendor-specific VPN gateway solution are generally
incompatible with gateways from other vendors.
Limitations
• Version-specific limitations in supported features for different StoneGate Firewall/VPN
versions are listed in the Release Notes for the versions you are using. The Management
Center automatically prevents the use of unsupported settings based on engine version.
• All VPNs you configure for VPN clients must be valid for StoneGate VPN clients even if you use
only third-party VPN client software.
• If your Firewall/VPN engine installation is specifically configured in a restricted operating
mode to comply with regulatory requirements, some VPN options are unavailable to you.
Proceed as explained in the Configuration Overview or follow one of the Basic VPN
Configurations (page 687) to quickly create some types of basic VPNs.
716 Chapter 50 Configuring IPsec VPNs

Illustration 50.1 Elements in the VPN Configuration (Excluding Certificate-Related Elements)
Ga rofi
VP
N
P
te le
wa
Pr
of
y
ile
Ga etti
Fi
Ga
VP
Fi olic
re
re y
N
S
te ngs
te
P
wa
wa
wa
wa
ll
ll
y
y
Si
te
The Gateway Settings element shown above is not part of the workflow below because the
default settings should be used in most cases (see Advanced VPN Tuning (page 774) for more
information). Otherwise, the following workflow covers all VPN configurations:
1. (Optional) If you are configuring a VPN with an external device, you may want to create a new
Gateway Profile specific to the device, see Defining Gateway Profiles (page 718).
2. Add the necessary number of gateway elements to represent the physical VPN devices,
see Defining Security Gateways (page 720). These define the VPN end-points (gateway IP
addresses) and the Sites (see the next point). Only one element per device is needed in
the system, even if there are many VPNs.
3. Configure the Gateway’s Sites. These define the IP addresses that can be made routable
through VPNs, see Defining Sites for VPN Gateways (page 729). The Sites can be
adjusted in different VPNs that the Gateway establishes.
4. (Optional) If the existing VPN Profiles do not have suitable settings for your new VPN,
create a new one as explained in Defining VPN Profiles (page 734). This defines the IPsec
settings (authentication, encryption, and integrity checking).
5. Create a new VPN element as explained in Defining a VPN Element (page 742). This
defines the topology (which gateways create tunnels with each other).
6. Create certificates, if necessary. See Getting Started With VPN Certificates (page 756).
7. Add the IPv4 Access rules and, if necessary, the IPv4 NAT rules for VPN traffic. See
Creating VPN Rules (page 748). This also activates the VPN on the engines.
What’s Next?
 Start from Configuring IPsec VPNs (page 718).
Getting Started With IPsec VPNs 717

Configuring IPsec VPNs
Starting from here, you can create a new VPN by following the “What’s Next” links from section
to section. This workflow contains steps for all kinds of IPsec VPN configurations. Alternative
next steps are included as necessary to achieve a particular type of configuration. Alternatively,
you may want to follow a simplified workflow for building a particular type of VPN, see Basic VPN
If you already have VPNs configured, we recommend making a backup of the Management
Server (see Creating Backups (page 795)) before you start configuring additional VPN settings.
Having a backup allows you to more quickly revert your changes in case your changes end up
interfering with existing VPNs.
Continue the configuration as explained below, in the first section that applies to you.
What’s Next?
 If you are configuring a VPN with an external gateway, you may want to create a new
Gateway Profile if the existing profiles are not suitable in this case, see Defining
Gateway Profiles (page 718).
 Otherwise, begin the configuration in Defining Security Gateways (page 720).
Related Tasks
 Configuration Overview (page 717)
 Getting Started With VPN Client Settings (page 782)
Defining Gateway Profiles

Prerequisites: None
Internal Gateways always use a default profile that is assigned according to the currently
installed software version and cannot be changed manually. Gateway profiles can be used with
external gateways to set certificate-related options (used with some gateways that do not
support some operations) and to restrict the options to a supported set to prevent configuration
errors. If you do not see a need to utilize these settings, you can use the unrestricted Default
(all capabilities) profile.
What’s Next?
 To add or modify a custom Gateway Profile, continue in Defining a Custom Gateway
Profile (page 718).
 To configure a VPN using the existing Gateway profiles, continue in Defining Security
Gateways (page 720).
Defining a Custom Gateway Profile

The properties on the General tab are meant for advanced users. The default values are the
recommended values. These options affect the VPN directly.
The IKE Capabilities and IPsec Capabilities are not directly used in a VPN (the settings are
selected for use in the VPN Profile element), but instead define a set of options that the
Gateway supports, so that the system can automatically check for misconfigured settings.

 To define a custom Gateway Profile
opens.
Illustration 50.2 Gateway Profiles in the VPN Configuration Tree
2. Browse to Other ElementsProfiles.

3. Right-click the Gateway Profiles branch and select New Gateway Profile. The Gateway
Profile Properties dialog opens.
Illustration 50.3 Gateway Profile Properties
4. Enter a unique Name and optionally a Comment for the element.

5. Select options for Tunnel-to-Tunnel Forwarding Capabilities:
Setting Description
Select this to indicate whether the Gateways using the profile are
capable of forwarding gateway-to-gateway VPN traffic to other
Relay Gateway-to-Gateway Traffic gateway-to-gateway VPNs. This reduces the number of tunnels
created by default for VPNs involving this Gateway when you define
forwarding from one VPN to another in the VPN element.
This option is shown only because the setting is used in the default
Relay Client-to-Gateway Traffic profiles for different versions of StoneGate Firewall/VPN. This
setting is not relevant to custom configurations.
Defining Gateway Profiles 719

6. Select options for Certificate Authentication:
Setting Description
Selecting this option prevents StoneGate from processing certificate
request payloads in IKE messages with Gateways that use this profile.
Ignore Certificate Requests
Gateways use certificate requests to ask the other gateway to forward
its certificates or related information.
Selecting this option prevents StoneGate from sending certificate

revocation lists in IKE messages with Gateways that use this profile. If
Do Not Send CRLs
the CRLs are available to the other gateway through other ways, it is not
necessary to send them through IKE messages.
Selecting this option makes StoneGate send the full certificate chain
Send Full Certificate Chains (from the node’s certificate to the root Certificate Authority certificate)
in IKE messages with Gateways that use this profile.
7. Switch to the IKE Capabilities tab and select the options that the device supports for IKE
phase 1.
8. Switch to the IPsec Capabilities tab and select the options that the device supports for IKE
phase 2.
What’s Next?
 Continue the configuration by Defining Security Gateways (page 720).
Defining Security Gateways

Prerequisites: None
The physical devices that establish the VPN are represented by Security Gateway elements in
the configuration. The following types of Gateway elements can be configured:
Gateway Type Description

StoneGate Firewall/VPN engines that are managed by the same
Management Server (and administrative Domain) to which you are
currently connected with your Management Client. You can add more
Internal Security Gateway
than one Gateway element to represent the same firewall, but each
Gateway element reserves an end-point (IP address) that cannot be
used by other elements.
All other security gateways, including StoneGate firewall/VPN devices

that are managed by some different Management Server than the one
External Security Gateway
to which you are connected (or which are configured under a different
administrative Domain).
All StoneGate and third-party VPN clients are represented by the default
IPSec Client Gateway
IPsec Client Gateway element.

Gateway Type Description
SOHO Gateway Groups represent one or more StoneGate SOHO
SOHO Gateway Group Firewall appliances when they are used like Internal Security Gateways.
Each SOHO firewall can belong to only one SOHO Gateway Group.
Proceed to the first section below that applies to you.
What’s Next?
 If you do not already have any Gateway elements, start by Creating a New Security
Gateway Element (page 721).
 To edit internal Gateway IP address related settings, see Defining End-Points for Internal
Security Gateways (page 722).
 To edit external Gateway IP address related settings, see Defining End-Points for
External Security Gateways (page 724).
 To change certificate acceptance settings, see Defining Trusted CAs for a Gateway
(page 726).
 To configure settings for VPN clients that connect to a gateway, see Defining Gateway-
Specific VPN Client Settings (page 727).
Creating a New Security Gateway Element

 To create a New Gateway
opens.
2. Right-click the Gateways branch in the element tree and select one of the following options:
• NewInternal Gateway to represent a firewall managed by this Management Server in a
VPN.
• NewExternal Gateway to represent a third-party VPN device or a StoneGate Firewall
managed by a different Management Server in a VPN.
• NewSOHO Gateway Group to represent SOHO firewalls in a VPN.
3. Enter the Name and optionally a Comment for the element.
4. (SOHO Gateway Groups only, optional) Select Use NAT-T to allow the gateways to
encapsulate the IPsec communications when necessary to traverse a NAT device. This
option uses standard NAT-T encapsulation on UDP port 4500.
5. (Internal Gateways only, optional) Deselect Automated RSA Certificate Management if you
prefer to create and renew certificates manually when certificates are needed.
• Automated certificate management is only for RSA certificates.
• Even when the option is selected, certificates are only created when needed.
6. Select the device this Gateway represents:
Gateway Type Configuration

Internal Gateway Select the Firewall engine that the Gateway element represents in VPNs.
Click Select and choose the Gateway Profile that contains information on the
External Gateway
capabilities of the external Gateway.
Defining Security Gateways 721

Gateway Type Configuration
Select the SOHO Firewall elements in the Resources list on the left and click
SOHO Gateway
Add.
Continue the configuration in the correct section according to the type of Gateway:
What’s Next?
 Defining End-Points for Internal Security Gateways (page 722)
 Defining End-Points for External Security Gateways (page 724)
 There is no additional configuration for SOHO Gateway Groups. Continue by Defining
VPN Profiles (page 734).
Defining End-Points for Internal Security Gateways

Each end-point is dedicated for one Gateway element. Any IP address that is already selected as
an end-point for some other Gateway element is not shown on the End-Points list for subsequent
Gateways you create for the same Firewall/VPN engine. Each Gateway element can be used in
several VPNs.
 To define end-points for Internal Gateways

1. Switch to the End-Points tab in the Gateway properties. The IP addresses available for use
as end-points are displayed.
Illustration 50.4 Internal Security Gateway Properties - End-Points
2. (Optional) Change the selection of IPv4 address(es) that you want to use as end-points in
VPNs. Typically, these are IP address(es) that belong to interface(s) towards the Internet,
which are selected by default (based on the firewall’s default routing table).
• Only IPv4 addresses can be used for end-points.
• On clustered firewalls, these are CVIs.
• If you have more than one Internet connection, select an IP address from each ISP to
make Multi-Link load balancing and failover possible for VPNs.
3. Double-click the end-point that you selected for this Gateway. The Internal End-Point

Illustration 50.5 Internal End-Point Properties
4. (Optional) Give the end-point a Name.

5. (Optional) Select the Mode to define how the end-point is used in a Multi-Link configuration.
You can override these settings in each individual VPN.
• Active: use the tunnel(s) of this end-point whenever possible.
• Standby: use the tunnel(s) of this end-point only if the Active end-points cannot be used.
6. (Optional, Firewall/VPN versions prior to 5.2 only) Select Use UDP Encapsulation if you want
to encapsulate IPsec communications in UDP packets using StoneGate’s proprietary
method.
7. (Optional) Select one of the Use NAT-T options to activate encapsulation for NAT traversal in
gateway-to-gateway VPNs, which may be needed to traverse a NAT device at the local or at
the remote gateway end.
Option Description
Select this option if you if you want to allow encapsulating the IPsec
communications in standard NAT-T UDP packets in gateway-to-gateway VPNs when
Use NAT-T
the gateways detect that a NAT operation is applied to the communications. If
both gateways do not support this option, the option is ignored.
Select this option to force NAT-T even when the gateways do not detect a NAT
Use force NAT-T operation being applied to the communications. If both gateways do not support
this option, the VPN fails to establish.
• The gateway always allows VPN clients to use NAT-T regardless of these settings.
• NAT-T always uses the standard UDP port 4500.
Note – If the external IP address is private and translated to a public IP address by an

external NAT device, make sure Contact Addresses and Locations are correctly defined in
the Firewall properties.

8. (Optional) Select Use TCP Tunneling Port on if you want to tunnel StoneGate IPsec VPN
Client communications with this Gateway end-point in a TCP connection to bypass a traffic
filtering device that does not allow standard IPsec ports to pass or to traverse a NAT
device.
• This option may not be supported by all external gateways. Support is required at both
ends of each tunnel.
9. If necessary, change the default Contact Address and/or add Exceptions for the
Location(s) of other Gateway(s) involved in the VPN.
• The two contacting Gateways must be in different Locations (note that external gateways
are always in the Default Location).
• In clusters, VPNs use CVIs, not NDIs.
• For more information on Locations and Contact Addresses, see Configuring System
Communications (page 59).
Example The internal gateway is behind a NAT device. The real address is defined as the End-Point
address, because the IP address is also used for identification inside the encrypted traffic.
Contact must be made using the translated address, so it is defined as a Contact Address.
10.In the Phase-1 settings, change the ID Type to your preferred option.
• The ID identifies the Gateways during the IKE phase 1 negotiations.
• The Distinguished Name type is only valid in certificate-based authentication.
• The IP Address type is not valid for end-points with a dynamic IP address.
11.Enter an ID Value if you selected DNS Name or Email as the type. The value for IP address
is filled in automatically.
Continue the configuration as explained below in the first section that applies to you.
What’s Next?
 If you want to use certificate authentication and you want to limit which of the
Certificate Authorities you define in the system this Gateway considers trusted,
continue in Defining Trusted CAs for a Gateway (page 726).
 If you plan to allow VPN Clients to establish VPNs with this Gateway, continue in
Defining Gateway-Specific VPN Client Settings (page 727).
 Otherwise, continue in Defining Sites for VPN Gateways (page 729).
Defining End-Points for External Security Gateways

 To define end-points for internal Gateways
1. Switch to the End-Points tab in the Gateway properties. The end-point table is displayed.
2. Click the Add button below the table. The External End-Point Properties dialog opens.

Illustration 50.6 External End-Point Properties
3. (Optional) Enter a Name for the end-point.

4. Define the IPv4 address for the end-point:
• If the end-point has a static (manually defined) IP address, enter the IPv4 Address. This
must be the IP address that is configured for the external device in its configuration.
• If the end-point has a dynamic (DHCP-assigned) IP address, select Dynamic.
5. (Optional) Select the Mode to define how StoneGate treats the end-point in a Gateway with
multiple end-points. This is a default setting for the tunnels that are generated for VPNs
that use this Gateway. You can override this Active/Standby setting in each VPN.
• Active: use the tunnel(s) to this end-point whenever possible.
• Standby: use the tunnel(s) to this end-point only if the Active end-points cannot be used.
6. (Optional, Firewall/VPN versions prior to 5.2 only) Select Use UDP Encapsulation if you want
to encapsulate IPsec communications in UDP packets using StoneGate’s proprietary
method.
• This method is proprietary to StoneGate. Do not use it for external gateway devices from
other vendors. Support is required at both ends of each tunnel.
7. (Optional) Select one of the Use NAT-T options to activate encapsulation for NAT traversal in
gateway-to-gateway VPNs, which may be needed to traverse a NAT device at the local or at
the remote gateway end.
Option Description
Select this option if you if you want to allow encapsulating the IPsec communications
in standard NAT-T UDP packets in gateway-to-gateway VPNs when the gateways detect
Use NAT-T
that a NAT operation is applied to the communications. If both gateways do not
support this option, the option is ignored.
Select this option to force NAT-T even when the gateways do not detect a NAT
Use force NAT-T operation being applied to the communications. If both gateways do not support this
option, the VPN fails to establish.

• This option may not be supported by all external gateways, but support is required at both
ends of each tunnel. If both gateways do not support this option, the option is ignored.
• StoneGate IPsec VPN clients are always allowed to use this encapsulation regardless of
this setting.
• NAT-T always uses the standard UDP port 4500
Note – If the external IP address is private and translated to a public IP address by an

external NAT device, make sure Contact Addresses and Locations are correctly defined in
the Firewall properties.
8. If necessary, change the default Contact Address and/or add Exceptions for the
Location(s) of other Gateway(s) involved in the VPN.
• The Contact Address must be defined if the IP address for contacting this Gateway is
different from the IP address the Gateway actually has on its interface (for example,
because of NAT).
• For more information on Locations and Contact Addresses, see Getting Started with
Example An external gateway is behind a NAT device. The real address is defined as the End-Point
address, because the IP address is also used as the Phase 1 ID inside the encrypted traffic.
Contact must be made using the translated address, so it is defined as a Contact Address.
9. In the Phase-1 settings, select the ID Type for your preferred option.
• The ID identifies the Gateways during the IKE phase 1 negotiations.
• The Distinguished Name type is only valid in certificate-based authentication.
• The IP Address type is not valid for end-points with a dynamic IP address. IP address may
not work as an ID if the address is translated using NAT.
10.Enter an ID Value of the correct type. The value for the IP Address type is filled in
automatically according to the IP address you defined for this end-point.
• Make sure that the ID Value matches the identity configured on the external gateway
device.
What’s Next?
 If you want to use certificate authentication and you want to limit which of the
Certificate Authorities you define in the system this Gateway considers trusted,
continue in Defining Trusted CAs for a Gateway (page 726).
Defining Trusted CAs for a Gateway

Certificate Authorities (CA) verify certificate authenticity with their signatures. Gateways accept
certificates only from specifically configured trusted CAs. By default, the Gateways trust all VPN
CAs that are currently defined in the system, but you can restrict the trusted CAs as instructed
here. You can alternatively or additionally restrict trusted CAs also in the VPN Profiles.
For external gateways, the system uses the trusted CA definition in the External Gateway
element to check that all gateways have the necessary certificates.
 To define CAs trusted by a Gateway

1. Switch to the Trusted CAs tab in the Gateway properties.

2. Select the Limit Trusted Certificate Authorities options:
Option Description
The gateway accepts any valid CA that is configured in your system, unless
Trust All Defined
restricted in the VPN element.
Restricts the trusted CAs and activate the controls below and select Enabled
Trust Only Selected
for the CAs that the Gateway needs to trust.
What’s Next?
 If you are creating an Internal Security Gateway and you plan to use VPN Clients to
establish VPNs with this Gateway, continue in Defining Gateway-Specific VPN Client
Settings (page 727).
Defining Gateway-Specific VPN Client Settings

The Internal Security Gateway element contains settings for assigning valid IP addresses to VPN
clients for connections through the VPN to the internal network. If you use StoneGate IPsec VPN
clients, you should configure the Virtual Adapter, since the alternative NAT Pool method does
not allow the StoneGate IPsec VPN client computers to use your organization’s internal DNS
servers. Virtual IP addressing works with all StoneGate VPN client versions and with third-party
VPN clients that support this feature.
For full information on all configuration options, see Managing VPN Client IP Addresses
(page 785).
Note – The Virtual Adapter IP addresses must be assigned by an external DHCP server. It
is not possible to set up the IP addresses in the VPN client or in the Gateway configuration.
It is not possible to use the internal DHCP server on single firewalls to assign the IP
addresses for Virtual Adapters.
 To configure the VPN client settings (for StoneGate IPsec VPN clients)
1. Switch to the VPN Client tab in the Gateway properties.

Illustration 50.7 Internal Security Gateway Properties - VPN Client
2. Select Virtual IP Address (using Virtual adapter). The other options in the dialog are
enabled.
3. Configure the settings as explained in the table below:
Setting Configuration
Select this option to make the firewall/VPN engine respond to ARP requests for
Use Proxy ARP the virtual IP address range. Click IPv4 Address Ranges to select the address
range to define the scope for this option (all virtual IP addresses).
Restrict Virtual (Optional) Select this option and click IPv4 Address Ranges to select the
Address Ranges addresses that the DHCP server is allowed to assign.
Select this option to define DHCP settings for the VPN clients. Click the DHCP
Use DHCP Servers button and select the correct external DHCP Server that assigns the IP
addresses.
Firewall Advanced Deselect Translated IP Addresses (using NAT Pool) if the option is selected.
Settings This disables the NAT Pool feature on the firewall.

Setting Configuration
(Optional) Select this option to force the use of unicast DHCP relay messages
even if the DHCP server is in a directly connected network in relation to the
firewall engine. By default, the firewall/VPN engine sends a normal DHCP client
broadcast message to a DHCP server that is in a directly connected network.
Use Local Relay
Select the option for what additional information to add to the messages. Select
the NDI for DHCP Relay to be used as the source address for the DHCP packets
when querying the DHCP server (the interface towards the DHCP server), and
adjust the Max Packet Size if necessary in your network.
(Optional) Select the Backup Gateways that StoneGate IPsec VPN client version
5.1 and higher use if this gateway is unavailable and organise them in the order
you want them to be contacted. This removes the need for the user to launch new
Backup Gateway connections to different gateways manually.
Each switchover launches a prompt that allows the user to confirm the switchover.
If the backup gateway’s certificate authority is not trusted, the user can manually
approve the certificate fingerprint and continue.
What’s Next?
 Continue the configuration by Defining Sites for VPN Gateways (page 729).
Defining Sites for VPN Gateways

Prerequisites: Creating a New Security Gateway Element
You must define Sites for all Internal and External Gateways. The Site element defines the
internal IP addresses that send or receive traffic through the VPN:
• Connections are only allowed to use the VPN if the source and destination IP addresses are
included in the Sites of the Gateways involved. Other traffic is rejected.
• If you activate NAT for tunneled traffic, you must add the translated addresses in the Site
definitions to make those IP addresses valid to be used in the VPN tunnel.
• The addresses must be unique at each end of a VPN tunnel. Use NAT to create unique
address spaces if the addresses overlap.
• If you use a Gateway in several VPNs, only complete Site elements can be included or
excluded on a VPN-to-VPN basis. All addresses in a Site are always included and excluded
together.
• For internal Gateways, an automatic Site element is available and enabled by default. The IP
address definitions of the automatic Site are created and updated based on routing
definitions. However, NAT addresses must always be added manually.
Defining Sites for VPN Gateways 729

The IP address information is also checked in the VPN establishment phase. When creating
VPNs with external Gateways, make sure the IP address spaces of both gateways are defined
identically in StoneGate and on the external device, or the VPN establishment may fail in one or
both directions. With internal Gateways, make sure to update the policies of both firewalls when
there are (automatic or manual) changes in the Sites at either end.
What’s Next?
 To turn automatic Site management off or on for an internal gateway, see Disabling/Re-
Enabling Automatic VPN Site Management (page 730)
 To continue with the automatic SIte (Internal Gateways) configuration, proceed as
explained in Adjusting Automatic VPN Site Management (page 731).
 To define the IP addresses for an external security gateway element, see Defining
Protected Networks for VPN Sites (page 732).
Related Tasks
 Adding a New VPN Site (page 731).
 Disabling a VPN Site Temporarily in All VPNs (page 733)
Disabling/Re-Enabling Automatic VPN Site Management

Automatic Site management is active by default on all new Internal Gateways. Automatic Site
management copies the internal IP addresses from the routing view (all interfaces except those
with the “Any Network” element attached) and continuously keeps the information up-to-date as
you make changes to routing. If you prefer not to update the information automatically for any
interface, you can disable this feature completely as instructed below. Alternatively, you can
disable this feature just for selected interfaces as explained in Adjusting Automatic VPN Site
 To disable/re-enable automatic Site management

1. In the internal Gateway element properties, switch to the Sites tab.
2. Deselect/select the Include and Update Addresses Based on Routing option.
• When the option is not selected, you must manually define the addresses that you want
to be routable through the VPN.
• When the option is selected, the Site content updates automatically according to changes
made in the corresponding firewall’s Routing view (for those interfaces that are not
disabled).
When you disable the automatic site management, the automatic Site is completely removed.
There must be some other Site configured for the Gateway for it to be valid in a VPN.
What’s Next?
 To define Sites manually, continue by Adding a New VPN Site (page 731).

Adjusting Automatic VPN Site Management
By default, Automatic Site Management is active for all new Internal Gateways. This adds a Site
element for your Gateway that copies interfaces and networks from the Routing view to your VPN
Gateway definition and updates them whenever the Routing view is changed. You can modify this
automatic Site in the following ways:
• You can disable individual interfaces through their right-click menu. This way, you can exclude
some of the internal interfaces from VPNs.
• You can add addresses to the automatic Site at the top level (at the same level with the
Interface elements that hold the automatic content, not inside them) by dragging and
dropping the correct Networks or other elements.
• You can add additional Sites for the Gateway alongside the automatic Site. See Adding a New
VPN Site (page 731).
• You can mark the automatic Site as Private in some VPNs. See Adjusting VPN-Specific Site
Settings (page 732).
What’s Next?
 If you plan to translate the IP addresses of the local hosts that communicate through
the VPN, add the addresses used in NAT in the Gateway’s Site definition and mark the
Sites that contain the original addresses as private (see Adjusting VPN-Specific Site
Settings (page 732)).
 To continue configuring a new VPN without defining further settings for the Site, add all
necessary Site and Gateway elements, then either configure a new set of IPsec settings
as explained in Defining VPN Profiles (page 734) or configure the VPN with an existing
set of settings as explained in Defining a VPN Element (page 742).
Adding a New VPN Site

You can add as many Site elements as you need to a Gateway. By default, each Site is included
in all VPNs where the Gateway is used, but individual Sites can be manually disabled in any VPN
without affecting the other VPNs. It is not possible to partially disable Sites; if the IP address
space must vary between different VPNs, you need several Sites.
 To add a new Site element

1. Switch to the Sites tab in the Gateway element properties.
2. Right-click in the panel on the right and select NewSite. The Site Properties dialog opens.
3. Enter a Name and optionally a Comment for your reference.
What’s Next?
 Continue the configuration in Defining Protected Networks for VPN Sites.

Defining Protected Networks for VPN Sites
The IP addresses configured for a Site define the addresses that are allowed to communicate
through the VPN tunnel (the encryption domain of each gateway). If traffic in the tunnel is subject
to NAT, you must add the NAT addresses to the Site. On Internal Gateways, the NAT addresses
are in addition to the untranslated IP addresses. External Gateway Sites only require the
translated address space that the Internal Gateway actually sees.
The local and remote Site definitions must match the same information on the other gateways
involved in the VPN because the gateways verify this information. Note that it may also make a
difference whether addresses are entered as individual IP addresses, address ranges, or
networks.
Note – Site definitions are applied globally to every VPN in which the Gateway is used,
unless you specifically adjust this in the VPN-specific Site settings.
 To add networks to a Site element

1. Check that you are on the General tab in the Site element’s properties.
2. Select the elements that represent the protected IP addresses behind the Gateway in the
left panel and click Add to include them in this Site.
• Addresses outside the Gateway’s local networks should generally not be included in the
Site in most configurations. There is no need to include the Gateways’ own IP addresses
in the Sites, but there is usually no need to specifically exclude those addresses if they
happen to be in the networks you add to the Site.
• IP address ranges may be interpreted differently from lists of IP addresses and networks
depending on the VPN device. Note that StoneGate converts Group or Expression
elements into address ranges, networks, or individual IP addresses depending on the IP
addresses included. Other VPN devices may treat same types of values differently.
If you edited a previously configured VPN, refresh the policy on all affected gateways to transfer
the changes, but make sure that the configuration of any external VPN gateway device involved
also contains the same IP address information.
What’s Next?
 Continue the Site configuration by Adjusting VPN-Specific Site Settings (page 732).
Adjusting VPN-Specific Site Settings

Site elements allow you to adjust how the Site is used in each VPN.
 To adjust the VPN references of a Site

1. In the Site element properties, switch to the VPN References tab.
2. In the table, select/deselect the Enable option for the existing VPNs displayed to include/
exclude the Site from the configuration. When the Site is disabled, it is greyed out.
Example You can disable a Site that contains translated address in VPNs in which NAT is not used, or
in which a different address space is used for translation.

3. Select the Mode for the Site for each VPN in which it is enabled.
• Normal mode is the default. Use this for all active Site elements that do not require one
of the other two modes.
• Hub mode is used on a hub Gateway in tunnel-to-tunnel forwarding. Hub mode Sites
contain the IP addresses of the networks that are behind the remote spoke gateways (the
networks between which the hub Gateway forwards traffic). The automatically generated
Site cannot be used as a Hub Site.
• (Internal Gateways only) Private mode is used for the local untranslated addresses when
addresses are translated using NAT in the VPN. You must include the translated IP
addresses (the addresses that the other end sees) as a Normal-mode Site element in
these types of VPNs. If NAT is disabled in the VPN, any Sites in the Private mode are
ignored.
What’s Next?
 Add all necessary Site and Gateway elements, then either configure a new set of IPsec
settings as explained in Defining VPN Profiles (page 734) or configure the VPN with
existing settings as explained in Defining a VPN Element (page 742).
Disabling a VPN Site Temporarily in All VPNs

These instructions are for disabling a Site that has been manually added to the Gateway. The
Site is disabled globally in all VPNs. To disable the automatic Site for an Internal Gateway, see
Disabling/Re-Enabling Automatic VPN Site Management (page 730).
 To disable a Site element globally

1. Open the Gateway element’s properties and switch to the Sites tab.
2. Right-click the Site (the top-level element) and select Disable. The Site is greyed out to
indicate that it is disabled in all VPNs in which this Gateway is used.
the changes. The configurations of external Gateways may also require an update.
What’s Next?
 There must be at least one enabled site. To add a new Site, see Adding a New VPN Site
(page 731).
 To continue without modifying the SItes, proceed as explained in the What’s Next
section in Defining Protected Networks for VPN Sites (page 732).
Related Tasks
 Adjusting VPN-Specific Site Settings (page 732)
 Defining VPN Topology (page 744)

Removing a VPN Site Permanently from All VPNs
These instructions are for removing a Site that has been manually added to the Gateway. The
Site is removed from all VPNs where the Gateway is used. To remove the automatic Site from an
Internal Gateway, see Disabling/Re-Enabling Automatic VPN Site Management (page 730).
 To remove a Site element from a Gateway element

1. Open the properties of the Gateway element and switch to the Sites tab.
2. Right-click the Site and select Remove. The Site is removed from this Gateway and deleted
from all VPNs.
the changes. The configurations of external Gateways may also require an update.
Defining VPN Profiles

Prerequisites: None
Each VPN refers to a VPN Profile. The VPN profile is the main point of configuration for IPsec
VPN integrity checking, authentication, and encryption settings. The VPN Profile also contains
some settings for VPN clients.
Several VPNs can use the same VPN Profile. There are predefined profiles in the system, which
are mostly useful for VPNs between internal Gateways. Client-to-gateway VPNs generally require
a custom profile.
What’s Next?
 To create a new VPN profile, continue in Creating a New VPN Profile (page 734).
 To modify an existing custom-made profile, continue in Modifying an Existing VPN Profile
(page 735).
 If you want to use an existing VPN Profile without editing it, continue in Defining a VPN
Element (page 742).
Creating a New VPN Profile

 To create a new VPN Profile
opens.
Illustration 50.8 VPN Profiles in the Element Tree

2. Expand the Other ElementsProfiles branch in the element tree.
3. Right-click VPN Profiles and select New VPN Profile. The VPN Profile Properties dialog
opens.
4. Give the new profile a Name and optionally a Comment.
What’s Next?
 Continue by Defining IKE (Phase 1) Settings for a VPN (page 735).
Modifying an Existing VPN Profile

Before editing a VPN Profile that is used in active VPNs, we recommend backing up the settings
(by duplicating the element, exporting it, or creating a Management Server backup). After editing
a VPN profile that is used in active VPNs, check all VPNs that use the profile for any possible
Issues that the changes may have caused.
 To modify a VPN Profile

opens.
2. Expand the Other ElementsProfilesVPN Profiles branch in the element tree.
3. Double-click the profile you want to edit. The VPN Profile Properties dialog opens.
4. (Optional) Change the profile’s Name and optional Comment. If you change the name, it is
changed in all configurations without any need for further action.
5. Edit the other properties as instructed in the sections listed below.
What’s Next?
 Defining IKE (Phase 1) Settings for a VPN (page 735)
 Defining IPsec (Phase 2) Settings for a VPN (page 737)
 Defining VPN Client Settings (page 740)
 Defining Trusted CAs for a VPN (page 742)
Defining IKE (Phase 1) Settings for a VPN

The options you choose are a balance between performance and security. A higher level of
security generally requires more processing power. If external gateways are involved, you must
make sure that all settings match between the gateways.
 To define IKE (Phase 1) Settings for a VPN

1. Switch to the IKE (Phase 1) tab in the VPN Profile Properties dialog.
Defining VPN Profiles 735

Illustration 50.9 VPN Profile Properties - IKE (Phase 1)
2. Select the Cipher Algorithm(s) (encryption method) to use in the VPN. We recommend that
you limit the selection to as few choices as possible, preferably only one. If you make
multiple choices, multiple proposals are sent in IKE negotiations.1
• Choose the method(s) according to your company’s requirements and the algorithms
supported by the gateways. Consider the sensitivity of the transferred information and
any regulations that you may have to follow.
computers.
required.
3. Select the Message Digest Algorithm(s) (integrity checking method) to use in the VPN. We
recommend that you select just one of these options if you have no specific reason to
select more.
4. Select the Diffie-Hellman Group (for key exchange) to use in the VPN. We recommend that
you select either 2 (1024 bits) or 5 (1536 bits). Group 1 is not a secure option in all
configurations.
5. Select the Authentication Method:
• DSS Signatures and RSS Signatures use certificates for authentication and require that
each Gateway has a valid certificate.
• Pre-Shared Key requires that you periodically change the pre-shared keys for each tunnel
in the VPN elements to be secure.
Note – The authentication method you select here is used for gateway-to-gateway VPNs.
Client-to-gateway VPNs have separate settings on the VPN Client tab.

6. Adjust the IKE Phase 1 SA Lifetime if you have a particular need to do so. The default
lifetime is 120 minutes.
• This setting affects tunnels that carry traffic continuously. Tunnels that are not used are
closed after a short delay regardless of the lifetime set here.
• If the VPN is continuously used and the lifetime passes, the Phase 1 negotiations are
done again.
• Renegotiations improve the security, but may require heavy processing, and may
sometimes cause slight delays in communications.
• There is a separate setting for the Phase 2 lifetime on the IPsec (Phase 2) tab. The Phase
1 lifetime must be longer than the Phase 2 lifetime.
7. Select the Negotiation Mode:
Mode Description
Main negotiation mode (recommended) protects the identity information of the Gateways
Main so that malicious parties cannot gain information on the Gateway’s identity by launching
IKE negotiations with the gateway.
Aggressive negotiation mode skips some steps that are included in the main mode,
resulting in somewhat quicker negotiations. For security reasons, we recommend that you
do not use the aggressive negotiation mode if you use pre-shared keys for authentication.
Aggressive
You must select Aggressive mode for VPNs that involve a gateway with a dynamic IP
address. In this case, we recommend you use certificates for authentication rather than
pre-shared keys
What’s Next?
 Continue by Defining IPsec (Phase 2) Settings for a VPN (page 737).
Defining IPsec (Phase 2) Settings for a VPN

The options you choose are a balance between performance and security. A higher level of
security generally requires more processing power. If external gateways are involved, you must
make sure that all settings match between the gateways.
 To define IPsec (Phase 2) Settings for a VPN

1. Switch to the IPsec (Phase 2) tab in the VPN Profile Properties dialog.

Illustration 50.10 VPN Profile Properties - IPsec (Phase 2)
2. Select the IPsec Type:

• The recommended setting is ESP (the communications are encrypted).
• In most cases, AH is not a valid option. The AH setting disables encryption for the VPN,
fully exposing all traffic that uses the VPN to anyone who intercepts it in transit. You can
use AH to authenticate and check the integrity of communications without encrypting
them.
3. Select the Cipher Algorithm(s) (encryption method) to use in the VPN. We recommend that
you limit the selection to as few choices as possible, preferably only one.2
• Choose the method(s) according to your company’s requirements and the algorithms
supported by the gateways. Consider the sensitivity of the transferred information and
any regulations that you may have to follow.
• Do not select the Null option unless you want to disable encryption. This option fully
exposes all traffic that uses the VPN to anyone who intercepts it in transit. You can use
Null encryption to authenticate and check the integrity of communications without
encrypting them.
computers.
required.
4. Select the Message Digest Algorithm(s) (integrity checking method) to use in the VPN. We
recommend that you select just one of these options if you have no specific reason to
select more.

5. Select the Compression Algorithm to use in the VPN:
• Deflate (not supported in Firewall/VPN versions 4.2 and 4.3) compresses the data to
reduce the bandwidth use on congested links. This requires processing and memory
resources, which increases latency. Latency may increase also for non-VPN traffic. Do not
select this option if the resource utilization is very high to begin with. Gateways at both
ends of each tunnel involved must support the option.
• None (recommended for most environments) sends the data without compressing it.
Provides better performance when bandwidth congestion for VPN traffic is not a constant
issue or if there is significant processor load to begin with. The only supported option for
Firewall/VPN versions 4.2 and 4.3.
6. (Optional) Adjust the IPsec Tunnel Lifetime if you have a particular need to do so. The
default is 30 minutes with no limit on transferred data.
• Reaching either of the limits triggers new Phase II negotiations, which must happen at
regular intervals for the sake of security.
• This setting affects tunnels that carry traffic continuously. Tunnels that are not used are
closed after a short delay regardless of the lifetime set here.
• Phase 2 negotiations are lighter on the processor than Phase 1 negotiations, but still
require some processing. Too frequent renegotiations can reduce performance down to
unacceptable levels.
• There is a separate setting for the Phase 1 lifetime on the IKE (Phase 1) tab. The Phase 1
lifetime must be longer than the Phase 2 lifetime.
7. Select the Security Association Granularity for VPN traffic. The IPsec SAs can be created
for each communicating IP network or host.
• SA per Net creates a security association (SA) for each network from which connections
are made through the VPN. This setting reduces the overhead when there are a large
number of hosts making connections through the VPN.
• SA per Host creates a SA for each host that makes connections through the VPN. This
setting may provide more eaven load balancing in clusters than the Per Net setting, but
increases the overhead, as Per Host usually requires that more SAs are negotiated.
8. (Optional) Select Use PFS with Diffie-Hellman Group to use Perfect Forward Secrecy (PFS)
and select the Diffie-Hellman Group you want to use with PFS.
• When you use this option, the gateways calculate completely new values for key
negotiations when renegotiating the SAs instead of deriving the values from previously
negotiated keying material. This increases security if a key is compromised.
• We recommend using either Group 2 (1024 bits) or Group 5 (1536 bits).
9. (Optional) Select Disable Anti-Replay Window if you have a particular need to do so.
• The anti-replay window feature provides protection against attacks in which packets are
replayed. When the anti-replay window is enabled, the gateway keeps track of the
sequence numbers of the arriving packets, and discards any packet whose number
matches the number of a packet that has already arrived.
• It is usually recommended to leave the anti-replay window enabled. However, if you use
QoS and QoS is applied to ESP/AH traffic, some of the ESP packets (for the same SA)
may be delayed because of the classification and arrive at the destination so late that the
anti-replay window has moved too far. This causes the packets to be dropped. In this
case, it may be necessary to disable the anti-replay window.

10.(Optional) Select Disable Path MTU Discovery to prevent the gateway from sending ICMP
“Fragmentation needed” messages to the originator when the packet size (including the
headers added for IPsec) exceeds the Ethernet-standard 1500 bytes.
• If this option is selected, packets may be fragmented for transport across the VPN and
reassembled at the receiving gateway.
• Selecting the option may be necessary if ICMP messages do not reach the other gateway
or the other gateway does not react to them correctly.
What’s Next?
 If this Profile is used for client-to-gateway VPNs, continue in Defining VPN Client Settings
(page 740).
 If you use certificates for authentication and you want to restrict trusted certificate
authorities at the VPN level, continue in Defining Trusted CAs for a VPN (page 742).
 Otherwise, click OK and continue in Defining a VPN Element (page 742).
Defining VPN Client Settings

VPN Client settings are selected on the VPN Client tab in VPN Profiles. These options affect all
VPN client connections and override any overlapping options on other tabs.
 To define VPN Client Settings

1. Switch to the VPN Client tab in the VPN Profile Properties dialog.
Illustration 50.11 VPN Profile Properties - VPN Client
2. Select the Authentication Method for certificate-based authentication.

• This option is always used for the Gateway certificates for the Gateways involved in client-
to-gateway VPNs, and if certificate authentication is used, also for the client.
• Certificate authentication does not need separate activation. However, you must configure
the issuing authority separately as trusted and you must create certificates for the VPN
clients in a manual process.

3. (Optional, StoneGate VPN Clients only) Select Hybrid Authentication if you want to allow
users of the StoneGate IPsec VPN Client to authenticate by filling in a username/password
combination or a similar authentication scheme provided by an external authentication
server. The gateway still authenticates itself to the VPN clients using a certificate.
4. (Optional, certificate authentication only) Select Allow CN Authentication to allow using the
common name of the certificates for authentication. The CN is checked against a value
entered in the User elements.
5. (Optional) Select Allow Pre-Shared Key Authentication if you have third-party VPN clients
that use a pre-shared key for authenticating the VPN clients and the gateway. The pre-
shared key is defined at the VPN tunnel level in the VPN properties. StoneGate clients do
not support this method.
Caution – The pre-shared key option requires aggressive mode IKE negotiations in the
client-to-gateway VPN. In aggressive mode, user information is not protected, so we
recommend you take precautions such as not using the same username for the users as
they have when they access other services in your internal network.
6. Select the Security Association Granularity for VPN traffic. The StoneGate IPsec VPN
Client supports only the SA per Net option.
Option Description
Creates a security association (SA) for each network from which connections are
SA per Net made through the VPN. This setting reduces the overhead when there are a large
number of hosts making connections through the VPN.
Creates a SA for each host that makes connections through the VPN. This
setting may provide more even load balancing in clusters than the Per Net
SA per Host setting if there are many clients connecting from the same network, but
increases the overhead significantly if there are connections from many IP
addresses.
Select this option together with SA per Net to support both StoneGate IPsec
Allow SA to Any
VPN Clients and any third-party VPN clients that only support SAs negotiated per
Network
Host.
7. (Optional) Activate any combination of basic Local Security Checks for StoneGate IPsec
VPN Client version 5.0 and above.
• Activating these options does not affect older versions of StoneGate IPsec VPN Clients or
third-party VPN clients; their connections are allowed as usual.
• The selected types of external security software must be operational as reported by the
Windows Security Center on the client computer; otherwise the connection attempt will
fail. The check is performed after the user has successfully authenticated.
• All client security checks are for on/off status of the external security software only; the
checks do not include the update status of virus definitions or if any Windows updates
have actually been installed.
• If the security check fails, the IPsec VPN Client notifies the user on which checks have
failed in a balloon message in the Windows Task Bar.

What’s Next?
 If you use certificates for authentication and you want to restrict trusted certificate
authorities at the VPN level, continue in Defining Trusted CAs for a VPN (page 742).
 Otherwise, click OK and continue in Defining a VPN Element (page 742).
Defining Trusted CAs for a VPN

If you want to use certificates signed by a particular CA (certificate authority), you must define
the CA as an element in the system. By default, all VPN CAs defined in the system are
considered trusted, but you can restrict the trusted CAs for particular VPNs as instructed here.
You can alternatively (or additionally) restrict trusted CAs also in the Gateway elements. If you
restrict trusted CAs in both the Gateway and the VPN Profile, make sure that any two Gateways
that form a VPN tunnel have a common CA to trust after all defined restrictions are applied (this
is also automatically validated).
 To define trusted certificate authorities

1. Switch to the Certificate Authorities tab in the VPN Profile Properties dialog.
2. Select the Trust Only Selected option to restrict the trusted CAs and activate the controls
below.
3. Select the CAs that you want to be considered as trusted in the VPNs that use this profile.
4. Click OK.
What’s Next?
 Continue by Defining a VPN Element.
Defining a VPN Element

Prerequisites: Defining Security Gateways
The VPN element collects together a set of other VPN-related elements to define settings for a
particular VPN instance. The main configuration for the VPN consists of defining which Gateways
are in the VPN and which of the Gateways form tunnels with each other. This is also where you
can enter and renew pre-shared keys if you use them for authentication in this VPN.
Consider the following when creating new VPN elements:
• Check whether you can utilize an existing VPN element instead. Most settings can be set
individually for each gateway-to-gateway pair even within a single VPN. The VPN Profile, pre-
shared key, and Multi-Link settings can all be selected separately for each VPN tunnel. Site
definitions are the only major exception to this rule; each Gateway’s Sites are fixed within
each VPN element.
• There must not be duplicate tunnels (two tunnels between the same two end-points) in the
configuration of any firewall/VPN engine. Duplicate tunnels cause a policy installation failure.
The easiest way to avoid duplicate tunnels is to define all VPNs between your internal
gateways in the same VPN element.

• If you are creating VPNs with partner organizations, you may only want to include a subset of
the internal IP address space in the VPN definitions to avoid having to reveal all internal
addresses to your partner. Any cases where Site definitions must be different for different
VPN tunnels requires creating separate VPN elements.
When you configure the VPN element, the validity of the VPN is automatically checked. If
problems are found, they are shown in the Issues view. While useful in many cases, the
automatic check does not detect all problems, especially regarding external gateways or
interference between several separate VPN elements.
What’s Next?
 To add a new VPN to the system, see Creating a New VPN Element (page 743).
 To modify the contents of an existing predefined or custom VPN element, see Modifying
an Existing VPN Element (page 744).
Creating a New VPN Element

The configuration of a new VPN element has two stages: first you define some basic properties
for the element as explained here, and then you can proceed to populating the element with
Gateways and adjusting the tunnels in the VPN editing view.
 To create a new VPN element

opens.
2. Right-click the VPNs branch in the tree and select New VPN. The VPN Properties dialog
opens.
3. Enter the Name and optionally a Comment for the VPN element.
4. Select the VPN Profile that you want to use as the default profile within this VPN. By
default, this profile is used for all tunnels, but you can override the selection for individual
tunnels.
5. (Optional) Select Apply NAT Rules to Traffic That Uses This VPN if you want the NAT rules
in the FIrewall/VPN engine’s policy to apply to traffic that it sends into or receives from the
VPN, or if you want to use the NAT Pool feature to translate VPN Client connections.
• The option affects the traffic that is transported inside the tunnels.
• This option does not affect the tunnel negotiations or the encrypted packets between
gateways. These communications are always matched to NAT rules.
Defining a VPN Element 743

6. Click OK. The VPN opens in the editing view.
What’s Next?
 Continue by Defining VPN Topology (page 744).
Modifying an Existing VPN Element

The VPN element can be configured in two ways: the basic properties for the element including
the VPN Profile and a NAT option are defined in the VPN element’s properties. All other settings,
including the included Gateways, Sites and tunnels are configured in the VPN editing view.
 To modify an existing VPN element

opens.
2. Expand the VPNs branch in the element tree.
3. Open the correct view for the settings you want to edit:
• To edit the basic properties, right-click the VPN element and select Properties. See the
explanations in Creating a New VPN Element (page 743) if you need help with the
options. Note that you will need to open the editing manually (see below) after changing
the basic settings if necessary - the editing view does not open automatically in this case.
• To adjust the other settings, right-click the VPN element and select Edit. Continue the
configuration in Defining VPN Topology (page 744) or Defining VPN Tunnel Settings
(page 746) according to which settings you want to change.
Defining VPN Topology

The VPN element editing view has two tabs. The Gateway selection on the Overall Topology tab
determines which Gateways are included in the VPN, which of them form tunnels with each
other, and which gateways contact each other through a hub gateway instead of contacting each
other directly. The general VPN topology is defined by classifying Gateways as Central or
Satellite. This classification defines which tunnels are generated on the Tunnels tab, on which
you can then further disable any unnecessary tunnels that may be generated.
For a valid VPN, you must have at least two Gateways included in the VPN and at least one of
the Gateways must be listed as a Central Gateway. The Satellite Gateways panel can be left
empty (for a full-mesh topology).
IPv4 Access rules control which connections use the VPN tunnels. Always remember to check
the Access rules after you add or remove tunnels.
Note – Each end-point-to-end-point tunnel can only exist in one active VPN. If you use the
same two Gateway elements in more than one VPN, make sure the topology does not
create duplicate tunnels and/or disable any duplicates of existing tunnels on the Tunnels
tab.
 To define the VPN topology

1. Check that you have the Overall Topology tab active in the VPN element in the editing
mode (see Modifying an Existing VPN Element (page 744) for instructions on how to open
the VPN in editing mode).

2. Drag and drop the Gateways you want to include in this VPN into either of the two panels for
the VPN topology.
• If you add a Gateway under Central Gateways, the Gateway can establish a VPN with any
other Gateway in the VPN and the Tunnels tab is populated with tunnels between the
endpoints of the Gateway you add and the endpoints of all other Gateways in the VPN.
• If you add a Gateway under Satellite Gateways, the Gateway can establish a VPN only
with Central Gateways in this VPN and the Tunnels tab is populated with tunnels between
the endpoints of the Gateway you add and the endpoints of the Central Gateway(s).
• The Issues panel alerts you to any incompatible or missing settings you must correct.
Note – Be careful to not unintentionally drop Gateways on top of other Gateways. This
indicates a forwarding relationship on a hub gateway (see the next step below).
3. (Optional) If you want to forward some connections from one VPN tunnel into another
through a hub gateway, drag and drop a Gateway on top of another Gateway. The gateway is
added under the other gateway at the same level as the Sites.
• Full support for this feature requires that the hub gateway is running firewall/VPN version
5.0 or higher.
• See Configuration 4: Basic VPN Hub (page 709) for a VPN hub configuration example.
• The Gateway used as a hub requires a special Site configuration, see Defining Protected
Networks for VPN Sites (page 732) and Adjusting VPN-Specific Site Settings (page 732).
Example In a setup in which VPN client users can connect to networks behind both Gateway A and
Gateway B when they connect to Gateway A, you would drop Gateway B on top of Gateway A
in the Central Gateways list and add the Client Gateway to Satellite Gateways.
4. (Optional) To allow VPN client access within this VPN, drag and drop the default IPsec
Client Gateway element to Satellite Gateways or Central Gateways.

5. (Optional) If you want to exclude a Gateway’s Site (some IP addresses) from this VPN, right-
click the Site element under the Gateway and select Disable.
What’s Next?
 Continue by Defining VPN Tunnel Settings.
Defining VPN Tunnel Settings

The Tunnels tab in the in the VPN element editing view allows you to define settings particular to
individual tunnels or disable some tunnels altogether. The topology of the VPN (defined on the
Overall Topology tab) determines which tunnels are shown on the Tunnels tab.
If an Internal Gateway has a Multi-Link VPN configuration, you can select whether to use tunnels
as backups or actively balance traffic between them. Multi-Link is a StoneGate-specific feature
that is not part of the IPsec standard, so you may not be able to use Multi-Link with third-party
gateways. Satisfactory results can be achieved if the third-party gateway allows ICMP probes,
RTT ICMP probes, and supports DPD. You can disable redundant tunnels to the third-party
gateway on this Tunnels tab if required.
Note – Multi-Link is not supported with SOHO firewall/VPN gateways. You can select the
tunnel that is used and avoid seeing reminders about this at policy installation by disabling
the redundant tunnels.
This is also where you can view the proxy identities (a summary of addresses and settings that
have been configured for individual tunnels), which you may want to check especially when there
are complex setups involving external components (such as a VPN hub configuration).
Before modifying a VPN element that is used in active VPNs, we recommend making a backup of
the Management Server as instructed in Creating Backups (page 795).
 To define VPN tunnel settings

1. Switch to the Tunnels tab in a VPN element in the editing mode (see Modifying an Existing
VPN Element (page 744) for instructions on how to open the VPN in editing mode). The list
of tunnels is displayed.
Illustration 50.14 VPN Editing View - Tunnels
• If no tunnels are listed, see Defining VPN Topology (page 744).

• The Gateway<->Gateway list shows connections between pairs of gateways.
• The End-Point<->End-Point list shows the individual connections that form the tunnels in
the Gateway<->Gateway list. There can be several connections at this level for any
Gateway pair if one or both of the Gateways have multiple endpoints (Multi-Link). If both
Gateways have only one endpoint, there is only one tunnel also at this level for the
Gateway pair.
• If you have set up connection forwarding between the Gateways on the Overall Topology
tab, the number of generated tunnels is reduced according to the relationships configured

and the capabilities of the Gateway that forwards the traffic. The forwarding relationships
are shown under Forwarding Gateways.
2. (Optional) If there are tunnels listed that are not needed, right-click the tunnel and select
Disable.
• Duplicate tunnels are not allowed between VPNs. If some other VPN already defines a
tunnel between the same end-points as some tunnel in this VPN, you must disable the
duplicate tunnel in one of the VPNs.
• SOHO Firewalls do not support Multi-Link tunnels and the configuration will randomly use
one of the available Multi-Link tunnels. If you want to use a particular tunnel, disable the
other tunnels on the End-Point<->End-Point level.
3. If you use pre-shared keys for authentication with external gateways, either set the key
agreed with your partner or export the keys that have been automatically generated for your
partner to use.
• To view, change, or export the pre-shared key for a particular tunnel, double-click the key
icon in the Key column in the Gateway<->Gateway list.
• This pre-shared key is used only with gateway devices. Set pre-shared keys for third-party
VPN clients in the User elements (StoneGate VPN clients do not allow pre-shared key
authentication).
the pre-shared key periodically (for example, monthly). Make sure that it is not possible for
outsiders to obtain the key while you transfer it to other devices.
4. (Optional) Change the VPN Profile used at the tunnel level to override the profile selected
for the VPN element:
• If you change a profile for a tunnel on the Gateway<->Gateway list, both IKE (Phase 1)
and IPsec (Phase 2) settings are overridden from what is default for the VPN.
• If you change a profile for a tunnel on the End-Point<->End-Point list, only the IPsec
(Phase 2) settings are overridden from what is selected for the main tunnel on the
Gateway level.
5. (Optional, does not apply to SOHO firewalls) If you have multiple tunnels between two
Gateways (Multi-Link configuration), you can select whether End-Point<->End-Point tunnels
use the Active mode (used at all times) or the Standby mode (used only when all Active-
mode tunnels are unusable).
• Select a tunnel on the Gateway<->Gateway list and click the Mode column for tunnels
that appear on the End-Point<->End-Point list to select the correct mode for the tunnels.
• When there are more than one alternative tunnels in Active mode between two Gateways,
the VPN traffic is load-balanced between the available tunnels.
6. (Optional) Review the IP addresses and settings used in the individual tunnels by right-
clicking the tunnels on the End-Point<->End-Point list and selecting View Proxy Identities.
This is especially useful in complex configurations that involve external components to
check the IP address details and other settings that must match with the external
configuration.
7. After making all changes, check the Validity column for all tunnels.
• If a tunnel has a warning icon in the Validity column, right-click the tunnel and select View
Issues. You must resolve all problems indicated in the messages shown.
• If all tunnels are shown as valid, the VPN is correctly configured, although the
Management Server cannot check all possible problems at this point, so additional
issues can be shown at policy installation. Any validation and issues that are shown for
external gateways are based only on the definitions that have been entered manually into
the related elements.

8. Click the Save icon above the tunnel lists.
The VPN is now configured, but to direct outgoing traffic to the VPN and allow incoming traffic
from the VPN, you must add VPN Access rules and possibly also NAT rules.
What’s Next?
 If you need to add a trusted certificate authority or certificates that are not generated
automatically, proceed to Getting Started With VPN Certificates (page 756) before
adding VPN rules.
 Otherwise, continue by Creating VPN Rules (page 748).
Creating VPN Rules

Prerequisites: Defining Security Gateways, Defining a VPN Element
The firewall IPv4 Access rules define which traffic is sent to the VPN and which traffic is allowed
out of the VPN. These checks are made in addition to the enforcement of the Site definitions of
the Gateways, which define the allowed source and destination addresses for each VPN.
There are three options for the Use IPsec VPN rule action, which all behave identically for
connections that originate in the local protected network, but which each have a special
meaning for connections coming in from external sources.
• Apply VPN and Enforce VPN both direct traffic from protected local networks into the VPN
tunnel and allow traffic that arrives through a VPN. However:
• Enforce VPN drops any non-VPN traffic from external networks to the local netork if it
matches the rule.
• Apply VPN does not match non-VPN traffic from outside networks into the protected
networks; matching continues from the next rule.
• Forward: Directs traffic from protected local networks or from a VPN tunnel into a VPN tunnel.
Useful for forwarding connections from one VPN tunnel into another (VPN hub configuration)
or connections from local networks to currently connected VPN client computers.
There is also a matching cell for Source VPN in firewall IPv4 Access rules. The cell can be used
to match traffic based on whether the traffic is coming from a VPN tunnel. When the Source VPN
cell is set to match VPNs, the rule only matches traffic from the selected VPNs. The cell can
also be set to only match non-VPN traffic. Access rules that do not have any Source VPN
definition can match any traffic, including traffic that is received through a VPN. However, the
Access rules must contain at least one rule that refers to the VPN (in the Action or Source VPN
cell) for any of the VPN’s settings to be included in the engine’s local configuration.
Note – We recommend that you activate logging for the VPN rules for initial testing even if
you do not plan to log the connections that use the VPN later on. VPN negotiations
between the gateways are always logged.

• Creating Basic VPN Rules for Gateway Connections (page 749)
• Creating Basic Rules for VPN Client Connections (page 750)
• Creating Forwarding VPN Rules on Hub Gateways (page 751)
• Preventing Other Access Rules from Matching VPN Traffic (page 752)
• Creating NAT Rules for VPN Traffic (page 752)

Creating Basic VPN Rules for Gateway Connections
In addition to the traffic that flows through the tunnels, the VPN traffic to form and maintain the
tunnels must be allowed in the policy. The Default template policy allows this traffic, but if you
use a custom top-level template, make sure that at least the ISAKMP (UDP) Service is allowed
between the Gateways (further ports may need to be opened if encapsulation is used).
 To create rules for incoming gateway-to-gateway VPN traffic

1. Insert the following type of rule to allow traffic from a single VPN with an Apply or Enforce
action:
Table 50.1 Basic Rule for Allowing Incoming VPN Traffic from a Single VPN

Select Use IPsec VPN, then change
Remote networks. Local networks. Set as needed. the Action to Apply or Enforce and
add the VPN element.
2. (Optional) Define the following types of rules when you want to match the rule based on
whether traffic is using a VPN:
Table 50.2 Rule for Allowing Incoming VPN Traffic from Any Number of Different VPNs
Source Destination Service Action Source VPN

(Double-click the cell to edit.)
To ignore this rule when processing non-
VPN traffic, activate the Match traffic
Remote Local Set as Select based on source VPN option and add one
networks. networks. needed. Allow. or more specific VPN elements according
to where the traffic is coming from. This
rule does not match traffic from other
sources.
 To create rules for outgoing VPN traffic

 Insert the following types of rule:
Table 50.3 Basic Rule for Outgoing VPN Traffic

Select Use IPsec VPN and add the
VPN element (the Apply, Enforce, and
Local networks. Remote networks. Set as needed.
Forward actions are all identical in this
use).
Note – If Access rules send traffic into a VPN, but the source and/or destination IP
address(es) are not included in the Site definitions, the traffic is dropped. This
configuration error is shown as the message “tunnel selection failed” in the logs.
Creating VPN Rules 749

Creating Basic Rules for VPN Client Connections
In addition to the traffic that flows through the tunnels, the VPN traffic to form and maintain the
tunnels must be allowed in the policy. The Default template policy allows this traffic, but if you
use a custom top-level template, make sure that at least the ISAKMP (UDP) Service is allowed
(further ports may need to be opened if encapsulation is used) from addresses that VPN client
hosts use when contacting the Gateway (ANY or some group of specific known addresses). VPN
client user authentication is also allowed as part of this VPN connection establishment process.
 To create rules for incoming VPN client traffic

1. Insert the following type of rule to allow DHCP queries from VPN clients to a DHCP server
(mandatory for the Virtual Adapter feature):
Table 50.4 Rule for Allowing DHCP Queries from VPN Clients
BOOTPC Select Jump

(Double-click the cell to edit.)
(UDP) and select the
ANY DHCP server. default DHCP Activate the Match traffic based on
BOOTPS source VPN option. Select Rule matches
Relay sub-
(UDP) traffic from any VPN client from the list.
policy.
Note – The DHCP server must be external to the firewall. The single firewalls’ internal
DHCP server cannot be used to assign addresses to the Virtual Adapters.
2. Insert the following type(s) of rule(s) to allow incoming connections from VPNs with VPN
clients.
Table 50.5 Rule for Allowing Incoming Traffic from VPN Clients
Source Destination Service Action Users Authentication

Select Use IPsec
VPN clients’ (Double-click the cell
VPN, then change
Virtual Adapter User or User to edit.)
Set as the Action to
address space Local networks. Group Add allowed
needed. Apply or Enforce
or NAT Pool elements. authentication
and add the VPN
address space. Service(s).
element.
• When a specific VPN and specific Authentication Service(s) are used somewhere in the
installed policy (such as in a rule similar to the one above), the corresponding
configurations are activated on the firewall. But note that all other rules are also matched
to the VPN client user’s connections.
• Any users known to the system who can authenticate using the specified authentication
method can connect with a VPN client. Any such connected users can then access
resources if there is a matching rule that allows connections without specific Users
defined. You can also use the Source VPN cell to prevent unwanted matches in Access
rules.
• When filled in, User and Authentication cells are equal to Source, Destination, and
Service as rule matching criteria; matching continues from the next rule if the defined
User and Authentication Service do not match the connection that is being examined. You

can, for example, define that the same user has access to different resources depending
on the authentication method used.
3. (Optional) To allow internal hosts to open connections to the VPN client computers when the
VPN is active (for example, to allow administrators’ remote desktop connections to the
hosts):
Table 50.6 Rule for Sending Traffic to VPN Clients

VPN clients’ Select Use IPsec VPN. Switch the
Virtual Adapter Action to Forward, then add a specific
Local networks. address space or Set as needed. VPN element or select the $ Client-to-
NAT Pool address gateway IPsec VPNs option to match
space. any VPN client connection.
• To use the VPN, the connecting hosts’ IP addresses must be included in the gateway’s
Site definition. See Defining Sites for VPN Gateways (page 729).
• Remember to also add a NAT rule for this traffic direction if NAT is used inside this VPN’s
tunnels. See Creating NAT Rules for VPN Traffic (page 752).
Creating Forwarding VPN Rules on Hub Gateways

For a configuration example of creating a VPN hub, see Configuration 4: Basic VPN Hub
(page 709).
 To create rules for forwarding VPN traffic from one tunnel to another
 Insert the following type of rule:
Table 50.7 Basic Rule for Forwarding VPN Traffic

One/some/all One/some/all
Select Use IPsec VPN, then change
addresses in addresses in
the Action to Forward and add the
remote (spoke) remote (spoke) Set as needed.
VPN element for the VPN into which
networks as networks as
matching traffic is forwarded.
needed. needed.
 To create rules for forwarding tunneled traffic to the Internet

1. Insert the following type of rule:
Table 50.8 Rule for Allowing Traffic Except if it Arrives through VPNs
Remote ANY or an (Double-click the cell to edit.)

networks or VPN Expression Activate the Match traffic based on
clients’ Virtual element that Set as Select source VPN option and add one or more
Adapter address excludes the needed. Allow. specific VPN elements according to where
space/NAT Pool local internal the traffic is coming from. This rule does
address space. networks. not match traffic from other sources.
Creating VPN Rules 751

2. In most cases, the source addresses are from a private space and you must add a NAT rule
to translate them to publicly routable IP addresses. Make sure NAT is enabled in the
Properties dialog of the VPN element(s) and add a NAT rule for the VPN traffic if a suitable
NAT rule does not exist already.
3. Configure the remote Gateway or VPN clients to forward all traffic to the VPN:
• VPN clients: configure the DHCP server to assign the hub Gateway as the default gateway
for the VPN clients.
• SOHO firewalls: activate the Allow only traffic to VPN option in the SOHO Firewall
properties, on the Corporate tab.
• StoneGate firewall/VPN gateways: create a VPN rule that directs all traffic to the VPN with
the hub gateway, see Creating Basic VPN Rules for Gateway Connections (page 749).
Note – For the traffic to be allowed into the VPN, the destination IP address must be part
of the Site definition of the hub Gateway. When you forward Internet traffic, the hub’s Site
must usually include the Any Network element. This Site may interfere with other VPN
configurations, so you should generally disable it in other VPNs. See Defining Protected
Networks for VPN Sites (page 732).
Preventing Other Access Rules from Matching VPN Traffic

 To create rules that do not match connections opened through a VPN
 Insert the following type of rule:
Table 50.9 Rule for Allowing Traffic Except if it Arrives through VPNs

(Double-click the cell to change settings.)
Set as Set as Set as Activate the Match traffic based on
Set as needed.
needed. needed. needed. source VPN option. Select Rule does not
match traffic from any VPN from the list.
Creating NAT Rules for VPN Traffic

NAT rules are always applied to the VPN tunnel communications (the encrypted communications
that have the Gateways as their source and destination), but not to the traffic that is inside the
VPN tunnel (the traffic that uses the VPN tunnel). If you want to apply NAT to traffic going into or
coming out of the VPN tunnel, you must specifically allow this with an option in the VPN
element’s basic properties (see Modifying an Existing VPN Element (page 744)).
Observe the following guidelines:
• You must define Sites (encryption domains) that contain the translated IP addresses that the
packets use when they are inside the VPN tunnel. Set the Sites that contain the real IP
addresses to Private mode in the VPN. See Adjusting VPN-Specific Site Settings (page 732).
Example If you translate IP addresses of traffic going into the VPN, you must add a Site that includes
the translated IP addresses to your internal Gateway to make those addresses valid in the
VPN. The Sites that contain the internal addresses are set to Private mode.

• If you have configured address translation for VPN clients in the Firewall element’s properties
(NAT Pool), make sure your NAT rules do not match the VPN client communications. This is
the preferred method for translating VPN client addresses.
• If you want to forward traffic originating from VPN clients or SOHO firewalls to the Internet, you
must typically have at least two NAT rules: the first rule to translate internal IP addresses to
an external IP address for the Internet connections and the second rule (above the first one)
for connections to internal resources to prevent NAT from being applied or to translate to an
internal IP address as necessary.
The order of processing for traffic going into a VPN tunnel is:
Access RulesNAT RulesVPN tunnel.
The order of processing for traffic coming out of a VPN tunnels is:
(VPN client NAT Pool)Access RulesNAT RulesInternal Network.
Other than what is stated above, there are no further VPN-specific issues with NAT rules. As
usual, the first matching NAT rule is applied to those connections that are matched against the
NAT rules and the rest of the NAT rules are ignored.
What’s Next?
 For detailed instructions on creating NAT rules, see Editing NAT Rules (page 545).
Monitoring VPNs
Prerequisites: Defining Security Gateways, Defining a VPN Element, Creating VPN Rules
You can monitor the current status of the VPN in the System Status view. The overall status of
the VPN elements and the tunnels they contain is shown in the tree of monitored elements. See
Reading Component Statuses (page 88) for more information on the colors used.
Logging for VPNs is separate for the tunnels and the traffic that uses the tunnels:
• VPN negotiations are always logged (regardless of the logging options in Access rules) as
informational messages. For information on these messages, see Reading VPN-related Logs
(page 912) and IPsec VPN Log Messages (page 1005).
• More detailed logging is available when you activate IPsec diagnostic logging for the firewall/
VPN engine for troubleshooting purposes. See Enabling/Disabling Firewall/VPN Diagnostics
(page 193).
• The traffic using the VPN tunnels is logged according to the logging options you set for the
rule that allows the traffic in or out of the VPN. See Defining Access Rule Logging Options
(page 528).
• The System Status view provides shortcuts to logs filtered for the specific VPN or Security
Gateway(s) referenced in the log event.
• Right-click a VPN in the Status tree or connectivity diagram and select
MonitoringLogs by VPN.
• Right-click a Security Gateway in the Status tree or connectivity diagram and select
MonitoringLogs by Security Gateway.
• Right-click the connection between two Security Gateways in the connectivity
diagram and select MonitoringLogs by Security Gateways to view logs of traffic
between the two Security Gateways.
Log pruning filters that have been activated in your system may delete some (or even all) of the
generated messages.
Monitoring VPNs 753

C HAPT ER 51
MANAGING VPN CERTIFICATES
A digital certificate is a proof of identity. StoneGate supports using certificates for

authenticating gateways and VPN clients in VPNs.
Getting Started With VPN Certificates (page 756)

Defining a VPN Certificate Authority (page 757)
Creating and Signing VPN Certificates (page 759)
Uploading VPN Certificates Manually (page 762)
Renewing VPN Certificates (page 763)
Exporting the Certificate of VPN Gateway or VPN CA (page 764)
Importing a VPN Gateway Certificate (page 765)
Checking When Gateway Certificates Expire (page 765)
Checking When an Internal VPN CA Expires (page 766)
755
Getting Started With VPN Certificates
Prerequisites: (To certify internal Gateways) Defining Security Gateways
What VPN Certificates Do

You can use certificates for authentication in all types of VPNs as required. Certificates are
issued by a certificate authority (CA) as a proof of identity. Gateways that form a VPN tunnel are
configured to trust the CA that signed the other gateway’s certificate. All certificates issued by a
trusted CA are accepted as valid, so certificates can be flexibly added, renewed, and changed
without affecting the VPN as long as the actual identity information is correct.
Certificates are an available option in all VPNs, and certificates are always necessary for
Gateways to which StoneGate IPsec VPN Clients connect. Certificates are an available option on
the VPN client side as well, but not mandatory.
Certificates reduce the required maintenance work, because they need to be changed much
less frequently than pre-shared keys. All certificates are created with an expiration date, after
which the certificate is not valid anymore. Certificates signed by the internal IPsec CA are valid
for three years from their creation. When a certificate expires, a new certificate is needed.
Certificate Management
Certificate-related tasks in StoneGate mostly involve internal VPN Gateways. RSA certificates
can be created and renewed automatically, but if DSA certificates or an external CA are involved,
some manual steps are required.
There are two options for signing the internal gateway certificates:
• The Management Server includes a dedicated internal CA for signing VPN certificates, the
“Internal IPsec CA”, which you use through the Management Client. This CA is used in
automatic certificate management.
• You can create certificate requests in the StoneGate system, export them, sign them using
an external CA, and then import the signed certificate back into StoneGate.
The internal VPN certificate authority can also sign certificate requests created by external
components. This feature is mainly meant to support VPN client deployments. The internal VPN
CA does not allow you to cancel issued certificates, so consider how widely you can use it for
signing external certificate requests within your organization.
1. (Optional) If you plan to use certificates that are signed by some external certificate
authority (CA), define the CA in the system. See Defining a VPN Certificate Authority
(page 757).
2. To use an externally-signed certificate, DSA certificate, or if automatic certificate
management is disabled, start by Creating a VPN Certificate or Certificate Request for an
Internal Gateway (page 759).
3. (For externally signed certificates) When the certificate is signed, import it as explained in
Importing a VPN Gateway Certificate (page 765).
4. Select a certificate-based Authentication Method on the IKE (Phase 1) tab of the VPN
Profile for VPNs. See Defining IKE (Phase 1) Settings for a VPN (page 735).
756 Chapter 51 Managing VPN Certificates

Defining a VPN Certificate Authority
Prerequisites: You need the root certificate (or a valid certificate) from the certificate authority
For a certificate to be valid, a mutually trusted Certificate Authority (CA) must sign the
certificate. Only the internal VPN CA of your system is configured as a trusted VPN CA in VPNs
by default. You must define additional CAs in the following cases:
• If you create a VPN with an external gateway and you do not want to use the internal VPN CA
to create a certificate for the external gateway. The external gateway must also be configured
to trust the issuer of the certificate of your internal gateway.
• If you want to use a certificate signed by an external CA on an internal VPN gateway or on a
VPN client.
You can configure the CA as trusted by importing its root certificate or a valid certificate signed
by the CA. The certificates must be X.509 certificates in PEM format (Base64 encoding). It may
be possible to convert between formats using, for example, OpenSSL or the certificate tools
included in Windows.
The CAs you add can be either private (for self-signed certificates) or public (commercial
certificate issuers). When you define a CA as trusted, all certificates signed by that CA are
considered as valid until their expiration date (or until the CA’s certificate expires). Optionally,
you can also set up StoneGate to check the certificate revocation status from certificate
revocation lists (CRLs) or through the OCSP protocol. The CA may cancel a certificate, for
example, because it is compromised.
 To define a new Certificate Authority

Configuration view.
2. Expand the Other Elements branch in the element tree.
3. Right-click Certificates and select New VPN Certificate Authority. The VPN Certificate
Authority Properties dialog opens.
4. Type a Name for the element. This name is only for your reference.
Note – All fields but the Name on the General tab are greyed out. The greyed out fields are
always filled in automatically based on information contained in the certificate you import
and you cannot change them (information is shown when you close and reopen the
element after importing the information).
5. Switch to the Certificate tab and do one of the following:

• Click the Import button and import a certificate file.
• Copy-paste the information into the field on the tab (including the “Begin Certificate”
header and “End Certificate” footer).
Tip – The certificate information for many public certificate authorities can be copy-pasted from the
default Trusted Certificate Authority elements available in the Firewall Configuration view under
Other ElementsFirewall Properties (the Trusted Certificate Authority elements are used by
the HTTPS inspection feature).
Defining a VPN Certificate Authority 757

Illustration 51.1 Certificate Authority Properties - Certificate Tab
6. (Optional) If you want the firewall/VPN engines to check the revocation status of certificates
signed by this CA, switch to the Validation tab and select the options as follows:
• Select the Check Validity on Certificate-Specified CRLs option to activate CRLs for
certificate status checking.
• Select the Check Validity on Certificate-Specified OCSP Servers option to activate
OCSP certificate status checking.
7. (Optional) To define more CRL servers to check in addition to those defined in the
certificates, click the corresponding Add button and select:
• LDAP Server Element to choose an existing element
• Manual LDAP Server Address to type in the address in a dialog that opens.
Example ldap://example.com:389
8. (Optional) To define more OCSP servers to check in addition to those defined in the
certificates, click the corresponding Add button and type in an address in the dialog that
opens.
Example http://ocsp.example.com
Caution – When certificate checking is defined, all certificates signed by the CA are
considered as invalid if the validity check cannot be performed (for example, due to
incorrectly entered address or connectivity problems).
9. Click OK. If you see an invalid certificate error, the certificate you imported may be in an
unsupported format. Try converting the certificate to an X.509 certificate in PEM format
(Base64 encoding) using OpenSSL or the certificate tools included in Windows.
If you use the Default policy template, both LDAP (port 389) and HTTP (port 80) connections
from the engine are allowed. If your firewall or server configuration differs from these standard
definitions, edit the firewall policy to allow the necessary connections from the engines.

You can define several Certificate Authority servers in the system. By default, all CAs you have
defined in the system are trusted by all Gateways and in all VPNs. If necessary, you can limit
trust to a subset of the defined CAs when you configure the Security Gateway and VPN Profile
elements.
What’s Next?
 By default, all Gateways trust all configured VPN certificate authorities in all VPNs. The
trust relationships can be changed at the gateway level (Defining Trusted CAs for a
Gateway (page 726)) and in the VPN Profiles (Defining Trusted CAs for a VPN
(page 742)).
 To obtain a certificate from an external certificate authority, first create a certificate
request as explained in Creating a VPN Certificate or Certificate Request for an Internal
Gateway (page 759) and then import the signed certificate as explained in Importing a
VPN Gateway Certificate (page 765).
Creating and Signing VPN Certificates

Prerequisites: (To certify internal Gateways) Defining Security Gateways
Creating a VPN Certificate or Certificate Request for an

Internal Gateway
Following the instructions below, you can create a certificate request and sign it either using the
internal or an external certificate authority (CA). If the Internal Gateway has automatic certificate
management activated in its properties, the steps below are necessary only when you want to
use DSA certificates or create a certificate request to be signed by an external CA.
 To create a VPN certificate or certificate request for an internal gateway

Configuration view.
2. Select Gateways. The defined Gateways are displayed.
3. Right-click the Gateway that needs a VPN certificate and select ToolsGenerate
Certificate. The Generate Certificate dialog opens.
Illustration 51.2 Generate Certificate
Creating and Signing VPN Certificates 759

4. Enter the certificate information:
• Organization: the name of your organization as it should appear in the certificate.
• Country: (optional) standard two-character country code for the country of your
organization.
• Common Name: a descriptive name for the Gateway as it should appear in the certificate.
• Key Length: length of the key for the generated public-private key pair. The default is
1024 bits.
• Gateway: internal reference to the Gateway element. Not editable.
• Key Type: select the type of key you want to use according to the requirements of your
organization and, if you use an external certificate authority, possible restrictions in
supported key types.
5. Select how you want to Sign the certificate:
• Select Internally to sign the certificate using StoneGate’s internal VPN Certificate
Authority. If the internal VPN Certificate Authority is in the process of being renewed and
there are temporarily two valid internal VPN Certificate Authorities, select the one you
want to use from the list of internal VPN Certificate Authorities.
• Select Externally if you want to create a certificate request that some other Certificate
Authority signs.
6. Click OK. The signed certificate or unsigned certificate request is added under the Gateway
in the gateway list.
• Note that there may be a slight delay while the request is generated.
• If you signed the certificate using the internal VPN CA, the certificate is automatically
transferred to the Firewall/VPN engine and no further action is needed.
7. With external certificate authorities, further action is required: Right-click the certificate
request and select Export Certificate Request. A file save dialog opens for saving the
exported certificate request.
• To generate certificates for StoneGate, the CA must support PKCS#10 certificate
requests in PEM format (Base64 encoding) and the signed certificates must also be in
the PEM format. It may be possible to convert between formats using, for example,
OpenSSL or the certificate tools included in Windows.
• The CA must be able to copy all attributes from the certificate request into the certificate;
especially X.509 extension Subject Alternative Name must be copied as it is in the
request because the value is used for authentication.
What’s Next?
 When you receive the signed certificate, import it as explained in Importing a VPN
Gateway Certificate (page 765).

Signing External Certificate Requests Internally
StoneGate’s internal VPN Certificate Authority can be used to sign external certificate requests.
This feature is mainly intended for use with VPN clients, but it can be used to sign any
certificate request that is in the supported format (PKCS#10 certificate requests in PEM
format). An alternative is to configure StoneGate to accept an externally signed certificate by
defining the external certificate issuer as trusted. See Defining a VPN Certificate Authority
(page 757).
Make sure that the date, time, and time zone are all set correctly on the Management Server
and on the external component that uses the certificate. Certificates are valid for three years
starting from the date and time they are created. The validity start and end date and time are
written in the certificate and are enforced in the authentication.
Caution – The internal CA does not support certificate revocation lists, so it is not possible
to cancel an internally signed certificate before it expires.
 To sign an external certificate request

Configuration view. A VPN-specific toolbar is shown at the top edge of the element panel.
Illustration 51.3 VPN Tools Menu
2. In the VPN-specific toolbar, click the Tools icon and select Sign VPN Client Certificate. The
Sign VPN Client Certificate dialog opens. Despite its name, the same dialog works for all
X.509 certificate requests in PEM format and is not limited to VPN client certificate request
signing.
Creating and Signing VPN Certificates 761

Illustration 51.4 Sign VPN Client Certificate
3. If the internal VPN Certificate Authority is in the process of being renewed and there are
temporarily two valid internal VPN Certificate Authorities, select the internal VPN Certificate
Authority for signing the certificate request from the list at the top of the dialog.
4. Either browse to the certificate request file on your local workstation or copy-paste the
content of the certificate request into the dialog (with the “begin certificate request”
header and “end certificate request” footer).
5. Click Sign. The certificate is signed and the dialog switches to show information on the new
certificate. Note the expiration information on the Certificate tab.
6. On the General tab, click Export to save the certificate for transfer to the device that needs
it.
7. Click OK.
Uploading VPN Certificates Manually

Prerequisites: Creating a VPN Certificate or Certificate Request for an Internal Gateway
In most cases, certificates are transferred to the engines automatically. However, if there are
problems with missing VPN certificates on the Gateways, you can transfer them to the engines
manually.
 To transfer VPN certificates to the engines

Configuration view. A VPN-specific toolbar is shown at the top edge of the element panel.
Illustration 51.5 VPN Tools Menu

2. In the VPN-specific toolbar, click the Tools icon and select Upload Gateway Certificates.
The certificates are either uploaded, or you will see a message that all certificates have
already been automatically uploaded.
Related Tasks
 Troubleshooting Certificates (page 867)
Renewing VPN Certificates

Prerequisites: None
For security reasons, certificates have an expiry date, after which the certificate must be
replaced with a new one. The process is partially automatic when internally-signed certificates
are used, and the necessary steps are explained in this section. To create a new externally-
signed certificate, see Creating a VPN Certificate or Certificate Request for an Internal Gateway
(page 759).
The certificates issued by the internal VPN Certificate Authority are valid for three years. If
automatic RSA certificate management is activated for an internal security gateway, RSA
certificates issued by the internal VPN Certificate Authority are renewed automatically without
your intervention as long as the certificate-related files are intact (including the private key
stored on the engines).
The internal VPN Certificate Authority itself is valid for ten years. A new internal VPN Certificate
Authority is automatically created six months before the internal VPN Certificate Authority’s
expiration date. New certificates signed by the new internal VPN Certificate Authority are
automatically created for internal gateways. If certificates are used to authenticate IPsec VPN
client users and the certificates have been signed by the expiring VPN Certificate Authority, you
must manually create new certificates for the IPsec VPN clients. You must also create new
certificates manually for any other external components that have certificates signed by the
internal VPN Certificate Authority.
Note – When you renew the VPN certificate, StoneGate IPsec VPN client users will receive
a notification about the certificate fingerprint change. Notify your users before you renew
the certificate, if possible.
 To renew an externally signed certificate of an internal Gateway

1. Create a new certificate request as explained in Creating a VPN Certificate or Certificate
Request for an Internal Gateway (page 759).
2. Import the signed certificate as explained in Importing a VPN Gateway Certificate
(page 765).
 To renew an internally signed certificate of an external component

1. Create a new certificate request in the external component. For StoneGate IPsec VPN
clients, this is explained in the IPsec VPN Client User’s Guide.
2. Sign the certificate as explained in Signing External Certificate Requests Internally
(page 761).
Renewing VPN Certificates 763

 To manually renew internally signed Internal Gateway certificates
Configuration view.
2. Browse to Virtual Private NetworksCertificatesGateway Certificates. The
certificates are shown with their expiration dates and signer information.
3. Right-click the certificate you want to renew and select Renew Certificate.
4. Click Yes. There is a delay while the certificate is renewed, after which you are notified that
the certificate was renewed. The certificate is transferred to the engine automatically.
5. Refresh the policy of the firewall/VPN engine to activate the new certificate.
The procedure explained above renews the certificate when the certificate-related information is
intact on the engine and on the Management Server. If the certificate has not expired but is
affected by other problems, delete the existing certificate element in the Management Client
and create a new one (see Creating a VPN Certificate or Certificate Request for an Internal
Gateway (page 759)).
Exporting the Certificate of VPN Gateway or VPN CA

Prerequisites: A signed certificate is present in the system or a new internal VPN CA has been created
In addition to certificate requests, you can also export signed gateway certificates and the
certificates of VPN Certificate Authorities. This is not usually necessary, but can be done as
needed.
If the system has created a new internal VPN Certificate Authority, you must export the
certificate of the new internal VPN Certificate Authority and import the certificate on external
gateways that use certificates signed by the internal VPN Certificate Authority or communicate
with gateways that use certificates signed by the internal VPN Certificate Authority. If the
external gateway itself uses a certificate signed by the internal VPN Certificate Authority, you
must also create a new certificate for the external gateway (see Renewing VPN Certificates
(page 763).
Certificates that are created when the internal VPN Certificate Authority signs an external
certificate request must be exported at the time of signing and are not stored for exporting at a
later time.
 To export a signed certificate

Configuration view.
2. Browse to Other ElementsCertificatesGateway Certificates. The certificates are
shown with their expiration dates and signer information.
3. Right-click a certificate and select Export Certificate. A file save dialog opens.
4. Browse to the location where you want to save the file on your local workstation and click
Save.

 To export the certificate of the Internal VPN Certificate Authority
Configuration view.
2. Browse to Other ElementsCertificatesVPN Certificate Authorities. The VPN
Certificate Authorities are shown with their expiration dates.
3. Right-click a VPN Certificate Authority and select ToolsExport Elements. The Export
dialog opens.
4. Browse to the location where you want to save the file on your local workstation and click
Export.
If the external gateway uses a certificate signed by the internal VPN Certificate Authority and the
internal VPN Certificate Authority has been renewed, you must create a new certificate for the
external gateway. See Renewing VPN Certificates (page 763).
Importing a VPN Gateway Certificate

Prerequisites: Creating a VPN Certificate or Certificate Request for an Internal Gateway
This procedure allows you to import a certificate signed by an external certificate issuer for an
internal VPN Gateway when the certificate request has been created internally. For security
reasons, it is not possible to import externally generated private keys.
Note – All CAs that issue certificates for your VPNs must be configured in the system (see
Defining a VPN Certificate Authority (page 757)) and be included as trusted both at the
Gateway and VPN Profile levels.
 To import a VPN gateway certificate

Configuration view.
2. Open the Gateways branch and expand the tree under the Gateway.
3. Right-click the certificate request and select Import Certificate.
4. Select the certificate authority that signed the certificate.
5. Browse to the certificate file or copy-paste the file’s content as text.
6. After the signed certificate is imported, delete the certificate request, which is still
displayed under the Gateway along with the signed certificate.
The certificate is transferred to the engine automatically.
Checking When Gateway Certificates Expire

Prerequisites: A signed certificate is present in the system
By default, RSA certificates issued by the internal VPN Certificate Authority to internal VPN
Gateways are renewed automatically. In other cases, the certificates expire according to the
information written in the certificate when it was generated. StoneGate never accepts an expired
certificate.
Importing a VPN Gateway Certificate 765

 To check when VPN certificates expire
Configuration view.
2. Expand the Other ElementsCertificates branch in the element tree and select Gateway
Certificates. The existing certificates are displayed in the other panel.
3. See the Expiration Date column for information on the certificate’s expiry.
• You can renew internally signed certificates through their right-click menu (necessary only
if automatic certificate management is not active). VPN client users may be prompted to
accept the change of certificate.
• Elements with no expiration date are certificate requests (Status: To be signed).
Checking When an Internal VPN CA Expires

Prerequisites: None
The Management Server includes a dedicated internal VPN CA for signing VPN certificates, the
“Internal IPsec CA”. The internal VPN CA is valid for ten years. A new internal VPN CA is
automatically created six months before the internal VPN CA’s expiration date. You can check
the expiration date and status of the internal VPN CA.
 To check the status of an internal VPN CA

Configuration view.
2. Expand the Other ElementsCertificates branch in the element tree and select VPN
Certificate Authorities. The existing VPN Certificate Authorities are displayed in the other
panel.
3. See the Expiration Date column for information on the certificate’s expiration date.
4. To view detailed information, right-click a VPN Certificate Authority and select Properties.
The Properties dialog for the internal VPN CA opens.
5. See the Validity information in the Valid from and Valid to fields.
6. See also the Status information:
• Active: You can use this Internal VPN CA to sign certificates.
• Renewal Started: This is a new Internal VPN CA that the system has created
automatically. The process of renewing VPN certificates for internal gateways has begun.
• Expires Soon: A new internal VPN CA has been created but some components may still
use certificates signed by this internal VPN CA.
• Inactive: This internal VPN CA has expired or no system component uses a certificate
signed by this internal VPN CA.
Related Tasks
 Understanding Certificate-Related Problems (page 868)
 Dealing with Expiring Certificate Authorities (page 872)

C HAPT ER 52
RECONFIGURING EXISTING VPNS
The topics below provide additional instructions for some common configuration and tuning
tasks for existing VPNs.
Adding or Removing Tunnels Within a VPN (page 768)

Configuring NAT Settings for an Existing VPN (page 768)
Adding New Gateways to an Existing VPN (page 770)
Changing Gateway IP Addressing in an Existing VPN (page 770)
Giving VPN Access to Additional Hosts (page 771)
Routing Internet Traffic Through VPNs (page 771)
Routing Traffic Between VPN Tunnels (page 772)
Renewing or Generating Pre-Shared Keys (page 773)
Advanced VPN Tuning (page 774)
767
Adding or Removing Tunnels Within a VPN
Prerequisites: You must have a VPN configured
The number of tunnels generated for a VPN is determined by how the Gateway elements are
listed in the Overall Topology tab of the VPN element and the number of end-points there are
active in each Gateway element.
• Each central Gateway forms a tunnel with each central and satellite Gateway in the VPN. No
other Gateway<->Gateway tunnels are created. See Defining VPN Topology (page 744) for
detailed instructions. Tunnels are not generated between end-points that cannot connect to
each other, for example, tunnels are not generated between two end-points if they both have
a dynamic IP address.
• Tunnel generation can be prevented if a Gateway is added under a different Gateway instead
of directly at the main level in the central Gateways list. This configuration implies that the
Gateway at the main level forwards connections to the Gateway(s) below it in the hierarchy.
For the forwarding to work, it must be explicitly configured in the central gateway’s IPv4
Access rules (in a rule with the Use VPNForward action).
• Endpoint<->Endpoint tunnels are created between all endpoints defined in the properties of
any two Gateways that form a Gateway<->Gateway tunnel. See Defining End-Points for Internal
Security Gateways (page 722) or Defining End-Points for External Security Gateways
(page 724).
Before changing the tunnels that are used in active VPNs, we recommend making a backup of
the Management Server as instructed in Creating Backups (page 795). After changing the
topology of the VPN, always check that all new or changed Tunnels are valid on the Tunnels tab.
Related Tasks
 Defining Security Gateways (page 720)
 Adding New Gateways to an Existing VPN (page 770)
Configuring NAT Settings for an Existing VPN

Prerequisites: You must have a VPN configured
Activating NAT Traversal

NAT traversal prevents intermediary devices from applying NAT to VPN communications if NAT is
found to prevent the communications from working. It works by encapsulating the packets.
NAT traversal encapsulates the IKE and IPsec communications inside UDP packets (NAT-T) or
tunnels them inside TCP packets (proprietary method). The TCP tunneling option is available for
client-to-gateway VPNs only. There is also a legacy UDP encapsulation method that is not
supported on 5.2 firewall engines.
The UDP and NAT-T encapsulation options do not affect client-to-gateway VPNs. NAT-T is always
active in client-to-gateway VPNs.
Encapsulation is not always necessary. Usually, the VPN can be configured to work even when
NAT is applied simply through the definition of Contact Addresses. For more information, see
Getting Started with System Communications (page 60).
768 Chapter 52 Reconfiguring Existing VPNs

The encapsulation options are activated in the end-point properties in the Gateway element, see
Defining End-Points for Internal Security Gateways (page 722) and Defining End-Points for
External Security Gateways (page 724).
Translating Addresses of VPN Communications Between

Gateways
The communications needed to establish and maintain VPN tunnels between VPN Gateways are
always translated according to the NAT rules (as opposed to the communications that use the
VPN tunnel, see Translating Addresses in Traffic Inside a VPN Tunnel (page 769)). Create a
matching NAT rule that defines some NAT operation to translate addresses in these
communications and make sure that the communications do not match the wrong NAT rule
unintentionally.
When you add NAT, you may need to change VPN settings. Add contact addresses for the
firewalls, (see Getting Started with System Communications). Contact Addresses can be used
with both internal and external gateways.
There is nothing VPN-specific about creating the actual NAT rules (see Editing NAT Rules
(page 545)).
Translating Addresses in Traffic Inside a VPN Tunnel

By default, IP addresses in traffic that enters or leaves a VPN tunnel are not translated. This
behavior is controlled by an option in the properties of the VPN element, accessible through the
right-click menu for the VPN in question.
If the option to translate the IP addresses is enabled, the IP addresses in traffic that uses
gateway-to-gateway VPN tunnels are translated according to the NAT rules. There is nothing VPN-
specific in creating these NAT rules. However, the VPN configuration is affected if local protected
addresses are translated using NAT:
• Set the Site that contains the private local addresses (before translation) in the Private mode
in VPNs in which those addresses are translated using NAT.
• Add the translated addresses as a new Site for the Gateway (disable the Site in other VPNs).
This Site is in the default Normal mode.
If the option to translate the IP addresses is enabled, VPN client traffic is translated according
to the NAT Pool settings in the Firewall element’s properties (see Managing VPN Client IP
Addresses (page 785)) or as defined in the NAT rules. Make sure the NAT Pool addresses do not
match NAT rules if the NAT Pool is active.
For more information on configuring NAT rules, see Editing NAT Rules (page 545).
Configuring NAT Settings for an Existing VPN 769

Adding New Gateways to an Existing VPN
Prerequisites: None
If you have a VPN that is already configured, you can add new Gateways as needed following the
general configuration workflow outlined here:
1. Create a Gateway element to represent the physical gateway device in VPNs if the element
does not exist already, see Defining Security Gateways (page 720). Once created, the
same element can be used in any number of VPNs.
2. If the VPN uses Certificates for authentication, you may need to create a new VPN
certificate for the Gateway (see Getting Started With VPN Certificates (page 756)). The
same certificate can be used in any number of VPNs, providing it fulfills the following
criteria:
• The certificate must match the type of certificate selected for the VPN in the VPN Profile.
• The certificate must be issued by a certificate authority that the other Gateways trust.
3. Edit the VPN element to add the Gateway on the Overall Topology tab, see Defining VPN
Topology (page 744).
4. Check and adjust the Tunnels between the new Gateway and the existing Gateways, see
Defining VPN Tunnel Settings (page 746).
5. Refresh the policies of all Firewall/VPN engines that are involved in the tunnel.
Changing Gateway IP Addressing in an Existing VPN

Prerequisites: None
For internal Gateways, the VPN endpoint addresses are determined by the IP addresses you
have defined for the interfaces in the Firewall element. On clusters, only CVI addresses are used
as VPN endpoints.
• If you change the IP address of some interface of a firewall, the corresponding VPN endpoint
IP address also changes automatically and the existing tunnels in the VPN element are
preserved.
• If continuous connectivity is required, define the old and new IP address as two separate
interfaces, select both as endpoints in the VPN, and refresh the policies of all affected
firewall/VPN engines. In this configuration, either of the IP addresses can be used; Multi-Link
VPN automatically selects the end-point that works.
• If you add and remove interfaces, you may need to select and deselect endpoints manually
and then check the tunnel configuration in the VPN element. See Defining End-Points for
Internal Security Gateways (page 722)and Defining VPN Tunnel Settings (page 746).
Note – If the Gateway’s identity in the VPN is tied to its IP address, you must update the
configurations of all gateways in the VPN even if the IP address is NATed and therefore not
directly used for contact. For internal Gateways, this is done by refreshing the engine’s
policy after making changes. For external Gateways, change the information in the
configuration of that gateway device.
For external Gateways, the VPN endpoint addresses are always entered manually. Change the IP
address configured in StoneGate and refresh the policies of all affected firewall/VPN engines.

• If continuous connectivity is required, define the new address as a second endpoint before
the address is actually changed. StoneGate MultiLink VPN automatically selects the IP
address that works before and after the change.
• See Defining End-Points for External Security Gateways (page 724).
Giving VPN Access to Additional Hosts

Prerequisites: None
If you want to give access through the VPN to hosts with IP addresses that are not already
configured for your VPN, proceed according to this general workflow:
1. Make sure the IP addresses (possibly the translated IP addresses if NAT is enabled in this
VPN) are included in one of the Sites of the correct Gateway. If the IP addresses must not
be included in other VPNs where the same Gateway element is used, add them to a
separate Site and disable the SIte in other VPNs. See Adding a New VPN Site (page 731).
2. If there are external Gateways involved, make sure any IP addresses you add to the Site
definition in StoneGate are also added to the configuration of the external gateway device,
so that it routes the traffic through the VPN.
3. Check that the IPv4 Access rules of all Gateways involved specify that this traffic is sent/
allowed through the VPN, and if NAT is enabled in the VPN, check also the NAT rules. See
Creating Basic VPN Rules for Gateway Connections (page 749) and Creating NAT Rules for
Routing Internet Traffic Through VPNs

Prerequisites: A working VPN between all Gateways involved
It is possible to force all traffic from VPN clients or clients in protected networks to be routed
through the VPN so that the traffic can be inspected and sanitized centrally. The configuration
requires the following settings:
1. Enable NAT for tunneled traffic in the VPN element’s properties. See Modifying an Existing
VPN Element (page 744).
2. Change the mode of all of the central Gateway’s Sites in this VPN to Private and replace
them with a Site that contains the Any Network element. Disable the Any Network Site in
other VPNs. See Defining Sites for VPN Gateways (page 729).
3. Reconfigure the policy:
• Create Access rules, see Creating Forwarding VPN Rules on Hub Gateways (page 751).
• Create NAT rules that translate any private IP addresses to public addresses for the
Internet. See Creating NAT Rules for VPN Traffic (page 752).
4. Redirect the traffic from external components to the central gateway as necessary:
• For StoneGate Firewall/VPN Gateways, add an Access rule that sends the desired traffic
to the VPN, see Creating Basic VPN Rules for Gateway Connections (page 749).
• For SOHO firewalls: Disallow direct Internet access for the Corporate clients, see
Forwarding All SOHO Corporate Traffic to the VPN (page 772).
5. (VPN Clients only) Configure the Virtual Adapter as explained in Configuring Virtual IP
Addressing for VPN Clients (page 787).
Giving VPN Access to Additional Hosts 771

Forwarding All SOHO Corporate Traffic to the VPN
 To forward all Corporate network connections to the VPN
1. Open the properties dialog of the SOHO firewall and switch to the Corporate tab.
Tip – You can multi-select several SOHO firewalls and then right-click and select the Common
Properties action to change this setting on several SOHO firewalls.
2. Turn on the Allow only traffic to VPN option.
3. Click OK.
What’s Next?
 Apply the configuration on the SOHO firewalls to transfer the changes.
Related Tasks
 Defining Corporate Interfaces for SOHO Firewalls (page 370)
Routing Traffic Between VPN Tunnels

Prerequisites: (If VPN client traffic is forwarded) Configuring Virtual IP Addressing for VPN Clients
It is possible to redirect traffic from one VPN tunnel to some other VPN tunnel through a hub
gateway. This is especially useful for VPN client users who need access to resources at different
locations, because the users do not have to separately connect to different gateways according
to the services they want to use.
See Getting Started With IPsec VPNs (page 716) if you need more instructions for creating and
editing VPNs and the elements involved.
See Configuration 4: Basic VPN Hub (page 709) for a step-by-step configuration example.
 To redirect traffic between VPN tunnels

1. Define a hub topology in which the other Gateway elements are under the forwarding
gateway (see illustration). The IPsec Client Gateway is always inserted at the top level.
Note – Duplicate tunnels are not allowed. There must not be gateway-to-gateway
connections between the hub and the other gateways in other active VPNs.
2. Add a new Site under the hub Gateway that contains all relayed IP addresses that you want
to make reachable through the hub (IP addresses behind the spoke Gateways) and set the
Mode of the Site to Hub in this VPN (disable this Site in other VPNs, if configured). If VPN
client traffic is forwarded, add also the virtual IP address space used for the VPN clients in
a Site under the hub Gateway (if the IP address space is not already included).

Illustration 52.1 Hub Topology for Tunnel-to-Tunnel Forwarding.
Hub Gateway. Protected IP

addresses
behind the
These Gateways
subordinate
are contacted
gateways.
through the hub.
3. Add IPv4 Access rules that forward the traffic between tunnels as instructed in Creating
Forwarding VPN Rules on Hub Gateways (page 751).
4. Refresh the policies of all Gateways, starting from the hub gateway.
Optionally, all traffic (including Internet traffic) can be routed through the hub Gateway (see
Routing Internet Traffic Through VPNs (page 771)).
Renewing or Generating Pre-Shared Keys

Prerequisites: Pre-shared key authentication selected in the VPN Profile and allowed in the Gateway Profiles
Renew or generate VPN pre-shared keys according to one of the two sets of instructions below.
Generating a New Pre-Shared Key Automatically

As a security precaution, we recommend that you periodically change the pre-shared key (for
example, monthly).
 To renew or generate pre-shared keys by automatic key generation

Configuration view.
2. Right-click a VPN element and select Edit VPN. The VPN editing view opens.
4. Select all Tunnels whose pre-shared keys you want to renew.
5. Right-click one of the selected Tunnels and select Delete Pre-Shared Key.
6. Right-click one of the selected Tunnels again and select Generate Missing Pre-Shared Key.
7. If you need to transfer keys to external components, double-click the Key column for those
tunnels and copy-paste or export the key.
Caution – Make sure that outsiders cannot obtain the key while you transfer it to other
devices. The key must remain secret to be an effective security measure.
Renewing or Generating Pre-Shared Keys 773

Configuring Pre-Shared Keys Manually
As a security precaution, we recommend that you periodically change the pre-shared key (for
example, monthly).
 To renew pre-shared keys manually

Configuration view.
2. Right-click a VPN element and select Edit VPN. The VPN editing view opens.
4. Double-click the Key column for the tunnel whose key you want to change.
5. Copy-paste or type in a new key into the dialog and click OK.
Caution – The pre-shared key must be long and random to provide a secure VPN.
Advanced VPN Tuning

Prerequisites: None
The Gateway Settings element defines performance-related VPN options for the Firewall/VPN
engines. These settings are used internally and there is no need to match them exactly with
settings of other gateways in VPNs.
The Gateway Settings elements are stored under the Other ElementsProfilesGateway
Settings branch in the VPN Configuration view.
Illustration 52.2 Gateway Settings in the Element Tree
What’s Next?
 If you want to change any of the Gateway settings, proceed to Defining a Custom
Gateway Settings Element (page 774).
Defining a Custom Gateway Settings Element

 To create new Gateway Settings
Configuration view.
2. Expand the Other ElementsProfiles branch in the element tree.

3. Right-click the Gateway Settings branch in the element tree and select New Gateway
Settings. The Gateway Settings Properties dialog opens.
Illustration 52.3 Gateway Settings Properties
Proceed according to the settings you want to change.
What’s Next?
 Adjusting General Gateway Settings (page 776)
 Adjusting Negotiation Retry Settings (page 777)
 Adjusting Certificate Cache Settings (page 778)
 Adjusting Anti-Clogging Settings (page 778)
Advanced VPN Tuning 775

Adjusting General Gateway Settings
See the table below for an explanation of the effect of the general settings in the Settings
section in Gateway Settings properties. The default settings are the recommended values.
Adjust the settings if you have a specific need to do so.
Table 52.1 Settings
Parameters Description
Define the Max Length of Encryption Key (in bits).
A longer encryption key is always more secure than a
shorter one, since it produces stronger encryption.
Max Length of Encryption Key Longer keys require more computing power.
Encryption keys that are too long compared to the
performance and load of the firewall/VPN engine
may cause performance problems and may even
make it vulnerable to denial of service attacks.
Maximum number of IKE SAs kept in the gateway

memory. Negotiated SAs typically require several
Max Number of IKE SAs kilobytes of memory on the security gateway. For
performance reasons it may be necessary to limit
the number of SAs that the firewall can negotiate
upon request.
Allows faster VPN recovery in some error situations
by sending delete notifications for any unknown
Use Tunnel Recovery
IPsec packets. Currently supported engine versions
do not use the settings on the Tunnel Recovery tab.
What’s Next?
 Adjusting Negotiation Retry Settings (page 777)
 Or if you are done with Gateway Settings, click OK and continue by assigning the new
Gateway settings as explained in Assigning the Gateway Settings for a Firewall/VPN
Engine (page 779).

Adjusting Negotiation Retry Settings
See the table below for an explanation of the effect of the settings in the Negotiation Retry
section in Gateway Settings properties. If a negotiation for a VPN does not complete
successfully, the VPN establishment is retried according to the settings available here. The
default settings are the recommended values.
If the VPN establishment often fails because you have frequent intermittent problems with
network connectivity or because your network connection is very slow, increasing these values
may be a work-around solution for getting the VPN to establish.
Table 52.2 Negotiation Retry
Number of possible retries when sending a packet to
a remote gateway. The negotiation for opening a
Retry Limit
tunnel is cancelled when negotiation has been
attempted the number of times specified.
Initial time between retry attempts. This value

doubles at each attempt until the value entered for
Retry Timer
the Retry Timer Maximum is reached. Enter the
value in milliseconds.
Maximum delay between two retry attempts. When

the Retry Timer reaches this value, all further retries
Retry Timer Maximum
are done at the interval defined here until the Retry
Limit is reached. Enter the value in milliseconds.
Tunnel negotiation is cancelled if it is not completed

Negotiation Expiration before the expiration time is reached. Enter the
value in milliseconds.
What’s Next?
Engine (page 779).

Adjusting Certificate Cache Settings
See the table below for an explanation of the effect of the settings in the Certificate Cache
section in Gateway Settings properties. These settings have effect only if you use certificates to
authenticate the security gateways in IKE negotiations. The default settings are the
recommended values. Adjust the settings if you have a specific need to do so.
Table 52.3 Certificate Cache
Maximum Number Maximum number of certificates stored in the cache.
Maximum size of the certificate cache. Define the

Maximum Size
value in bytes.
Defines how long any Certificate Revocation Lists

(CRL) are valid. Overrides the validity stated on the
received CRLs. Typically, individual CRLs should not
CRL Validity be trusted over long periods of time. When the CRL
validity time is reached, the firewall/VPN engine
fetches new CRLs from their issuing authorities.
Define the value in seconds.
What’s Next?
Engine (page 779).
Adjusting Anti-Clogging Settings

See the table below for an explanation of the effect of the settings in the Anti-Clogging section
in Gateway Settings properties. Anti-clogging provides a basic authentication filter that protects
computing resources against most denial of service attacks. The default settings are the
recommended values.
Table 52.4 Anti-Clogging
Time-out for the regular generation of random local
Local Secret Recreation secrets. All IKE SA lifetimes must be smaller than 2
times this value. Enter the value in seconds.
Message digest algorithm used for the anti-clogging

Token Digest Algorithm
tokens.
What’s Next?
 Click OK and continue by assigning the new Gateway settings as explained in Assigning
the Gateway Settings for a Firewall/VPN Engine (page 779).

Assigning the Gateway Settings for a Firewall/VPN Engine
By default, all firewall/VPN engines refer to the Gateway Default Settings Gateway Settings
element. If you want to change the Gateway Settings to a set you have created yourself, follow
the directions below.
 To define the Gateway Settings for a firewall/VPN engine

1. Double-click the Firewall element. The Firewall Properties dialog opens.
2. Switch to the Advanced Settings tab.
3. Click the VPN Settings button. The VPN Settings dialog opens.
Illustration 52.4 VPN Settings
4. Click Select, browse to the correct profile and click OK.
What’s Next?
 Refresh the policy of the firewall to transfer the changes.

C HAPT ER 53
VPN CLIENT SETTINGS
StoneGate VPN Clients do not have controls for many settings that are needed for
establishing a VPN. These settings are defined in the SMC, and the IPsec VPN Client
downloads it from the gateways it connects to.
Getting Started With VPN Client Settings (page 782)

List of VPN Client Settings in the Management Client (page 783)
Managing VPN Client IP Addresses (page 785)
Exporting VPN Client Configuration to a File (page 789)
781
Getting Started With VPN Client Settings
Prerequisites: See Getting Started With IPsec VPNs
For instructions for the installation and daily use of StoneGate VPN Clients, see the VPN Client’s
PDF documentation.
What VPN Client Settings in the SMC Do
The StoneGate IPsec VPN Client settings are configured centrally in the Management Center and
then automatically updated to the Clients from the engines when the clients connect. The
following settings are transferred from the gateway to the client:
• Routing information (VPN Site definitions): generally, if an IP address that the client wants to
contact is included in the Site definition, the traffic is routed into the VPN.
• Authentication settings.
• Encryption settings.
• Information about the gateway’s end-points.
• Setting for NAT traversal method allowed.
• Settings for local security checks on the client computer (for StoneGate IPsec VPN clients
version 5.0 or higher).
• Backup gateways to contact in case there is a disruption at the gateway end (for StoneGate
IPsec VPN client version 5.1 or higher).
Limitations
• When the IPsec VPN Client is first installed, it has no configuration. Therefore, the basic
information on Gateways (such as the IP address to use for connecting) must be introduced
by either the user after installation or the administrator when preparing for the deployment.
• There are version-specific dependencies between StoneGate IPsec VPN Client and Firewall/
VPN software. See the Release Notes of the StoneGate VPN Client version you intend to use
for information on compatibility with your Firewall/VPN gateway’s software version.
• StoneGate does not create configurations for third-party VPN clients. You must create the
configuration through the controls and tools of the third-party IPsec VPN client product.
Related Tasks
 Getting Started With IPsec VPNs (page 716)
 Configuration 3: Basic VPN for Remote Clients (page 701)
 Creating Basic Rules for VPN Client Connections (page 750)
 Routing Internet Traffic Through VPNs (page 771)
782 Chapter 53 VPN Client Settings

List of VPN Client Settings in the Management Client
The table below outlines the settings for StoneGate VPN clients available in the Management
Client.
Table 53.1 VPN Client Settings in the Management Client
Location Setting Explanation

Port used for tunneling VPN client connections
TCP Tunneling Port inside TCP connections to bypass intermediary
traffic filters and NAT devices.
Firewall element
properties Address range for translating IP addresses of
Advanced incoming VPN client connections for internal
Settings tab Translated IP address (Using networks. Alternative to using the Virtual
VPN Settings NAT Pool) Adapter (next setting below in this table).
(See Managing VPN Client IP Addresses
(page 785).)
Options for configuring the VPN client with a

second, virtual network adapter with a DHCP-
Virtual IP address (Using
assigned IP address for connections inside the
Virtual Adapter)
VPN. Alternative to using the NAT Pool
Internal VPN (previous setting above in this table).
gateway element
properties Shows the VPN Client settings from the
VPN Client tab properties of the Firewall element for your
Firewall Advanced Settings convenience, since the address space for the
(See Managing VPN
NAT Pool must not overlap with the Virtual
Client IP Addresses
Adapter address space if both are used.
(page 785).)
Backup gateways to contact in case there is a
disruption at the gateway end (in the order of
Backup Gateways
contact). This feature requires StoneGate IPsec
VPN Client version 5.1 or higher.
Cipher Algorithms
AES-128
AES-256
3DES These are the supported algorithms for the
VPN Profile element Message Digest Algorithms current version of StoneGate VPN clients.
properties MD5
IKE (Phase 1) tab SHA-1
(See Defining IKE SHA-256
(Phase 1) Settings Diffie-Hellman Group
for a VPN Not supported by StoneGate VPN clients.
1 (768 bits)
(page 735).)
Authentication Methods
Pre-shared key These settings have no effect on VPN client
Negotiation Mode connections. See VPN Client tab instead.
Authentication Mode
List of VPN Client Settings in the Management Client 783

Table 53.1 VPN Client Settings in the Management Client (Continued)

Cipher Algorithms
AES-128
AES-256
AES-CGM These are the supported algorithms for the
3DES current version of StoneGate VPN clients.
VPN Profile element Message Digest Algorithms AES-XCBC-MAC requires StoneGate VPN client
properties AES-XCBC-MAC version 5.0 or higher.*
IPsec (Phase 2) MD5
tab SHA-1
(See Defining IPsec SHA-256
(Phase 2) Settings
for a VPN IPsec Type Only ESP is supported.
(page 737).) Not supported in StoneGate IPsec VPN Client
Compression Algorithm
(and Firewall/VPN engine) versions 4.2 and
Deflate
4.3. Other versions support this option.
PFS Diffie-Hellman Group

Not supported by StoneGate VPN clients.
1 (768 bits)
The selected authentication method used with

Authentication Method
StoneGate VPN clients.
StoneGate VPN Clients support only the more

Negotiation mode
secure main mode. This setting cannot be
Main
deactivated.
The VPN client users authenticate by username

and password (or other type of passcode) and
Allow Hybrid Authentication
the gateway authenticates itself to the client
with a certificate.
Allows authentication using the common name

VPN Profile element
in the certificate as the user name. The CN is
properties Allow CN authentication
checked against a value entered in the User
VPN Client tab
elements.
(See Defining VPN
Client Settings Allow Pre-Shared Key This setting has no effect on StoneGate VPN
(page 740).) Authentication (Aggressive client connections, as pre-shared key
Mode Allowed) authentication is not supported.
Defines whether SAs are negotiated per

Security Association network or per each connecting IP address.
Granularity Only SA Per Net is supported by StoneGate
IPsec VPN Clients.
Defines whether the IPsec VPN Client checks

for the presence of basic security software to
Local Security Checks stop connections from risky computers.
This feature requires StoneGate IPsec VPN
Client version 5.0 or higher.

Table 53.1 VPN Client Settings in the Management Client (Continued)

This setting has no effect on VPN client
VPN element connections. Pre-shared keys for VPN client
Pre-shared key fields
Tunnels tab connections are defined per-user account in
the User elements.
*)The Russian product version has no strong encryption algorithms.
Managing VPN Client IP Addresses

There are two different methods to define the IP addresses VPN clients use in the internal
network. You must always configure one or the other when you want to create a client-to-gateway
VPN for the VPN to be valid. The methods are as follows:
1. You can use NAT to translate the IP addresses in communications, which gives the VPN
Clients an ‘internal’ IP address in the internal network without the need for a DHCP
server. This is called a NAT Pool.
• This method is not recommended for StoneGate IPsec VPN Clients, because it does not
allow the clients to make queries to internal DNS servers without manual configuration.
• NAT rules must not be applied to communications from clients that receive their address
through the NAT Pool feature (which also uses NAT).
• The NAT Pool method does not require any additional client-side features.
2. (Recommended for StoneGate IPsec VPN Clients) You can use a DHCP server to assign the
VPN clients a second, virtual IP address that is used in communications through the VPN
tunnel. The IP address is attached to a Virtual Adapter. Using this method provides the
following benefits over the NAT Pool:
• Centrally configure the DNS settings to any version of StoneGate IPsec VPN Clients when
connected (using the DHCP server).
• Control the IP address each VPN Client is assigned (depending on the DHCP server).
• Forward client-to-gateway VPN traffic to a site-to-site VPN and/or route the Internet traffic
from the client computer through the gateway for inspection.
• Open new connections also from the internal network to the VPN Client computers
through the VPN.
• To use the Virtual Adapter, the VPN client software must support this feature. All third-
party VPN clients do not have a Virtual Adapter feature.
Third-party VPN clients do not necessarily require utilizing either of these methods if the
communications can use a locally configured IP address. StoneGate VPN clients always require
either the NAT Pool or the Virtual Adapter. Activating both the NAT Pool and the Virtual Adapter is
technically possible, but the NAT Pool address translation is applied to all VPN client traffic
when activated, including connections from hosts that use a Virtual Adapter.
What’s Next?
 Configuring NAT Pool for VPN Clients (page 786)
 Configuring Virtual IP Addressing for VPN Clients (page 787)
Related Tasks
 For a detailed technical discussion on using a virtual IP address, see RFC 3456.
Managing VPN Client IP Addresses 785

Configuring NAT Pool for VPN Clients
The NAT pool defines a range of IP addresses that the firewall can use to translate the source
address of connections from mobile VPN clients. The NAT pool translates the addresses in the
same way as NAT rules do. Connections that use the NAT Pool must not match any NAT rules.
Note – Make sure NAT is enabled for this VPN. The Enable NAT with this VPN option in
the properties of the VPN element must be selected. Otherwise, the NAT pool options have
no effect.
 To define the NAT Pool

1. Open the properties of the Firewall element.
2. Switch to the Advanced Settings tab.
3. Click the VPN Settings button. The VPN Settings dialog opens.
Illustration 53.1 VPN Settings
4. Select the Translated IP address (using NAT Pool) option.
Note – If the NAT Pool is active, it is used for translating connections from VPN clients that
have a virtual IP address. It is not possible to exclude hosts with a virtual IP address from
being subject to the NAT Pool address translation.
5. Enter the IP addresses and ports you wish to use for translating VPN client traffic in IP
Range and Port Range.
Caution – Make sure the addresses you define here do not overlap with addresses that are
in use in your networks. Also, the addresses must not overlap with any translated address
space in your NAT rules.

Configuring Virtual IP Addressing for VPN Clients
This feature requires:
• That you use an external DHCP server to assign the IP addresses.
• That the users use a VPN client that has a Virtual Adapter feature. All StoneGate IPsec VPN
Clients always have this feature installed and active.
The Virtual Adapter assigns the VPN client a second IP address for communications through the
VPN, independent of the address the VPN client computer uses in its local network.
Most DHCP servers allow a configuration in which a particular client computer is always
assigned a particular IP address, for example, based on the MAC address (if VPN clients are set
fixed MAC addresses for their Virtual Adapters).
What’s Next?
 To configure virtual addressing, proceed to Configuring the Gateway for Virtual IP
Address Clients.
Configuring the Gateway for Virtual IP Address Clients

 To define Virtual IP Addressing for VPN Clients
Configuration view.
2. Select the Gateways branch in the element tree and double-click the Gateway to which VPN
clients will connect.
3. Switch to the VPN Client tab.
Illustration 53.2 Internal Security Gateway Properties - VPN Client
4. Select the Virtual IP Address (using Virtual adapter) option. The other options beneath
are enabled.
5. (Optional) Select Use Proxy ARP to make the firewall/VPN engine act as a proxy for the
VPN client’s ARP requests and click the corresponding Edit button to select the address
range to define the scope for this option.
Note – The Proxy ARP option may be required for a working VPN depending on your
Managing VPN Client IP Addresses 787

6. (Optional) Select Restrict Virtual Address Ranges and click Edit to select IP addresses
that the DHCP is allowed to assign.
• With this option, you can enforce that the VPN clients’ addresses stay within a set range,
even if the DHCP server tries to assign some other IP address. If an incorrect address is
assigned, the user may not be able to access resources.
• These address ranges must not overlap with the NAT Pool. The NAT Pool configuration is
shown for your reference at the bottom of the VPN Client tab.
Note – If the NAT Pool is active, it is used for translating connections from VPN clients that
have a virtual IP address. It is not possible to exclude hosts with a virtual IP address from
being subject to the NAT Pool address translation.
7. Select Use DHCP to define DHCP settings for the VPN clients.
8. Click the DHCP Servers button and select the correct DHCP Server element.
9. (Optional) Select the Use Local Relay option to force the use of unicast DHCP relay
messages for VPN clients’ DHCP requests even if the DHCP server is in a directly
connected network in relation to the firewall engine.
• By default, the firewall/VPN engine sends a normal DHCP client broadcast message to a
DHCP server located in a directly connected network.
• Unicast DHCP relay messages are always used when sending the DHCP requests to DHCP
server that is behind an external gateway device.
10.(Optional) Select Add User information or Add Group information to add the VPN Client
user or user group information (in the form: user@domain or group@domain) to the DHCP
Request packets’ Remote ID option field.
• Your DHCP server must support the DHCP Relay Agent Information option to use this
information.
• Depending on your DHCP server configuration, this information can be used as a basis for
IP address selection.
11.Choose one NDI address in NDI for DHCP Relay to be used as the source address for the
DHCP packets when querying the DHCP server (the interface towards the DHCP server).
12.If you have a specific need to do so, you can change the largest allowed packet size for the
relayed DHCP requests in the Max Packet Size drop-down list.
What’s Next?
 DHCP relay is not allowed in the Default template. To allow this traffic, continue the
configuration in Allowing DHCP Relay in the Policy (page 789).

Allowing DHCP Relay in the Policy
DHCP relay is not allowed in the default template. However, there is a ready-made DHCP relay
sub-policy that you can use in your own policy.
Note – The sub-policy also contains rules for local DHCP relay between internal networks.
If just one of these DHCP relay features is active, the rules for the other feature are invalid
and ignored when the policy is installed.
 To activate the DHCP relay sub-policy

1. Open the firewall’s policy (or a template policy) for editing.
2. Insert a rule that redirects the inspection to the DHCP relay subrules:
• Source, Destination, and Service: right-click each cell and select Set to ANY.
• Action: Click the cell and select Jump from the list that opens. Select DHCP Relay and
click Select.
What’s Next?
 Refresh the firewall’s policy before using this configuration.
Exporting VPN Client Configuration to a File

Prerequisites: The client-to-gateway VPN must be fully configured, see Getting Started With IPsec VPNs
You can export the settings for StoneGate IPsec VPN Clients from the Management Center. This
allows deploying new clients without requiring the users to add the VPN gateways manually.
 To export the StoneGate IPsec VPN Client configuration

Configuration view.
2. Select the Gateways branch in the element tree and right-click the Gateway to which VPN
clients will connect.
3. Select ToolsSave Gateway Contact Information and save the resulting file.
Generate a separate file for each gateway to which clients directly connect.
What’s Next?
 Make the configuration available to VPN Clients as explained in the StoneGate IPsec
VPN Client Administrator’s Guide.
Exporting VPN Client Configuration to a File 789

M AINTENANCE AND
U PGRADES
In this section:
Backing up and Restoring System Configurations - 793
Managing Log Data - 799
Managing and Scheduling Tasks - 813
Managing Licenses - 823
Upgrading the Management Center - 833
Upgrading the Engines - 839
Manual Dynamic Updates - 845
791
792
C HAPT ER 54
BACKING UP AND RESTORING SYSTEM

CONFIGURATIONS
Backups contain the necessary configuration information to restore the SMC to the state it
was in when the backup was taken, including the configuration information for the firewall and
IPS engines that the Management Server stores.
Getting Started with Backups (page 794)

Creating Backups (page 795)
Storing Backup Files (page 796)
Restoring Backups (page 796)
Recovering from a Hardware Failure (page 798)
793
Getting Started with Backups
Prerequisites: None
What Backups Do
Backups allow you to save and restore StoneGate Management Server and Log Server
configurations on the same system or a different physical host.
• The Management Server backup contains the policies, elements, and other essential
configuration details for all Firewall/VPN and IPS components that they manage, as well as
the configuration of the Management Server itself.
• The Log Server backup contains the Log Server’s local configuration and optionally the logs.
Restoring the backups allows you to restore the SMC configurations to the exact same state as
they were when taking the backup even if you restore it on a completely new installation.
Backups are needed to recover from the loss of the system configurations, for example, due to
hardware failure. A backup also allows you to relocate the SMC servers onto different hardware.
Limitations
The private keys of engine certificates are stored locally on the engines and are not backed up.
The Management Server is the only place that contains usable, complete configuration
information for any individual engine component in the system. The engines contain a working
copy of the configuration details that allows them to carry out traffic inspection independently,
but it is not possible to extract this information from the engines in the event that the
Management Server is lost. Regular Management Server backups are therefore essential and
must be stored in a safe storage location outside the Management Server host machine.
Always take the backups using StoneGate’s internal backup tool. External backup applications
that back up the host server may not produce usable backups of your StoneGate system,
especially if the StoneGate servers are running at the time the backup is taken.
Backups from the previous major version of StoneGate can always be restored in the current
major version of StoneGate. Backups taken from older versions may not always be restorable.
Generally, backups can be restored between versions that support direct upgrades between the
versions (see the Release Notes for version-specific details).
Note – If your configuration contains elements for HTTPS Inspection, the private keys and
certificates of the Server Protection Credentials and Client Protection Certificate
Authorities are included as plain text in the Management Server backup. Use the
encryption option for the backups when the configuration contains elements for HTTPS
Inspection. For more information, see Setting up HTTPS Inspection (page 655).
1. Backup up the Management Server(s) and Log Server(s) regularly as instructed in
Creating Backups (page 795) or schedule backup tasks to run at regular intervals as
instructed in Creating Backup Tasks (page 817) and Scheduling Tasks (page 820).
2. Store the backup files in a safe location as instructed in Storing Backup Files (page 796).
3. When necessary, restore a backup as instructed in Restoring Backups (page 796).
794 Chapter 54 Backing up and Restoring System Configurations

Creating Backups
Prerequisites: None
Management Server backups include all configuration information, including licenses, the
server components’ certificates needed for system communications, the root CA, and locally-
stored user accounts. The configurations you create in the SMC for the engine components is
included in the Management Server backup, so these components do not have to be separately
backed up.
The Log Server backup contains the Log Server configuration information and optionally also the
log data stored on the server. There is a configurable limit to how large the Log Server backup
can be.
The directions below explain how to use the Management Client to take and manage the
backups. It is also possible to create backups on the command line, see Command Line Tools
(page 917). The backup file itself is the same regardless of the method used.
Note – To back up the Management Server, there must be enough free disk space on the
server. Twice the size of the management database is required. If there is not enough
available disk space, the backup process does not start.
 To create backups
1. Select FileSystem ToolsBackup. The Backup Task Properties dialog opens.
2. Select the server(s) you want to back up from the list on the left and click Add. The
selected server(s) are added to the list on the right.
3. (Optional) If you want to create an encrypted backup, select Encrypted, and enter and
confirm a password.
• We recommend using this option if the configuration contains elements for HTTPS
Inspection.
4. (Optional) If you are creating a backup of Log Server(s) and you want to back up the log
files, select Back up Log Files.
5. Click OK. The progress is shown on a new tab.
What’s Next?
 Copy the backup files from the backup directory to a separate, safe location for storage,
see Storing Backup Files (page 796).
Related Tasks
 If you want to create backup tasks and schedule them to run at regular intervals, see
Creating Backup Tasks (page 817) and Scheduling Tasks (page 820).
 To back up and delete log data with the log management tools, see Getting Started with Log
Data Management (page 800).
Creating Backups 795

Storing Backup Files
Prerequisites: Creating Backups
The backup files are saved in the <installation directory>/backups/ directory on the
server on which they were created. We recommend copying the backup file to a safe location, for
example, to removable media or another host. Otherwise, you will have to manually recreate all
configurations if the data on the host computer is irrecoverably lost.
The backups files are compressed to .zip files or .enc files and they can also be
decompressed manually if needed. If necessary, the backups are split into several files to fit the
maximum file size. Each backup has its own subdirectory.
Note – Remember to handle the backup files securely, since they contain all the
configuration information for the system.
 To store backup files

1. Browse to the backup directory on the Management Server or Log Server:
• Backup files are stored in the <installation directory>/backups directory or a
subdirectory under it.
• Unencrypted backups are .zip files.
• Encrypted backups are .enc files.
2. Copy the backup files to a safe storage location.
Restoring Backups
StoneGate backups created in one operating system can be restored to an installation running
on some other operating system without any special measures. This is useful when changing
the operating system or hardware platform.
See the upgrade instructions in the Release Notes. If an intermediate upgrade is required
between your current version and the newest version, upgrade the existing installation to (at
least) the intermediate version to create a working backup.
There are special scripts for Management Server High Availability for restoring a Management
Server backup to a machine other than the one where it was created. For more information
about the scripts, see Command Line Tools (page 917).
When you restore a backup, StoneGate checks that there is enough disk space on the
destination drive. Twice the size of the backup file is required. If there is not enough available
disk space, the restoration process fails.
It is also possible to restore backups on the command line. For more information, see
Command Line Tools (page 917).
What’s Next?
 To restore a Management Server backup, see Restoring a Management Server Backup
(page 797).
 To restore a Log Server backup, see Restoring a Log Server Backup (page 797).

Restoring a Management Server Backup
If you are restoring the backup to clear a dynamic update package from your system, disable the
automatic updates before restoring the backup.
 To restore a Management Server backup

1. Check that the backup file is in the <installation directory>/backups/ directory of
the server in question.
• If you have moved the backup file to a different location, you must first copy it back to the
<installation directory>/backups/ directory.
2. Shut down the StoneGate Management Server service through the operating system’s
service management feature or using the StoneGate script.
• If you have trouble shutting down the services, disable the automatic startup of
StoneGate services in the operating system and restart the computer.
3. Start the backup restoration script:
• In Windows, run <installation directory>/bin/sgRestoreMgtBackup.bat
• In Linux, run <installation directory>/bin/sgRestoreMgtBackup.sh
4. Select the backup file to be restored: The default Management Server backup file names
have the following structure: sgm_vVERSION.[BUILD]_YYYYMMDD_HHMMSS[comment].
5. Type y and press enter to confirm the restoration. Encrypted backups require you to enter
the password that was used to encrypt the backup when it was created.
If the restore operation fails, the original configuration remains unchanged.
What’s Next?
 If the backup is restored on a system that uses a different IP address than the
Management Server that the backup is from, you must complete the relevant steps to
change the IP address, see Changing the Management Server’s IP Address (page 304).
 The backup contains the internal CAs (certificate authorities). If components in the
system have certificates from a different CA than the one contained in the backup, the
certificates are not accepted as valid after restoring the backup and have to be
regenerated as explained in Troubleshooting Certificates (page 867).
 Otherwise, start the Management Server.
Restoring a Log Server Backup

 To restore a Log Server backup
1. Check that the backup files are in the <installation directory>/backups/ directory of
the server in question.
• If you have moved the backup files to a different location, you must first copy them back
to the <installation directory>/backups/ directory.
2. Shut down the StoneGate Log Server service through the operating system’s service
management feature or using the StoneGate script.
• If you have trouble shutting down the services, disable the automatic startup of
StoneGate services in the operating system and restart the computer.
3. Start the backup restoration script:
• In Windows, run <installation directory>/bin/sgRestoreLogBackup.bat
• In Linux, run <installation directory>/bin/sgRestoreLogBackup.sh
Restoring Backups 797

4. Select the backup file to be restored: The default Log Server backup file names have the
following structure: sgl_vVERSION.[BUILD]_YYYYMMDD_HHMMSS[comment].
5. Type y and press enter to confirm the restoration. Encrypted backups require you to enter
the password that was used to encrypt the backup when it was created.
If the restore operation fails, the original configuration remains unchanged. If it is not possible
to transfer the logs through a backup, log files can be copied to the Log Server through the
operating system like any other files.
What’s Next?
 If you restore the Log Server backup on a computer with a different IP address than the
Log Server the backup was created with, complete the relevant steps in Changing the
Log Server’s IP Address (page 305).
 Otherwise, restart the Log Server and the Management Server.
Recovering from a Hardware Failure

 To restore Management Server configurations on replacement hardware

1. Install the Management Server software (see the Management Center Installation Guide).
Exact same version is not required for recovery, but all SMC components must run the
same version to work together.
2. Restore the Management Server backup as explained in Restoring a Management Server
Backup (page 797).
 To restore Log Server configurations on replacement hardware

1. Install the Log Server software, if not installed together with the Management Server
software (see the Management Center Installation Guide). Exact same version is not
required for recovery, but all SMC components must run the same version to work together.
2. Restore the Log Server backup as explained in Restoring a Log Server Backup (page 797).
 To restore firewall and IPS engine configurations on replacement hardware

1. Generate an initial configuration for the engine in the SMC as explained in Saving an Initial
Configuration for Firewall or IPS Engines (page 393).
2. Install the hardware into the network and configure in the same way as a normal new
installation (see the Installation Guide or Appliance Installation Guide).
3. When contact with the Management Server is established, install the policy. The full
working configuration is transferred to the engine.
Note – In some cases, IPsec VPN certificate information may be lost and policy installation
fails. If this happens, delete the old IPsec VPN certificates in the Management Client and
create new VPN certificates for the engine. When you use the same CA and certificate
details, the new certificates are accepted by other components. Policy installation is also
possible if you disable the invalid configurations (for example, by disabling all VPN-specific
Access rules in the policy). See Creating and Signing VPN Certificates (page 759).

C HAPT ER 55
MANAGING LOG DATA
Logs must be actively managed to prevent the Log Server from filling up the hard disk with
logs. StoneGate tools help you manage the generated log entries automatically according to
settings you define.
Getting Started with Log Data Management (page 800)

Defining When Logs Are Generated (page 801)
Archiving Log Data (page 802)
Deleting Log Data (page 805)
Exporting Log Data (page 809)
Viewing a History of Executed Log Tasks (page 812)
799
Getting Started with Log Data Management
Prerequisites: None
Any Log Server will gradually fill up completely if log data is never removed. You must actively
manage the log data to prevent this from happening.
What Log Management Tools Do
You can manage the log data in the following ways:
• Export log data so that it can be used elsewhere.
• Copy log data to an archive location.
• Delete old or unnecessary log data.
• Set up automatic log management tasks for exporting, copying, and removing selected data.
• Reduce the amount of logs by pruning some of the log entries before they are stored on the
Log Server. However, preventing the unwanted log entries from being created should always
be preferred over pruning to avoid unnecessary use of resources.
Limitations
Only the logs in the active storage are used in reporting. If you archive logs, you can still view
them in the Logs view, but they are no longer available when you generate reports (see Reports
(page 145)).
Alert and audit logs cannot be pruned.
1. Tune your system to generate the log entries you need. See Defining When Logs Are
Generated (page 801).
2. (Optional) Set up log archiving to store older important logs for possible later use and free
up the space on the Log Server, see Archiving Log Data (page 802).
3. (Recommended) Set up scheduled log data tasks for deleting logs that are not needed in
the long term. See Deleting Log Data (page 805).
4. (Optional) Configure log pruning to prune out any unnecessary logs if any are generated.
See Pruning Log Data (page 807).
Related Tasks
 Changing Log Server Configuration Parameters (page 279)
 Exporting Log Data (page 809)
 Exporting Log Data to Syslog (page 282)
 To export and archive log data directly from the Logs view, see Exporting Extracts of Log
Data (page 141).
800 Chapter 55 Managing Log Data

Defining When Logs Are Generated
Prerequisites: None
Normal and Alert logs are generated both based on internal conditions in the operation of a
component and based on traffic that the engines handle.
Internal conditions that trigger logs or alerts:
• There is a system error or warning.
• An engine test fails. You can configure the engine tester in detail and select whether test
failures trigger an alert as explained in Configuring the Engine Tester (page 397).
• The status of an engine changes (not active by default). See Enabling/Disabling Engine
Status Monitoring (page 192).
• When the values of a monitored item exceed a threshold limit in an Overview (not active by
default), see Setting Thresholds for Monitored Items (page 96).
• Diagnostics are active on a firewall engine (not active by default), see Enabling/Disabling
Firewall/VPN Diagnostics (page 193).
Traffic conditions that trigger logs and alerts:
• A sensor engine’s limit for the number of times tunneled traffic is rematched has been
reached (not active by default), see Adjusting Sensor Advanced Settings (page 428).
• Traffic matches a rule in your policy, see Getting Started with Editing the Rules in Policies
(page 510).
• Diagnostics are active on an engine (not active by default), see Enabling/Disabling Firewall/
VPN Diagnostics (page 193).
Additionally, you can set up Log Servers to receive logs from any devices that can be set up to
send syslog, see Monitoring Third-Party Devices (page 111).
In addition to activating and deactivating logging and the features listed above, you can optimize
the number of generated logs in the following ways:
• You can configure in the Sensor properties that the Sensor automatically drops duplicate log
entries as explained in Adjusting Sensor Advanced Settings (page 428).
• You can also configure log compression for antispoofing and Discard logs on firewall engines
as explained in Configuring Log Handling Settings (page 426).
What’s Next?
 To archive (and delete) logs, see Archiving Log Data (page 802).
 To remove unnecessary logs, see Deleting Log Data (page 805).
Defining When Logs Are Generated 801

Archiving Log Data
Prerequisites: None
You can set up an Archive Log Task for copying log data from the active storage on the Log or
Management Server to some other location. The same task can also delete the log data from
the active storage, so that you do not have to set up a separate task for freeing up the space.
By default, the log archive location is on the same disk drive as the active storage. To change
the archive folder, see Changing Log Server Configuration Parameters (page 279).
Note – The Archive Log Task copies the existing log files without compression. This enables
you to view the archived logs in the Logs view but they are not used in the Reports view
when reports are generated.
What’s Next?
 Start by Creating an Archive Log Task.
Creating an Archive Log Task

 To create an Archive Log Task
2. Right-click Tasks in the Administration tree and select NewArchive Log Task from the
menu. The Archive Log Task Properties dialog opens.
Illustration 55.1 Archive Log Task Properties - Genera Tab
3. Enter a unique Name and an optional free-form Comment for your own reference.
4. Select the server from which the logs are archived and click Add.
What’s Next?
 Continue by Selecting Log Data for Archiving (page 803).

Selecting Log Data for Archiving
 To select log data for archiving
1. In the Archive Log Task properties, switch to the Task tab.
Illustration 55.2 Archive Log Task Properties - Task Tab
2. Select the type of log data for archiving by checking the Target Data options.
3. Select the Time Range of the log entries.
• You have several options to limit the time range. For example, select Absolute Time
Range in the Time Range list and define the Start and End Time.
4. (Optional) Specify a script in the Script to Execute After the Task field. The Log Server
triggers this script after completing the task.
What’s Next?
 Continue by Selecting Operation Settings for Archiving Log Data (page 804).
Archiving Log Data 803

Selecting Operation Settings for Archiving Log Data
 To select operation settings for archiving log data
1. In the Archive Log Task properties, switch to the Operation tab.
Illustration 55.3 Archive Log Task Properties - Operation Tab
2. (Optional) Select the Filter for Copying. For instructions on how to define filters, see
Filtering Data (page 159).
3. In the Source Data Deletion section, select whether the data to be archived is kept in
active storage after it has been copied to the target location. You can also select that the
task removes some other data from the active storage (for example, the archive operation
can copy important logs from within the time range and then clear the active storage of all
logs within the time range).
• If you want to delete the archived data from the active storage, select the Delete Source
Data option.
• If you want to delete some other data from active storage while you archive data, select
the Delete Other Data option and optionally a log filter for deleting the other data.
4. Select the Archive Target Directory from the list. The directory is determined in the Log
Server’s configuration file (LogServerConfiguration.txt). See Changing Log Server
Configuration Parameters (page 279) for details.
5. Click OK.
The task appears under Task Definitions in the Tasks branch of the Administration tree. You can
run the task either manually or according to a fixed schedule.
What’s Next?
 To run the task manually, see Starting Tasks Manually (page 821).
 To make the task run automatically, see Scheduling Tasks (page 820).
Related Tasks
 Viewing Logs From Specific Servers and Archive Folders (page 136)

Deleting Log Data
Prerequisites: None
To permanently remove generated log data, you can delete it from the active storage or delete it
as it arrives to the Log Server using pruning filters.
What’s Next?
 To delete stored log data, proceed to Creating a Delete Log Task.
 To delete log data as it arrives on the Log Server, see Pruning Log Data (page 807)
Creating a Delete Log Task

The recommended way to delete logs is to set up a Delete Log Task. In an emergency, you can
also delete some of the log files from the Log Server (the default location for logs is in the
<installation directory>/data/storage folder).
 To create a Delete Log Task

2. Right-click Tasks in the Administration tree and select NewDelete Log Task from the
menu. The Delete Log Task Properties dialog opens.
Illustration 55.4 Delete Log Task Properties - General Tab
4. Select the server from which the logs are deleted and click Add.
What’s Next?
 Continue by Selecting Data for Deleting Logs (page 806).
Deleting Log Data 805

Selecting Data for Deleting Logs
 To select data for deletion
1. In the Delete Log Task properties, switch to the Task tab.
Illustration 55.5 Delete Log Task Properties - Task Tab
2. Select the type of log data for deletion by checking the Target Data options.
What’s Next?
 Continue by Selecting Operation Settings for Deleting Logs.
Selecting Operation Settings for Deleting Logs

 To select operation settings for deleting logs
1. In the Delete Log Task properties, switch to the Operation tab.
Illustration 55.6 Delete Log Task Properties - Operation Tab
2. (Optional) Select a log filter that defines which log entries are deleted. For instructions on
how to define filters, see Filtering Data (page 159).
3. Click OK.

The task appears under Task Definitions in the Tasks branch of the Administration tree. You can
run the task either manually or according to a fixed schedule.
Caution – When this task is started (either manually or as you schedule it), all logs
matching the selected filter and time range are permanently deleted from the active
storage. Make sure that the data you want to keep is exported and/or copied to a safe
location before the operation is started.
What’s Next?
Pruning Log Data

Log data pruning allows you to discard some of the generated logs according to detailed filtering
criteria you set. You can prune Log Entries as soon as they arrive on the Log Server or before
they are stored (allowing you to still view them in the Current logs view).
Use pruning with caution. The data is deleted without leaving any traces and there is no way to
recover incorrectly pruned entries. Pruning also wastes resources compared to preventing the
entries from being generated, since pruned entries still have to be created and transferred to
the Log Server, and the Log Server still has to process them. To prevent log entries from being
generated, see Defining When Logs Are Generated (page 801).
You can prune normal log entries; alert and audit entries cannot be pruned. The logs are pruned
using log filters. If you need more information on Log Filters, see Filtering Data (page 159).
Note – Pruning has no effect on logs that have already been stored. See Deleting Log Data
(page 805) on how to delete stored data.
 To prune log data

1. Select ConfigurationLog Data Pruning from the menu. The Log Pruning view opens.
Illustration 55.7 Log Data Pruning
Deleting Log Data 807

2. Select the tab of the log data type you want to prune.
3. Select a log filter for pruning log data from the tree in the Resources panel. If you add
several Log Filters, they are combined with logical OR (each filter is matched individually, so
all logs that match any of the selected filters are deleted).
• You can also create a new Filter through the New icon above the list of Filters. For
instructions on how to create Filters, see Filtering Data (page 159).
Caution – Never select the Match All filter for log pruning. Pruning with the Match All filter
irreversibly destroys all new logs that are created.
4. Activate the pruning for the correct stage:

• Click Add below the Immediate Discard field to prune logs before they are even shown in
the Current Logs view.
• Click the Add button below the Discard Before Storing field to show the log entries in the
Current Logs view and then delete them before they are permanently stored.
Caution – Any log entry that matches the filter you have selected is irrevocably deleted.
The changes you make to pruning filters are applied immediately.
5. A warning message is displayed. Click Yes to prune the selected log entries. This change is
applied immediately without any further action.
Related Tasks
 Disabling Pruning Filters (page 808)
 Deleting Log Data (page 805)
Disabling Pruning Filters

Pruning filters are disabled by removing them from the Log Data Pruning panels. An empty panel
means that no logs are pruned.
 To remove filters from log pruning

1. Select ConfigurationLog Data Pruning from the menu. The Log Data Pruning view opens.
2. Select the correct tab according to log data type.
3. Select the filter you want to remove from pruning in the Immediate Discard or Discard
Before Storing field.
4. Click the Remove button below the field that contains the filter.
Note – Log Filters that are removed from pruning remain available for other use until you
delete them separately.
5. Click OK in the dialog that is displayed to affirm this action. This change is applied
immediately without any further action.

Exporting Log Data
Prerequisites: None
Following the steps here, you can set up a Log Export task, which can be used in manual and
scheduled export operations to export a specific log data set from the Log Server and the
Management Server log storages.
You can also export extracts of log data while browsing logs, see Exporting Data from the Logs
View (page 141).
To send log data to external monitoring products, see Exporting Log Data to Syslog (page 282).
What’s Next?
 Start by Creating an Export Log Task.
Creating an Export Log Task

 To create an Export Log Task
2. Right-click Tasks in the Administration tree and select NewExport Log Task from the
menu. The Export Log Task Properties dialog opens.
Illustration 55.8 Export Log Task Properties - General Tab
4. Set the Operation Type to select the format for the exported data:
• Export XML: logs are exported in XML format
• Export CSV: logs are exported in CSV (comma-separated value) format
• (For exporting IPS traffic recordings) Export IPS Recordings as PCAP: IPS recording file is
converted to PCAP format that is compatible with “sniffer” tools such as tcpdump,
WinDump, or Wireshark.
• (For exporting IPS traffic recordings) Export IPS Recordings as Snoop: IPS recording file
is converted to Snoop format that is compatible with “sniffer” tools such as Wireshark.
Exporting Log Data 809

5. Select the server from which the log data is exported and click Add.
What’s Next?
 Continue by Selecting Data for Log Export.
Selecting Data for Log Export

 To select data for log export
1. In the Export Log Task Properties, switch to the Task tab.
Illustration 55.9 Export Log Task Properties - Task Tab
2. Select the type of log data for export by checking the Target Data options.
• If you selected Export IPS Recordings as PCAP or Export IPS Recordings as Snoop as
the Operation Type on the General tab, IPS Recording is automatically selected.
What’s Next?
 Continue by Selecting Operation Settings for Log Export.

Selecting Operation Settings for Log Export
 To select operation settings for log export
1. In the Export Log Task Properties, switch to the Operation tab.
Illustration 55.10 Export XML Task - Operation Tab
2. Select the Storage Directories to Export From:

• Default: the directory where active log data is stored on the selected server.
• Primary Archive: the directory where archived log data is stored.
• Custom: allows you to select one or more directories from the list.
3. (Optional) Select the Filter for Exporting. For instructions on how to define Filters, see
Filtering Data (page 159).
4. (Optional; IPS traffic recordings only) Enter the IPS Record ID of the traffic capture.
5. Define the destination file location:
• Server: file is exported to the export directory on the server.
• Local Workstation: file is exported to the workstation you are using.
6. Specify a name for the destination file (for example, “Mediumalerts.xml”) or click Browse to
browse for an existing export file.
7. In If file already exists, specify what happens when a previous file with the same name
exists in the same folder:
• Append: the new data is inserted at the end of the existing file.
• Overwrite: the previous file is replaced with the new export file.
• Use Number in File Name: a number is added to the end of the new file’s name.
• Fail Task: the operation is cancelled.
8. Click OK.
Exporting Log Data 811

The task appears under Task Definitions in the Tasks branch of the Administration view. If you
want to delete the data after exporting, set up a task for that as explained in Deleting Log Data
(page 805).
What’s Next?
Viewing a History of Executed Log Tasks

Prerequisites: Exporting Log Data / Archiving Log Data / Deleting Log Data
There is a history file from which it is possible to view all previously executed tasks related to
logs (Export Logs Tasks, Archive Log Tasks, and Delete Log Tasks). The system never erases
this file.
 To view previously executed Tasks

 Open the <installation directory>/data/logfile.txt file in a text editor to view
the previously executed tasks.

C HAPT ER 56
MANAGING AND SCHEDULING TASKS
Tasks define parameters of system maintenance operations. You can run maintenance
operations manually or automatically according to a schedule you set.
Getting Started with Tasks (page 814)

Task Types (page 815)
Creating New Task Definitions (page 817)
Scheduling Tasks (page 820)
Starting Tasks Manually (page 821)
Pausing the Scheduled Execution of a Task (page 821)
Cancelling a Task Schedule (page 821)
Starting Tasks Manually (page 821)
Stopping Task Execution (page 822)
813
Getting Started with Tasks
Prerequisites: None
What Tasks Do
With Task elements, you can start maintenance operations either manually or according to a
schedule. You can do the following maintenance with Tasks:
• Back up the Management and Log Server(s).
• Upload policies.
• Upgrade engine software remotely.
• Export, archive, and delete logs.
• Synchronize redundant Management Servers in a high-availability setup.
There are also certain pre-configured system tasks that run automatically in your system, and
which you can see when you work with Task elements.
Scheduling the tasks allows you to run regular or one-off maintenance operations automatically,
for example, during a regular maintenance window.
When scheduling automatic backups, you may want the data to be moved to a safe place
automatically. This can be achieved through operating system scripts, which Tasks can launch
upon completion. With Log Servers, you can change the backup and log archive locations in the
Log Server’s local configuration file.
See Task Types (page 815) for short descriptions of all Task types.
1. Define the Task parameters as explained in Creating New Task Definitions (page 817).
2. (Optional) Set up automatic Task execution as explained in Scheduling Tasks (page 820).
3. Run Tasks when necessary as described in Starting Tasks Manually (page 821).
Related Tasks
 Pausing the Scheduled Execution of a Task (page 821)
 Cancelling a Task Schedule (page 821)
 Stopping Task Execution (page 822)
814 Chapter 56 Managing and Scheduling Tasks

Task Types
Prerequisites: None
Tasks are based on Task Definitions. There are two kinds of Task Definitions: custom Task
Definitions and predefined System Task Definitions. To view Task Definitions or to create new
Task Definitions, browse to TasksTask Definitions in the Administration Configuration view.
Table 56.1 explains the types of custom Tasks that you can create.
Table 56.1 Custom Task Definitions
Task Definition Explanation

Creates backup files for the selected Management Server(s) and/or Log
Backup Task
Server(s). See Creating Backup Tasks (page 817).
Creates a ZIP file that contains copies of configuration files and system trace
SGInfo Task files for the selected component(s) for Stonesoft’s technical support. See
Creating SGInfo Tasks (page 820).
Refreshes the currently installed policy on the selected engine(s). See Creating
Policy Refresh Task
Policy Refresh Tasks (page 818).
Uploads the selected policy to the selected engine(s). See Creating Policy
Policy Upload Task
Upload Tasks (page 818).
Remotely upgrades the software on the selected engine(s). See Creating

Remote Upgrade Task
Remote Upgrade Tasks (page 819).
Copies log data from the active storage or archive to the selected location.
Export Log Task
See Exporting Log Data (page 809).
Copies log data from the active storage to the selected location. See Archiving
Archive Log Task
Log Data (page 802).
Delete Logs Task Deletes log data from the active storage. See Deleting Log Data (page 805).
In addition to Task Definitions that you create and customize, there are predefined Task
Definitions for several system tasks. You can run the System Tasks manually or reschedule
them, but you cannot change the options in System Task Definitions.
Table 56.2 System Task Definitions

Automatically creates a snapshot of all system elements after an update
Create Snapshot of
package has been activated. The snapshot information is used when
All System Elements
administrators compare policy snapshots.
Delete Old Executed

Deletes old entries from the list of Executed Tasks.
Tasks
Delete Old Deletes old Policy Snapshots. For more information about Policy Snapshots,
Snapshots see Checking and Comparing Policy Versions (page 504).
Task Types 815

Table 56.2 System Task Definitions (Continued)

Disables the accounts of administrators who have not been active within the
time period defined in the SGConfiguration.txt file. The accounts are
Disable Unused
disabled if the Enforce Password Settings option is enabled for Administrators
Administrator
in the Access Rights branch of the Administration Configuration view. An
Accounts
Administrator with unrestricted privileges can re-enable the disabled accounts.
See Defining Password and Login Settings for Administrators (page 223).
Connects to the CRL servers defined in Trusted Certificate Authority elements

Refresh Certificate
(see Defining Trusted Certificate Authorities for HTTPS Inspection (page 662))
Revocation Lists
and refreshes the certificate revocation lists on engines.
Renew Gateway Generates new certificates for internal gateways if automatic certificate
Certificates renewal is enabled in the internal gateways' properties.
Renew Internal Checks the status of internal certificate authorities for automatic renewal. To
Certificate ensure that the automatic certificate authority renewal works correctly, do not
Authorities change the schedule of this Task.
Checks the status of internal certificates for automatic renewal. To ensure that
Renew Internal
the automatic certificate renewal works correctly, do not change the schedule
Certificates
of this Task.
Synchronize Transfers the configuration changes made on the primary Management Server
Management Server to the secondary Management Server(s) when one or more secondary
Databases Management Servers are used for high availability.
Upload Gateway and

Certificate Authority Uploads new IPsec VPN certificates to the firewall/VPN engines.
Certificates
What’s Next?
 Creating New Task Definitions (page 817).

Creating New Task Definitions
Prerequisites: None
You can create new Tasks to help you maintain your system. The available Task Definitions are
explained in Task Types (page 815). For log data tasks (Export/Archive/Delete), see Getting
Started with Log Data Management (page 800).
What’s Next?
 Creating Backup Tasks (page 817)
 Creating Policy Upload Tasks (page 818)
 Creating Policy Refresh Tasks (page 818)
 Creating Remote Upgrade Tasks (page 819)
 Creating SGInfo Tasks (page 820)
Creating Backup Tasks

 To create a Backup Task
2. Right-click Tasks and select NewBackup Task. The Backup Task Properties dialog
opens.
3. Give the task a descriptive Name and optionally a free-form Comment.
4. Select the server(s) you want to back up from the list on the left and click Add. The
selected server(s) are added to the list on the right.
5. (Optional) Write a Backup Comment, which is shown in the Management Client and added
to the backup file name.
6. (Optional) If you want to create an encrypted backup, select Encrypted, and enter and
confirm a password.
7. (Optional) If you are backing up Log Server(s), select the Back up Log Files option to back
up the logs in addition to the server’s configuration.
8. Click OK. The new Backup Task is added to the list of Task Definitions.
What’s Next?
 To make the Task run automatically, proceed to Scheduling Tasks (page 820).
 To start the Task now, proceed to Starting Tasks Manually (page 821).
Creating New Task Definitions 817

Creating Policy Refresh Tasks
 To create a Policy Refresh Task
opens.
4. Select the engine(s) on which you want to refresh the policy from the list on the left and
click Add. The selected engine(s) are added to the list on the right.
Note – If you want already established connections to continue using the same
configuration information (such as NAT rules), make sure Keep Previous Configuration
Definitions is selected.
5. (Optional) Leave Validate Policy before Upload selected if you want to validate the rules
when the Task is launched manually, and select the related settings. See Validating Rules
Automatically (page 556) for more information.
• Policy validation is possible if you select only one element for the Policy Refresh Task.
6. (Optional) Add an Upload Comment that is shown in Policy Snapshots created from the
policy installations.
7. Click OK. The new Policy Refresh Task is added to the list of Task Definitions.
What’s Next?
Creating Policy Upload Tasks

 To create a Policy Upload Task
opens.
4. Select the engine(s) or Log Server(s) you want to upload the policy to from the list on the
left and click Add. The selected engine(s) or Log Server(s) are added to the list on the right.
5. Click the Select button next to the Policy field. A list of policies opens.
6. Select the policy you want to upload and click Select.
Note – If you want already established connections to continue using the same
configuration information (such as NAT rules), make sure Keep Previous Configuration
Definitions is selected.

7. (Optional) Leave Validate Policy before Upload selected if you want to validate the rules
when the Task is launched manually, and select the related settings. See Validating Rules
Automatically (page 556) for more information.
• Policy validation is possible if you select only one element for the Policy Refresh Task.
8. (Optional) Add an Upload Comment that is shown in Policy Snapshots created from the
policy installations.
9. Click OK. The new Policy Upload Task is added to the list of Task Definitions.
What’s Next?
Creating Remote Upgrade Tasks

 To create a Remote Upgrade Task
opens.
4. Select the upgrade Operation:
• Remote Upgrade (transfer + activate) loads the new configuration and reboots the
node.
• Remote Upgrade (transfer) loads the new configuration without rebooting the node.
• Remote Upgrade (activate) reboots the node to activate a previously loaded
configuration.
Caution – Do not activate the new configuration simultaneously on all the nodes of a
cluster. If you want to schedule a Remote Upgrade Task for several nodes, create two
separate Remote Upgrade Tasks: one to transfer the new configuration and another to
activate it. Schedule the “Activate” Task to run only after the “Transfer” Task is complete.
See Scheduling Tasks (page 820).
5. Select the engine(s) that you want to upgrade from the list on the left and click Add. The
selected engine(s) are added to the list on the right.
6. Select the correct previously imported Engine Upgrade file for the upgrade.
7. Click OK. The new Remote Upgrade task is added to the list of Task Definitions.
What’s Next?
Creating New Task Definitions 819

Creating SGInfo Tasks
The SGInfo Task collects information about your system for Stonesoft’s technical support
personnel.
 To create an SGInfo Task

2. Right-click Tasks and select NewSGInfo Task. The Backup Task Properties dialog opens.
4. Select the engine(s) whose configuration files and system trace files you want to get from
the list on the left and click Add. The selected engine(s) are added to the list on the right.
5. Select Include Core Files to also include also the core files for troubleshooting, unless
instructed otherwise.
6. Click OK. The new SGInfo Task is added to the list of Task Definitions.
What’s Next?
Scheduling Tasks
Prerequisites: Creating New Task Definitions
After creating Task Definitions, you can schedule Tasks to run at a convenient time. If
necessary, you can also schedule System Tasks (see Task Types (page 815)).
 To schedule a Task
2. Browse to TasksTask Definitions. A list of defined Tasks opens.
3. Right-click the Task you want to schedule and select Schedule. The Task Properties window
opens.
4. Set the schedule properties:
• Repeat: how often to repeat the Task. If you select No, the Task is executed only once (at
the specified time).
• Start at: the date and time when the Task starts the first scheduled run.
Tip – The date and time can be entered manually in the format YYYY-MM-DD HH:MM:SS. You can also
right-click the Up or Down arrows next to the date field to select a date from the calendar.
5. Click OK. The schedule is added as a visible element under the Task Definition in question.

Starting Tasks Manually
Prerequisites: Creating New Task Definitions
If you want a Task to run immediately, you can start it from the Task Definitions list.
 To start a Task
2. Browse to TasksTask Definitions. A list of Task Definitions opens.
3. Right-click the task you want to start and select Start. The task starts and is added to the
list of Running Tasks.
Pausing the Scheduled Execution of a Task

Prerequisites: Scheduling Tasks
If you want to temporarily stop a Scheduled Task from running at the scheduled time, you can
suspend the Scheduled Task. When a Scheduled Task is suspended, it remains in the
Scheduled Task list, but it does not run at the scheduled time.
 To suspend a Scheduled Task

2. Browse to TasksTask Definitions. The Task Definitions list opens.
3. Expand the Task Definition you want to suspend. The schedule information for the task is
displayed as a branch below the Task Definition.
4. Right-click the schedule information and select Suspend. The task is suspended.
5. To restart a suspended task, right-click the schedule information and select Continue. The
task resumes and runs at the next scheduled time.
Cancelling a Task Schedule

Prerequisites: Scheduling Tasks
You can remove Tasks from the schedule by deleting the schedule information from the Task
Definition. Deleting the schedule information does not delete the Task Definition: the same Task
can be scheduled again.
 To remove a Task from the schedule

2. Browse to TasksTask Definitions. The Task Definitions list opens.
3. Expand the Task you want to remove from the schedule. The schedule information for the
task is displayed as a branch below the Task Definition.
4. Right-click the schedule information and select Delete. A confirmation dialog opens.
• The schedules of default System Tasks cannot be deleted.
5. Click Yes to confirm that you want to remove the selected Task from the Schedule. The Task
is removed from the Scheduled Tasks list.
Starting Tasks Manually 821

Stopping Task Execution
Prerequisites: Creating New Task Definitions, Scheduling Tasks, Starting Tasks Manually
 To abort a Running Task

2. Browse to TasksRunning Tasks. The Running Tasks list opens.
3. Right-click the Task you want to abort and select Abort. The execution stops.

C HAPT ER 57
MANAGING LICENSES
All system components must be licensed as a proof of purchase. Also, some additional
features can be activated by importing a feature license.
Getting Started with Licenses (page 824)

Generating New Licenses (page 826)
Upgrading Licenses Manually (page 827)
Changing License Binding Details (page 828)
Installing Licenses (page 828)
Checking If All Components Are Licensed (page 831)
Checking License Validity and State (page 831)
823
Getting Started with Licenses
Prerequisites: None
Licenses prove that your organization has legally purchased the StoneGate components you
configure. Licenses are issued when you purchase a product and you can upgrade them to new
supported versions as part of each component’s support and maintenance contract.
Licenses are generated by Stonesoft’s online licensing servers and imported to the system as
files. Licenses are shown as elements in the Administration Configuration view.
When Do I Have to Generate Licenses?
Generally, you must generate and import a license for each engine and each Management
Center server to start using the component. However, there are the following exceptions:
• All Management Servers in the same Management Center share a single license (high
availability setup with a primary server and one or more secondary servers).
• SOHO firewall appliances do not require separate engine licenses.
• All currently available firewall and IPS appliance models can fetch a license automatically
through the Management Server if automatic updates are enabled. If automatic licensing
fails, the appliances have a 30-day temporary license to give you time for manual licensing.
• StoneGate SSL VPN licenses can be managed locally or through the Management Center
(starting from SSL VPN version 1.4.0).
• Some optional features are activated by purchasing and importing a feature-specific license.
• You may need to replace a valid existing license to activate additional purchased features.
What Do the Different License Types Mean?
Licenses are classified based on how they are bound to components:
• Static licenses are bound to a detail about a specific component, based on which they are
automatically bound to the correct element. Static licenses of SMC servers are bound to an
IP address. Static licenses of appliances are bound to the appliance’s unique POS code.
• Dynamic licenses (except SSL VPN licenses) are bound to the Management Server’s licensing
code (POL). You must manually bind dynamic licenses to the correct element.
Available license types depend on the component:
• Management Server: always a static IP-address-bound license.
• Log Servers and Web Portal Servers: a static IP-address-bound license or a dynamic license.
• StoneGate firewall and IPS appliances: a static license bound to a POS code (all current
models) or a dynamic license (older models).
• StoneGate SSL VPN: special dynamic license bound to DNS domains instead of a POL code.
• Engines installed on your own hardware: always a dynamic license.
• Feature-specific licenses: always a dynamic license.
When Do I Have to Update Licenses?
Components do not run without a valid license. Always make sure you have an updated license
ready before you make a change that invalidates the previous license. Licenses have to be
updated for new software versions and if the binding detail in the license changes:
• Version upgrades: No action is required if automatic license upgrades are active, see
Automatic Updates and Engine Upgrades (page 209). Otherwise, upgrade licenses manually.
License upgrades are available shortly before a new version is released.
824 Chapter 57 Managing Licenses

• Changes in binding: Change licenses manually if you change an IP address used for binding in
a static license, or if you move a dynamic license to a different Management Server.
Licenses indicate a maximum version for which the license is valid, but the license is also valid
for all previous software versions (exception: SSL VPN version 1.3 or older cannot use licenses
generated for version 1.4 or higher). You must update the license if you upgrade a component to
a new major release indicated by a change in the first two digits of the version number (for
example an upgrade from 1.2.3 to 1.3.0 or an upgrade from 1.2.3 to 2.0.0). If only the last
number changes, the existing license is valid also for the newer version.
Appliance licenses do not allow upgrades beyond the last version that the appliance can run.
See www.stonesoft.com/en/support/product_life-cycle to check which appliance models have a
last supported version. With third-party hardware, be extra careful not to upgrade the software to
versions that exceed the hardware’s capabilities.
Management Server Managed Component Limit
The managed component limit concerns Management Server licenses that impose a restriction
on the number of managed or monitored elements. If your Management Server license allows
an unlimited number of managed components, this restriction does not apply to you. To check
this detail, see the properties of the Management Server’s License.
Each engine is generally counted as one managed unit in the limitation, with some exceptions:
• Analyzers and virtual appliances are not counted.
• Any number of clustered engines count as a single managed unit (one cluster equals one
managed unit).
• L-model appliances (for example, FW-310L) count as half a managed unit (two components
equal one managed unit). If all nodes in a cluster are L-model appliances, the whole cluster is
counted as half a managed unit (mixed clusters are counted as one managed unit).
• SOHO firewalls and third-party components that are monitored through the Management
Center count as one fifth of a unit (five components equal one managed unit).
You cannot combine licenses in your system. For example, two Management Server licenses
that each contain a restriction for five managed components only allow you to manage five
components even if you bind both licenses to a single Management Server.
What’s Next?
 Generating New Licenses (page 826)
 Installing Licenses (page 828)
Related Tasks
 Upgrading Licenses Manually (page 827).
 Changing License Binding Details (page 828)
 Checking If All Components Are Licensed (page 831)
 Checking License Validity and State (page 831)
 Troubleshooting Licensing (page 879)
Getting Started with Licenses 825

Generating New Licenses
Prerequisites: Appliance delivery or license code information from Stonesoft
Licenses always indicate the newest software version you are entitled to, but they are valid for
licensing any older software versions as well.
Generally, each component must have a separate license, including the Management Center
components. Some additional features may also require a separate license.
Note – Your system may be able to automatically generate licenses for new StoneGate
appliances. For automatic licensing to work, install a license for the Management Center
components and ensure that automatic updates are working. The factory-installed
temporary license is automatically replaced with a permanent POS-bound license when the
appliance is configured for use.
 To generate a new license

1. Go to Stonesoft’s online License Center at www.stonesoft.com/license/.
2. To log in, enter the required code to identify a license you want to use and click Submit. The
license page opens.
• The proof-of-license (POL) code identifies a license. You can find it in the order delivery
message sent by Stonesoft (usually by e-mail). For previously licensed components, the
POL code is also shown in the Licenses tree in the Administration Configuration view.
• StoneGate appliances additionally have a proof-of-serial number (POS) that you can find
on a label attached to the appliance hardware.
3. Check which components are listed as included in this license and click Register. The
license generation page opens.
4. Read the directions on the page and fill in (at least) the required fields for all included
components.
5. Enter the details that bind each license to a component in your system:
• Management Server(s): enter the IP address you plan to use on the server. If your license
allows several Management Servers in the system (for high availability), enter a comma-
separated list of the IP addresses of all Management Servers in the same SMC.
• Other SMC servers: enter the Management Server’s POL code or the IP address you plan
to use on the server.
• Firewall or IPS engines: enter the POS code of a StoneGate appliance (see the label
attached to the appliance). The POS code option is not shown for old appliance models
that lack support for POS-based licenses, in which case you must enter the Management
Server’s POL code. POS binding is always recommended when the option is available.
• SSL VPN appliances: enter the DNS domain name(s) of your organization.
Note – If the binding information is incorrect, the license is unusable. If you accidentally
generate a license with the wrong binding information, request a license change through
these same licensing pages.
6. Click Submit Request. The license file is sent to you, and also becomes downloadable in
the License Center.
What’s Next?
 Proceed to Installing a License for an Unlicensed Component (page 828).

Upgrading Licenses Manually
Prerequisites: See Getting Started with Licenses for an overview
Licenses are valid for any older software versions in addition to the version indicated on the
license, so you can upgrade the licenses at any time without affecting the system’s operation.
You can view, change, and download your current licenses at Stonesoft’s online License Center
www.stonesoft.com/license/ by logging in with your personal account (to view all licenses
generated using that account) or by entering a proof-of-license or proof-of-serial number code (to
view information related to a particular license).
If automatic license upgrades are configured (recommended), your licenses are automatically
kept up-to-date, but if you prefer, you can upgrade licenses manually in the following ways:
• When you log in to the online License Center, you can upgrade the license for the displayed
component(s) through the link provided and save the license as a file that you can import in
the system as explained in Installing Licenses (page 828).
• You can export information on licenses through the Management Client and use the resulting
text file to upgrade the licenses as explained below.
 To upgrade several existing licenses

2. Expand the Licenses branch and browse to the type of Licenses you want to upgrade.
3. Ctrl-select or Shift-select the licenses you want to upgrade.
4. Right-click one of the selected items and select Export License Info. A file save dialog
opens.
5. Save the information to a file. A dialog opens.
6. (Optional) Click Yes to launch the online multi-upgrade form in the default web browser on
your system.
7. Upload the license file to Stonesoft’s online License Center using the multi-upgrade form.
The upgraded licenses are sent to you and also become available for download through the
online License Center.
What’s Next?
 To import the upgraded license(s), proceed to Replacing the License of a Previously
Licensed Component (page 829).
Upgrading Licenses Manually 827

Changing License Binding Details
Prerequisites: None
Licenses that are bound to an IP address must be changed if the IP address of the component
changes. Licenses that are bound to the POL code of the Management Server must be changed
if you want to transfer the licenses to a different Management Server or if you replace the
Management Server’s license with a license that has a different POL code.
IP-address-bound licenses have been previously available for firewall and IPS engines. You can
use and update a previously generated IP-address-bound engine license, but you must switch
the binding to the Management Server’s POL code if the engine’s control IP address changes.
POS-based licenses are recommended for StoneGate appliances. These are bound to the serial
number of the appliance hardware, and are automatically bound to the correct element.
You must change IP address and POL based binding manually. To view, change, and download
your current licenses at Stonesoft’s online License Center www.stonesoft.com/license/, log in
with your personal account (for all licenses your account is authorized to view) or by entering a
proof-of-license or proof-of-serial number code (to view information related to a particular
license).
What’s Next?
 If automatic license updates are active, changed licenses are downloaded automatically
as long as the license’s identification code remains the same.
 To manually apply new licenses, proceed to Replacing the License of a Previously
Licensed Component (page 829).
Installing Licenses
Prerequisites: Generating New Licenses / Upgrading Licenses Manually
Installing a License for an Unlicensed Component

If your system is divided into administrative Domains, imported licenses are initially available to
any Domain. When the license is bound to an element (automatically or manually), the license is
assigned to the Domain in which the element is stored. Licenses that are not assigned to any
domain can also be manually assigned to a particular Domain through their right-click menu.
Caution – If you choose Management Server POL code -based licensing for appliances,
make sure you bind the licenses to the correct engine elements and make sure to also
change the license if you change the appliance hardware. For example, if you use a license
generated for a FW-310 appliance with a FW-5105 appliance, the appliance’s throughput is
limited much below its actual performance.
 To install a new license

dialog opens.
2. Select one or more license files and click Install. The licenses are imported and installed.
Most types of licenses are now also automatically bound to the correct components.

view opens.
4. If you installed an dynamic engine license (bound to the Management Server’s POL code):
4a. Expand the Licenses branch and browse to the type of Licenses you installed.
4b. Right-click the newly-imported license and select Bind to select the correct engine. If
you make a mistake, you can still right-click and select Unbind.
Caution – When you make a configuration change on the engine (policy upload or refresh),
the license is permanently bound to that engine. Such licenses cannot be rebound unless
you relicense or delete the engine element the license is currently bound to. When
unbound, such a license is shown as Retained.
5. Check that components are now licensed as intended. Note that the list of Unlicensed
Components may show those engines that have a license bound to the POS code of an
appliance, because POS-bound licenses are attached to the correct engines automatically
when the engine is installed and makes initial contact with the Management Server.
Engine licenses are applied when you upload or refresh the policy on the engines.
Related Tasks
 Checking If All Components Are Licensed (page 831)
Replacing the License of a Previously Licensed Component

If your system is divided into administrative Domains, imported licenses are initially available to
any Domain. When the license is bound to an element (automatically or manually), the license is
assigned to the Domain in which the element is stored. Licenses that are not assigned to any
domain can also be manually assigned in a particular Domain through their right-click menu.
Caution – If you choose Management Server POL code -based licensing for appliances,
make sure you bind the licenses to the correct engine elements and make sure to also
change the license if you change the appliance hardware. For example, if you use a license
generated for a FW-310 appliance with a FW-5105 appliance, the appliance’s throughput is
limited much below its actual performance.
Invalid or missing licenses may prevent components from working. If you are manually replacing
working licenses with new ones, we recommend that you take a back up of the Management
Server before you make changes so that you can easily roll back the changes. See Creating
Backups (page 795).
 To install an updated license for an already licensed component

dialog opens.
Installing Licenses 829

3. Select one or more license files and click Install. The licenses are imported and installed.
• If the licenses only upgrade the software version in a previously imported license (license
identifier does not change), the previous license is replaced with the new one
automatically and no further action is needed.
• Static licenses (which identify the component by POS code or IP address) are
automatically bound to the correct components based on the identifying information,
unless the component already has a dynamic (Management Server POL code bound)
license.
4. If you are replacing a component’s dynamic (Management Server POL code bound) license
with a static (IP address or POS code bound) license:
4a. Expand the Licenses branch and browse to the correct type of licenses.
4b. Right-click the currently bound dynamic license and select Replace by static license.
5. If you imported a dynamic license that is not automatically bound (as previously explained):
5a. Expand the Licenses branch and browse to the correct type of licenses.
5b. If there is a previous dynamic license bound to the element, right-click the old dynamic
license and select Unbind.
5c. Right-click the new license and select Bind.
5d. Select the correct engine to bind the license to. If you make a mistake, you can still
right-click the license and select Unbind.
Caution – When you make a configuration change on the engine (policy upload or refresh),
the license is permanently bound to that engine. Such licenses cannot be rebound unless
you relicense or delete the engine element the license is currently bound to. When
unbound, such a license is shown as Retained.
6. Check the displayed license information, and make sure that all the components you meant
to license have the correct new license.
7. Right-click any old licenses that may still be displayed and select Delete.
The changes to the engine licenses take effect when you upload or refresh the policy on the
engines.
Related Tasks

Checking If All Components Are Licensed
Prerequisites: None
Each Management Center Server and each Firewall, Sensor, and Analyzer must have its own
license. There is no difference in licensing clustered engines compared to licensing a single
firewall or sensor engine.
To check the licenses, select ConfigurationConfigurationAdministration from the menu
and then select LicensesUnlicensed ComponentsAll. This view displays all elements in
your system that require a license but do not currently have a valid license. If any components
are shown as unlicensed:
• Engine licenses generated based on a StoneGate appliance POS code are bound when the
engine makes initial contact with the Management Server. It is normal to see the
corresponding elements as unlicensed until initial contact is made.
• To generate and install new licenses for the components listed, see Generating New Licenses
(page 826).
• If you have already generated and installed licenses, check that the binding details are
correct (POS code, POL code, or IP address).
Checking License Validity and State

Prerequisites: None
Check all installed licenses in the Administration Configuration view, by selecting

ConfigurationConfigurationAdministration from the menu and then selecting
LicensesAll Licenses.
The view displays each license and the component it is currently bound to, along with the
newest software version that the license entitles you to install. Licenses are valid for all minor
releases within the displayed major version (for example, a 5.1 license allows installing 5.1.0,
5.1.1, 5.1.2 etc.) and for any previous software version.
The license states per license type are explained in the table below.
Table 57.1 Possible States for a License
License Type License State Explanation

A Dynamic license that is bound and fixed to some component. Can be
Dynamic Bound
unbound to the “Retained” state or replaced with a Static license.
A license that has reached the end of its validity period. Only evaluation
Dynamic Expired licenses and virtual engine licenses have a validity period. Other licenses are
valid for the indicated version without any time restrictions.
A Dynamic license that has been unbound from the “Bound” state. Can be
rebound to the same component with the “Cancel Unbind” action or changed
Dynamic Retained
to the “Unassigned” state by completing one of the procedures in License Is
Shown as ‘Retained’ (page 880).
A Dynamic license that is not bound to any component. Can be bound to a

Dynamic Unassigned component or deleted. To bind the license to a component, right-click the
license and select Bind.
Checking If All Components Are Licensed 831

Table 57.1 Possible States for a License (Continued)
License Type License State Explanation

A Dynamic license that is bound to a component, but is not yet permanently
Dynamic Assigned fixed to it because the component's policy has not been installed after the
license binding. Can be unbound to the “Unassigned” state or deleted.
A license that was generated based on IP address or POS code and which is
currently bound to a component. Static licenses do not need manual binding
or unbinding, because they are bound automatically. Can be deleted.
Static Active It is not possible to create new IP address bound licenses for engine
components, but previously created IP address bound engine licenses may
be present in your system and can be upgraded to new versions. However, if
a license is changed in any other way, the binding must also be changed.
A license that has reached the end of its validity period. Only evaluation
Static Expired licenses and virtual engine licenses have a validity period. Other licenses are
valid for the indicated version without any time restrictions.

C HAPT ER 58
UPGRADING THE MANAGEMENT CENTER
This section explains how you can upgrade the Management Servers, Management Clients,
Log Servers, and Web Portal Servers in your Management Center.
Getting Started with Upgrading the SMC (page 834)

Obtaining the SMC Installation Files (page 835)
Upgrading Management Center Servers (page 836)
Default Installation Directories for SMC (page 837)
833
Getting Started with Upgrading the SMC
Prerequisites: None
What SMC Upgrades Do

In addition to updating the StoneGate Management Center (SMC) software, the upgrade also
makes other changes in your system:
• New system elements and policies may be added and obsolete system elements may be
removed. Elements that are in use are not deleted, but instead converted from system
elements to regular elements when they have no default role anymore.
• Any elements may be updated with new types of options (related to new/changed features),
and occasionally obsolete options may be removed or changed.
• A new dynamic update package is activated in your system, unless you have already installed
the same or a newer update package before the installation (this may be cause of some, but
not necessarily all of the changes listed above).
• The Management Client’s Online Help system may be updated with new or corrected
information.
A summary of changes to elements is created during each upgrade; you are presented a link to
see these HTML reports when the Management Server upgrade is finished.
Limitations
All Management Center components (Management Server, Management Client, Log Server, and
the optional Web Portal Server) must have the same software version. All other components try
to connect the Management Server when they start and do not start up if their software version
does not match with the Management Server software version.
What Do I Need to Know before I Begin
Although the need to do so is unlikely, the upgrade can be easily reversed if you take the correct
precautions. If the Management Center upgrade fails, you can automatically revert to the
previous installation if you select the option in the installer before the upgrade starts. In any
case, we recommend that you take a backup of the Management Server using StoneGate’s
internal backup tool before you upgrade. The backup contains all necessary information to
restore the configurations (including the engine configurations). The backup does not contain
software version or operating system specific information and can always be restored from an
older-version system to a newer-version system if a direct upgrade is supported between the
software versions involved. For more information, see Backing up and Restoring System
The SMC is offline during the upgrade. The engines continue to operate normally and store their
generated log data in their local spool while the Management Server and Log Server are offline.
Once connectivity is restored, the spooled log data is transferred from the engines to the Log
Server(s).
To check which version of the Management Center you are currently using, select HelpAbout
StoneGate in the Management Client. Additionally, the Management Client’s version is
displayed in the Management Client’s login dialog.
834 Chapter 58 Upgrading the Management Center

1. Prepare the installation files as explained in Obtaining the SMC Installation Files
(page 835).
2. (If automatic license updates have been disabled) Update the licenses as explained in
Upgrading Licenses Manually (page 827).
3. Upgrade all components that work as parts of the same SMC as explained in Upgrading
Management Center Servers (page 836).
4. If you distribute Web Start Management Clients from some external server (instead of the
Management Server), update the Web Start distribution as explained in Distributing Web
Start from External Servers (page 272).
Obtaining the SMC Installation Files

Prerequisites: None
Before running the installer, check the installation file integrity using the MD5 or SHA-1 file
checksums. The checksums are on the StoneGate installation CD-ROM and on the product-
specific download pages at the Stonesoft website.
Windows does not have MD5 or SHA-1 checksum programs by default, but there are several
third-party programs available.
Stonesoft provides only recent versions of the software for download. We recommend you store
the upgrade files yourself to make sure you can install the exact same version at a later time
(for example, in case of a hardware failure), especially if your organization’s policies mandate
lengthy testing periods that limit the speed of adopting new versions.
 To obtain the Management Center installer

1. Download the installation file from http://www.stonesoft.com/download/. There are
several packages available:
• The .iso download allows you to create an installation CD-ROM that can install or upgrade
the software on all supported platforms.
• Separate .zip packages are available for downloading installation files for all supported
platforms or just one supported platform.
2. Change to the directory that contains the file(s) to be checked.
3. Generate a checksum of the file using the command md5sum filename or sha1sum
filename, where filename is the name of the installation file.
Example $ md5sum sg_engine_1.0.0.1000.iso
869aecd7dc39321aa2e0cfaf7fafdb8f sg_engine_1.0.0.1000.iso
4. Compare the displayed output to the checksum on the website.
Caution – Do not use files that have invalid checksums. If downloading the files again does
not help, contact Stonesoft technical support to resolve the issue.
Obtaining the SMC Installation Files 835

If you are installing from the .iso file, create the installation CD-ROM using a CD-burning
application that can correctly convert the CD-ROM structure from the .iso image to a CD-ROM
with several files and folders. If the end result is a CD-ROM with the original .iso file on it, the
CD-ROM cannot be used for installation. If you are installing from a .zip file, unzip all folders and
files in the archive to the server you want to upgrade.
Upgrading Management Center Servers

Prerequisites: Upgrading Licenses Manually (if automatic license upgrades are not active)
You can upgrade without uninstalling the previous version. If you want to reinstall in a new
operating system or on different hardware, see Changing the Management Platform (page 304).
Caution – All the Management Center components (Management Server, Management

Client, Log Server, and the optional Web Portal Server and Web Portal) must use the exact
same SMC software version to work together.
If you are upgrading from a very old version of the StoneGate Management Center to a new
version, you may have to upgrade to an intermediate version first before upgrading to the latest
version of StoneGate (check the Release Notes at http://www.stonesoft.com/en/support/
technical_support_and_documents/).
 To upgrade the Management Center components

1. Start the installation.
• In Windows, run StoneGate_SW_Installer/Windows/setup.exe
• In Linux, run StoneGate_SW_Installer/Linux/setup.sh
Note – In some cases, the installer may still recognize services as running even after you
have stopped them. If this happens, disable the automatic startup of all StoneGate
services and reboot the computer. During the upgrade, the installer reconfigures the
services to start automatically again.
2. Read and accept the License Agreement to continue with the installation. The Installation
Wizard automatically detects the previous installation directory.
3. Click Next to accept the installation directory. The Installation Wizard displays the
components to be upgraded.
Illustration 58.1 Select SMC Components

4. (Optional) Select Save Current Installation if you want to save a copy of the current
installation that you can revert to at any time after the upgrade.
5. Click Next to continue. When upgrading the Management Server, you are prompted to back
up the current Management Server data as a precaution. Select Yes to back up the
Management Server data to the <installation directory>/backups/ directory.
Caution – If you are working on a Windows system and you run any StoneGate component
as a service, make sure that you have closed the Services window before you complete the
next step. Otherwise, the services may not be installed.
6. Check the pre-installation summary and click Install to continue. The upgrade begins.
7. When the upgrade is complete, click the link(s) in the notification to view the report(s) of
changes the installer has made to your system configurations in your web browser.
8. Click Done to close the installer.
Upgrade any SMC components running on other computers in the same way.
What’s Next?
 If you distribute Web Start Management Clients from some external server (instead of
the Management Server), update the Web Start distribution as explained in Getting
Started with Web Start Distribution (page 270).
 Otherwise, the Management Center upgrade is now complete.
Default Installation Directories for SMC

Prerequisites: None
Default installation directory on Windows:

• c:/stonesoft/stonegate/
Default installation directory on Linux:
• /usr/local/stonegate/
Under the installation directory, note especially the following folders:
• /backups/ stores Management Server (sgm_) and Log Server (sgl_) backups. The backups
must be in this directory to be listed in the Management Client and when running scripts
without specifying a backup file.
• /bin/ contains the SMC command line tools (see Management Center Commands
(page 918)) as well as some additional scripts that are used by the installation wizard.
Default Installation Directories for SMC 837

C HAPT ER 59
UPGRADING THE ENGINES
This section explains how you can upgrade the firewalls, sensors, analyzers, SOHO firewall
appliances, and SSL VPN appliances.
Getting Started with Upgrading Engines (page 840)

Obtaining Engine Upgrade Files (page 841)
Upgrading Engines Remotely (page 841)
839
Getting Started with Upgrading Engines
Prerequisites: None
The primary way to upgrade engines is a remote upgrade through the Management Server. The
local upgrade option is not covered here (see the product-specific Installation Guide instead).
How Engine Upgrades Work
The upgrade package is imported on the Management Server manually or automatically. Then,
you apply it to selected engines through the Management Client.
The engines have two alternative partitions for the software. When you install a new software
version, it is installed on the inactive partition and the current version is preserved to allow
rollback to the previous version in case the installation is interrupted or some other problems
arise. If the engine is not able to return to operation, it automatically switches back to the
previous software version at the next reboot. You can also switch the active partition manually.
You can upload and activate the new software separately, for example, to upload the upgrade
during office hours but activate it during a service window.
The currently installed working configuration (routing, policies etc.) is stored separately and is
not changed in an upgrade or a rollback. Although parts of the configuration may be version-
specific (for example, if system communications ports are changed), the new version can use
the existing configuration. Possible version-specific adjustments are made when you refresh the
policy after the upgrade.
Limitations
It is not possible to upgrade between 32-bit version and a 64-bit version of the software. If you
are running the software on a compatible standard server, you can reinstall the software using
the other version (note that in clusters, 32-bit and 64-bit nodes cannot be online
simultaneously). StoneGate appliances do not support this type of architecture change.
What Do I Need to Know before I Begin
The Management Center must be up to date before you upgrade the engines. An old
Management Center version may not be able to recognize the new version engines and generate
a valid configuration for them. The Management Server can control several older versions of
engines. See the Release Notes for version-specific compatibility information.
During a cluster upgrade, it is possible to have the upgraded nodes online and operational side
by side with the older version nodes. This way, you can upgrade the nodes one by one while the
other nodes handle the traffic. However, you must upgrade all the nodes to the same version as
soon as possible, as prolonged use with mismatched versions is not supported.
The current engine version is displayed on the General tab in the Info panel when you select
the engine (if the Info panel is not shown, select ViewInfo).
1. (If automatic engine upgrade file downloads are disabled) Prepare the installation files as
explained in Obtaining Engine Upgrade Files (page 841).
2. (If automatic license updates are disabled) Update the licenses as explained in Upgrading
Licenses Manually (page 827).
3. Upgrade the engines as explained in Upgrading Engines Remotely (page 841).
840 Chapter 59 Upgrading the Engines

Obtaining Engine Upgrade Files
Prerequisites: None
If the Management Server is not set up to download engine upgrades automatically (see
Automatic Updates and Engine Upgrades (page 209)) or if you want to perform a local upgrade,
you must download the installation files manually and check the installation file integrity using
the MD5 or SHA-1 file checksums. Windows does not have MD5 or SHA-1 checksum programs
by default, but there are several third-party programs available.
The instructions here cover the remote upgrade, which is the recommended method in most
cases. See the product-specific Installation Guide if you want to upgrade locally
 To manually download an engine upgrade file

1. Download the suitable installation file for your architecture (32-bit or 64-bit) from
www.stonesoft.com/download/. There are two types of packages available:
• The .zip package is used in the remote upgrade on all supported platforms. It can also be
used for a local upgrade from a USB memory stick.
• The .iso download allows you to create an installation CD-ROM for a local upgrade on all
supported platforms.
2. Change to the directory that contains the file(s) to be checked.
3. Generate a checksum of the file using the command md5sum filename or sha1sum
filename, where filename is the name of the installation file.
Example $ md5sum sg_engine_1.0.0.1000.iso
869aecd7dc39321aa2e0cfaf7fafdb8f sg_engine_1.0.0.1000.iso
4. Compare the displayed output to the checksum on the website.
Caution – Do not use files that have invalid checksums. If downloading the files again does
not help, contact Stonesoft technical support to resolve the issue.
5. Log in to the Management Client and select FileImportImport Engine Upgrades from
the main menu.
6. Select the engine upgrade (sg_engine_version_platform.zip file) and click Import. The
import takes a while. You can see the related messages in the status bar at the bottom of
the Management Client window.
Upgrading Engines Remotely

Prerequisites: (Possibly) Upgrading the Management Center, Obtaining Engine Upgrade Files
The Management Server can remotely upgrade engine components that it manages. You can
upgrade several engines of the same type in the same operation. However, we recommend that
you upgrade clusters one node at a time and wait until an upgraded node is back online before
you upgrade the other node(s).
Note – Clusters operate normally throughout the upgrade when the upgrade is done in
stages, but upgrade all nodes in the cluster to the same version as soon as possible.
Prolonged use with mismatched versions is not supported. However, it is not possible to
have 32-bit and 64-bit engines online in the cluster at the same time.
Obtaining Engine Upgrade Files 841

 To upgrade an engine remotely
1. Read the Release Notes document for the new version, especially the required SMC version
and any other version-specific upgrade issues that may be listed.
• In the Management Client, select ConfigurationConfiguration
Administration from the main menu and browse to Other ElementsEngine Upgrades.
A link is included in the upgrade file’s information table.
• If the Management Server has no Internet connectivity, the Release Notes are not
available in the Management Client, and can be found in the Technical Documentation
search at www.stonesoft.com/support.
2. (If you plan to activate the new software right away) Right-click the node you wish to upgrade
and select CommandsGo Offline.
3. Right-click a component you wish to upgrade and select Upgrade Software or
ConfigurationUpgrade Software depending on your selection. The Remote Upgrade Task
Illustration 59.1 Remote Upgrade Task Properties
4. Select the type of Operation you want to perform:

• Select Remote Upgrade (transfer + activate) to install the new software and reboot the
engine with the new version of the software.
• Select Remote Upgrade (transfer) to install the new software on the node without an
immediate reboot and activation. The node continues to operate with the currently
installed version until you choose to activate the new version.
• Select Remote Upgrade (activate) to reboot the engine and activate the new version of
the software that has been installed earlier.
Caution – To avoid an outage, do not activate the new configuration simultaneously on all
the nodes of a Firewall cluster. Activate the new configuration one node at a time, and
proceed to the next node only after the previous node is back online.
5. If necessary, adjust the selection of engines included in the upgrade. All engines in the
same upgrade Task must be of the same type.

6. Select the correct engine version and click OK. If you chose to activate the new
configuration, you now need to acknowledge a warning that the node will be rebooted. A
new tab opens showing the progress of the upgrade.
• The time the upgrade takes varies depending on the performance of your machine and the
network environment.
• If you chose to activate the new configuration, the engine is automatically rebooted and
subsequently brought back online.
The upgrade overwrites the inactive partition and then switches the active partition. To undo the
upgrade, use sg-toggle-active command or the engine’s boot menu to switch back to the
previous software version on the other partition. This switch may also happen automatically at
the next reboot if the engine is not able to successfully return to operation when it boots up
after the upgrade.
What’s Next?
 When the upgrades are finished, refresh the policy of upgraded firewalls/sensors to
make sure any possible changes specific to the new software version are transferred to
the engines.
Related Tasks
 Accessing the Engine Command Line (page 202)
 Creating Remote Upgrade Tasks (page 819)
Upgrading Engines Remotely 843

C HAPT ER 60
MANUAL DYNAMIC UPDATES
Dynamic Update packages include changes and additions to the system Policies, Situations,
and other elements of the StoneGate Management Center.
Getting Started with Manual Dynamic Updates (page 846)

Importing an Update Package (page 846)
Activating an Update Package (page 847)
845
Getting Started with Manual Dynamic Updates
Prerequisites: None
It is very important to keep the system policies and situations up-to-date so that newly
discovered vulnerabilities can be detected. Changes and additions are provided in update
packages available at the Stonesoft website.
What Dynamic Updates Do
Dynamic updates provide updates particularly to the deep inspection features on the IPS and
Firewall/VPN products. For example, new threat patterns and changes in the system Templates
and Policies are introduced in dynamic updates for up-to-date detection. They may also revise
the default elements you use to configure the system.
Limitations
• On occasion, you may need to upgrade first before you can use a certain dynamic update
package. See the Release Notes for the update packages at the Stonesoft Web site for more
information.
• If there are several Domains defined in the system, the installation of manual dynamic
updates can only be done in the Shared Domain.
As an alternative to downloading the updates manually as explained here, you can configure the
dynamic updates to be downloaded and optionally even activated automatically in your system.
See Automatic Updates and Engine Upgrades (page 209).
Virus database updates for firewalls are always done automatically and directly by the engines.
Updates are always active when the anti-virus feature is active. For additional settings, see
Configuring Anti-Virus Settings (page 424).
1. Download the latest dynamic update package from the Stonesoft web site and import it in
the Management Client as explained in Importing an Update Package (page 846).
2. Activate the update package in the Management Client as explained in Activating an
Update Package (page 847)).
Importing an Update Package

Prerequisites: None
 To import an update package

1. Go to www.stonesoft.com/download/ and follow the link to dynamic updates.
2. If the download page shows that a more recent update is available, download the latest
.jar update package file.
• To see more details about what is included in the dynamic update package, follow the
Release Notes link on the dynamic update web page.
846 Chapter 60 Manual Dynamic Updates

3. Save the update package file to a location accessible from the computer you use to run the
Management Client.
Note – Ensure that the MD5 checksums for the original files verified by Stonesoft and the
files that you have downloaded match.
4. Select FileImportImport Update Packages. The StoneGate Update Package File

Browser dialog opens.
5. Browse to the correct file, select it, and click Import. The import takes some time, and the
completion of the import is displayed in the status bar of the Management Client window.
What’s Next?
 Proceed to Activating an Update Package.
Activating an Update Package

Prerequisites: Importing an Update Package
Activation of a dynamic update package introduces the changes from an imported update
package into your system.
 To activate an update package

2. Expand the Other Elements tree and select Updates. A list of all imported and activated
update packages opens.
3. Right-click the new update package and select Activate. The Management Server Backup
dialog opens.
4. Unless you have a fresh installation, click Yes. After the backup is taken, the update
package activation starts. The included items are shown so that you can view them after
the activation is complete.
5. Click Close when the activation is finished.
What’s Next?
 Refresh the policies on all engines to activate the changes.
Activating an Update Package 847

848 Chapter 60 Manual Dynamic Updates
T ROUBLESHOOTING
In this section:
General Troubleshooting Tips - 851
Troubleshooting Accounts and Passwords - 853
Troubleshooting Alerts, Errors, and Log Messages - 857
Troubleshooting Certificates - 867
Troubleshooting Engine Operation - 875
Troubleshooting Licensing - 879
Troubleshooting Logging - 883
Troubleshooting the Management Client - 887
Troubleshooting NAT - 893
Troubleshooting Policies - 897
Troubleshooting Reporting - 905
Troubleshooting Upgrades - 909
Troubleshooting VPNs - 911
849
850
C HAPT ER 61
GENERAL TROUBLESHOOTING TIPS
This section contains tips for how to troubleshoot situations that are not covered by more
specific troubleshooting sections.
If Your Problem Is Not Listed (page 852)

Tools For Further Troubleshooting (page 852)
851
If Your Problem Is Not Listed
When having problems with your system, you should first make sure you have followed the
relevant instructions.
Some problems you are having may be related to known issues, which you can view at the
Stonesoft Web site at http://www.stonesoft.com/support/.
If your organization is entitled to technical support, contact Stonesoft Support (for contact
details, see Technical Support (page 24)). Note that issues related to generating licenses or
updating the information contained in the licenses are handled by Stonesoft Order Services
(order@stonesoft.com).
Tools For Further Troubleshooting

StoneGate logs and alerts provide useful information on what the components do and what is
happening in your system. You can increase the detail level of logs on certain areas of
operation. See Enabling/Disabling Firewall/VPN Diagnostics (page 193). To gain useful
information from the logs produced, you must be able to filter the logs efficiently. See Filtering
Logs in the Logs View (page 134).
There are StoneGate-specific as well as standard networking tools available on the engines. See
Working on the Engine Command Line (page 201) and Engine Commands (page 926).
If you need a deeper understanding of how some aspect of StoneGate functions, consult the
relevant section(s) in the Reference Guides.
852 Chapter 61 General Troubleshooting Tips

C HAPT ER 62
TROUBLESHOOTING ACCOUNTS AND

PASSWORDS
This section concentrates on troubleshooting password-related issues.
Forgotten Passwords (page 854)

User Account Changes Have no Effect (page 854)
Creating an Emergency Administrator Account (page 855)
853
Forgotten Passwords
Problem description: You or someone else in your organization forgets one of the passwords
related to the StoneGate system.
Solution: You can regain access by changing the password. An administrator who has
unrestricted permissions can change any StoneGate password. The password recovery
procedures for the different passwords are as follows:
• Management Client login passwords can be changed in the Administrator elements.
Administator elements can be found in the Administration Configuration view under Access
RightsAdministrators. See Creating a New Administrator Element (page 218) for more
information.
• Web Portal login passwords can be changed in the Web Portal User elements. Web Portal
elements can be found in the Administration Configuration view under Access RightsWeb
Portal Users. See Defining Web Portal User Accounts (page 260) for more information.
• The Engine Root account password (for command line access) can be changed by right-
clicking the individual engine node and selecting CommandsChange Password. If the
engine is not connected to the Management Server (because, for example, it is a spare
appliance), you can reset all of the engine’s settings through a boot menu option in the local
console accessible through a serial connection or through a directly connected monitor and
keyboard.
Caution – Resetting the engine through the boot menu stops the engine from processing
traffic, since all configurations are cleared.
• A User password used for end-user authentication can be changed in the User element. User
elements are stored in the Firewall Configuration view under Other ElementsUser
AuthenticationUsers (if the user is stored in the internal LDAP database or an external
LDAP database that StoneGate is configured to use).
• The default Management Server Database user account is dba, and the password is created
automatically. If you do not know the password but you need it for some operation, you can
change the password through FileSystem ToolsChange Database Password.
If none of the administrators can log in due to account issues, see Creating an Emergency
Administrator Account (page 855).
User Account Changes Have no Effect

Problem description: You add a User element (end-user account for authentication) or change
the password in a User element, but the new user account or new password are not accepted
when the end-user tries to authenticate. Previously created and unmodified user accounts work
as expected. If you changed the password, the previous password is still accepted.
Reason: There may be a replication problem that prevents synchronizing the user database
information from the Management Server to the local database on the firewalls.
Solution: Reset the user database by right-clicking an individual firewall node (not the upper-
level Single Firewall/Firewall Cluster element) and selecting CommandsReset User
Database. This action copies all user information from the Management Server to the engine.
Also, make sure User DB Replication (automatic user database replication) is active under
Options in the right-click menu for the Single Firewall/Firewall Cluster (top-level) element.
854 Chapter 62 Troubleshooting Accounts and Passwords

Creating an Emergency Administrator Account
Problem description: None of the administrators can log in to the Management Server because
of account-related issues.
Solution: A new account with unrestricted permissions can be created in an emergency using
the sgCreateAdmin script on the Management Server (located in the <installation
directory>/bin folder) with the Management Server service stopped. You can then log in to
the Management Client using this account, change passwords, and create new accounts
normally as explained in Defining Administrator Accounts (page 218).
Creating an Emergency Administrator Account 855

856 Chapter 62 Troubleshooting Accounts and Passwords
C HAPT ER 63
TROUBLESHOOTING ALERTS, ERRORS, AND

LOG MESSAGES
This chapter explains some common alert and log messages that you may see in the log
browser and gives hints on how to proceed when you see such messages.
Alert Log Messages (page 858)

Log Messages (page 860)
Error Messages (page 864)
857
Alert Log Messages
Certificate Authority Expired/Expiring Alerts

See Dealing with Expiring Certificate Authorities (page 872).
Certificate Expired/Expiring Alerts

See Replacing Expired/Missing Certificates (page 870).
“Log Spool Filling”

Problem description: the “Log spool filling” alert is triggered.
Reason: The logs are not transferred from the engine at all or the engine is generating logs
more quickly than can be transferred to the log server.
Solution: See Logs Are Filling up the Storage Space (page 884).
“Status Surveillance: Inoperative Security Engines”

Problem description: the Inoperative Security Engines alert is triggered.
Reason: the Management Server did not receive expected status updates from a firewall,
sensor, or analyzer and the Status Surveillance option is selected for the engine (in the engine’s
right-click menu under Options).
Solution: if you see these alerts, one of the problems listed below may exist or may have
existed temporarily:
• The connectivity between the engine and the Management Server may have been lost due to
connection problems between the engine and the Management Server or due to a technical
issue on the Management Server. Problems that affect only management communications do
not interfere with the operation of the engines - they continue processing traffic.
• The engine may be experiencing technical problems.
 To troubleshoot inoperative security engines

1. Check if the status of the engine or the system connections (shown in the info view when
the engine is selected) still shows problems.
2. Check if there is a steady log stream from the affected engine and if there are any further
alerts or logs from the engine that could explain the reason for the message.
3. Check if the engine is actually processing traffic normally even if the Management Server is
not able to monitor the engine and/or show the log stream.
4. A console connection to the affected engine is recommended, if possible, when you
suspect that the engine may not be operating properly. This allows you to see any possible
error messages printed out to the console before you take corrective actions, such as
reboot the node.
858 Chapter 63 Troubleshooting Alerts, Errors, and Log Messages

If you suspect technical problems on the engine, run the sginfo script on the engine before
rebooting it (if possible) and contact Stonesoft support.
Related Tasks
 For information on command line tools, see Command Line Tools (page 917).
“System Alert”
Problem description: you receive an alert with the title “System Alert”.
Reason: “System Alert” is a general category for all alert messages that are generated because
something in the operation of the StoneGate system components requires your attention.
Solution: Select the alert entry in the Logs view and click Details in the toolbar to view the alert
entry information. Some of the most frequently seen messages are also explained in this
section.
“Test Failed”
Problem description: test-related alerts are triggered (for example, “Tester: Link Status test
failed”).
Reason: tester alerts indicate that the automatic tester system running on the engines has
detected a failure in one of the tests that the tester is configured to run. The Tester is
configured to run some tests by default and administrators may configure additional tests. The
tester is configured in the properties of each engine.
Solution: make sure the condition that caused the test to fail is resolved.
Related Tasks
 Getting Started with the Engine Tester (page 398).
“Throughput Based License Exceeded”

Problem description: throughput based license exceeded alerts are triggered.
Reason: Some StoneGate licenses limit the throughput of the engine to a certain fixed value. If
the throughput limit is reached at any particular moment, the exceeding traffic is dropped and
an alert is created to notify you of the matter. The throughput limit is counted as the total
throughput of all traffic handled by the engine at any one moment (all traffic together regardless
of type, direction, or the links used).
Solution: Usually, the messages are triggered by temporary spikes in traffic and do not cause
major problems. If you see these messages often, you should take action:
• Make sure your StoneGate appliance licenses are matched to the correct elements according
to the type of appliance. If the license generated with the POS code of a lower-throughput
appliance is applied to a higher-throughput appliance, the throughput is needlessly limited.
• If the hardware can handle a higher throughput than what it is licensed for, you may switch to
a higher-throughput license (contact your StoneGate reseller).
• If the license throughput corresponds to the maximum throughput achievable with your
hardware, you may be able to install an additional cluster node or you can switch to hardware
with a higher maximum throughput (contact your StoneGate reseller).
Alert Log Messages 859

• You can restrict the traffic in a more controlled way, for example, using the traffic
management features of a StoneGate firewall. See Getting Started with QoS (page 616) for
more information.
Log Messages
Connection Closed/Reset by Client/Server

Problem description: Connection fails and a connection closed by client/by server or
connection reset by client/by server message is shown in the logs. If the connection closing
does not occur in the expected order of a normal TCP connection, the message may state
“connection closed abnormally”.
Reason: These messages inform you about an event that the firewall has detected in the
network. Connection closing is an expected event at the end of each standard TCP connection.
The logging settings in the Access rules determine whether connection closing is logged.
Frequent abnormal connection closing or resets may indicate problems in the network, such as
an overloaded server.
Solution: If connection problems affect services, perform standard network troubleshooting
steps along the whole communication path.
“Connection Removed During Connection Setup”

Problem description: You see “Connection removed during connection setup” messages in
conjunction with connection closing logs.
Reason: This message notifies you of a connection that was abnormally cut during the TCP
connection setup phase because of a RST (reset) sent by one of the communicating parties.
Solution: Check why the connection is torn down, for example, if the server is overloaded or if
the service is down or using a non-standard port.
“Connection State Might Be Too Large”

Problem description: You see “error when serializing for state sync” messages with a
“connection state might be too large” clarification log entries for a firewall cluster. You may also
experience intermittent or continuous problems with clustering and traffic flow, which are
typically alleviated for some time by rebooting all clustered nodes.
Reason: The firewall keeps a record of all connections that are handled statefully to be able to
track the connection. When the firewall is clustered, this connection table must be synchronized
between the nodes to allow connections to continue if a node goes down. When the state table
grows excessively large, the firewall engines can no longer effectively use it.
This message is usually caused by a misconfiguration. Typical configuration problems include:
• Using the Oracle Protocol Agent (PA) on the actual database connections between the client
and the server. The Oracle Protocol Agent is meant for cases where TCP port 1521 is used
only for negotiating the port number for Oracle database connections, and the port number
for the actual connection is assigned dynamically. It must not be used in any other cases.

• Excessive idle timeouts defined in Access Rules. All TCP connections are normally explicitly
closed by the communicating parties and can therefore be cleared from the state table based
on actual connection state. Non-TCP protocols do not establish connections, but the
communications are still handled as virtual connections on the firewall to allow all firewall
features to be used on the traffic. Since the communicating parties do not have a closing
mechanism, these virtual connections are never cleared from the firewalls’ connection
records before the communications are left idle (unused) for the duration of the defined
timeout. If access rules define excessively long timeouts for such traffic between many
different hosts, the connection state table can grow extremely large.
Solution: If the Oracle Protocol Agent is in use, make sure it is not applied incorrectly. If
necessary, replace the default service that has a Protcol Agent attached with a custom service
that matches the correct port without a Protocol Agent.
Check the Access Rules to see if there are rules that override the default idle timeout value for
non-TCP traffic. Make sure the override is not applied to any traffic that does not absolutely
need a longer timeout (make the rule as specific as possible) or try reducing the timeout
(generally, the idle timeout should not be more than a few minutes). In some cases, allowing
both communications directions separately may remove the need for long timeouts.
“Connection Timeout...”
Problem description: You see “connection closed” log entries with a “connection timeout”
clarification.
Reason: Connection timeout log messages are generated for inactive connections that the
firewall clears out from its connection tracking table. For some reason, the hosts that were
communicating within this allowed connection have stopped transmitting packets between each
other.
Solution: Most connection timeouts are normal and necessary to ensure that the firewall cleans
up inactive connections from its records, freeing up the resources. However, sometimes the
timeout may prevent communications from continuing:
• If there is some application in your network that leaves connections inactive for long periods
of time before continuing again, you can increase the timeout for those connections in the
Action options for the Access rule that allows the connection. The rule-specific timeouts
override the global timeouts that are set per connection state in the Firewall element’s
properties (Advanced Settings).
Caution – Setting long timeouts for a high number of connections considerably increases
the resource consumption of the firewall and may even lead to performance problems. This
applies especially to non-TCP protocols that do not include connection closing messages,
because such virtual connections are never closed before the timeout is reached.
• If the protocol is not actually connection-oriented (for example, if the protocol is SNMP), you
can disable connection tracking for the traffic in the Access rule’s Action options. This
requires that you explicitly allow both directions of the communications in the rule, since
without connection tracking, reply packets cannot be automatically allowed. NAT rules are not
applied to connections that are not tracked. We recommend that you deactivate logging in
rules that have connection tracking off, since these rules will create a separate log entry for
each packet transmitted. This greatly increases the number of log entries generated and can
potentially lead to an unmanageable level of logging traffic.
Log Messages 861

“Incomplete Connection Closed”
Problem description: You see “incomplete connection closed” messages in the logs.
Reason: This information message indicates that the firewall allowed a connection and passed
the first packet of a connection (the SYN packet). However, the reply packet (SYN/ACK) from the
destination host did not arrive at the firewall, so the firewall determined that the connection was
unsuccessful and removed it from its records.
This can happen in one of the following situations:
• The SYN packet did not reach the destination.
• The SYN packet reached its destination, but the destination host did not send any reply.
• The SYN packet reached its destination and the destination host replied, but the reply packet
did not reach the firewall.
Solution: It is normal to see a few of these messages in the log from time to time, but a higher
number of these messages may indicate problems in your network or the communicating
applications.
If this message appears in the logs often for legitimate traffic, there is a networking problem
that you must address. Use normal network troubleshooting tools to find out where the packets
are lost.
In some cases SYN packets may be sent maliciously to random hosts as an attempt to find out
your network structure. These attempts may sometimes be seen as SYN packets to hosts that
do not exist, which may trigger the Incomplete Connection Closed messages if access to those
addresses is allowed and routable. The possibility of successful scans can be reduced by using
dynamic NAT on the firewall. See Editing NAT Rules (page 545).
“NAT Balance: Remote Host Does Not Respond”

Problem description: Connections are dropped with NAT balance messages in the logs.
Reason: A connection has been allowed, the firewall has applied a NAT rule that defines source
and/or destination translation, and the traffic has been forwarded according to the firewall’s
routing configuration, but a reply is never received.
Solution:
1. If NAT is applied to the connection in error, adjust your NAT rules accordingly. It is also
possible to create a NAT rule that defines no translation to disable NAT for any matching
connection.
2. Check that the firewall routes the traffic correctly. The routing decision is made based on
the translated destination IP address.
3. Make sure the destination host is up and providing the requested service, and that any
intermediary firewall allows the connection.
4. Try to trace the path that the communications take and use traffic captures as necessary
to find the point of failure.

“Not a Valid SYN packet”
Problem description: The “Not a Valid SYN Packet” message appears in logs in conjunction
with entries on discarded packets.
Reason: “Not a Valid SYN Packet” is a TCP packet that is not the first packet of a TCP
connection (the packet does not have the SYN flag set), but is not part of an existing connection
either (there is no connection tracking entry on the firewall matching this packet). This packet
would be allowed by the policy if it was part of an existing tracked connection.
The messages usually also contains a code inside square brackets that indicates the flags set
in the discarded packet (A=Ack, F=FIN, R=RST, P=Push, S=SYN).
Some examples of situations, where “Not a Valid SYN packet” messages can be seen:
• Asymmetric routing, which means that the opening packet does not go through the firewall,
but the reply (the SYN/ACK) does. If this is the case, there is a configuration error in the
routing of the surrounding network that must be fixed.
• Connections that are idle for more than the defined connection timeout (connection has been
erased from the Firewall records). This will always happen from time to time, but if necessary,
the timeout can be increased or you can use the TCP Proxy Protocol Agent, which can reset
the connection at the host and server when the connection is left idle (if the application in
question does not properly close connections).
• Connections that have been made to look like TCP connections while they are not. If
necessary, these can be allowed as individual packets without connection tracking.
• Network scans or attacks that use ACK packets.
• Heavily loaded server or client that sends a packet after the host at the other end of the
connection has already timed out and closed the connection.
Solution: It is normal to see some messages like this in the logs. If a certain type of
communication that you want to allow is always prevented because of connection tracking:
• If there are connections that are left idle for a long time, you can modify the idle timeout value
for the Access rule that allows that specific traffic. See Defining Firewall “Allow” Action
Options (page 523). There are also default values that you can set globally for different TCP
connection states in the Firewall element’s properties (Advanced settings). This solution does
not usually apply to non-TCP connections, so take care that the rule only matches the specific
connections involved.
Caution – Setting long idle timeouts for a high number of connections considerably
increases the resource consumption of the firewall and may even lead to performance
problems. Especially, non-TCP protocols do not include connection closing messages, so
such virtual connections are never closed before the timeout is reached.
• You may have to disable connection tracking in the rule allowing the connection. We
recommend that you deactivate logging in rules that have connection tracking off, since these
rules will create a separate log entry for each packet transmitted. This greatly increases the
number of log entries generated. NAT cannot be applied to traffic that is allowed without
connection tracking and both communication directions must be explicitly allowed in the
Access rules (replies are not automatically allowed).
• For some types of connections, problems may be solved by using a Service that includes a
special Protocol Agent for that kind of traffic. See Using Protocol Elements (page 579) for a
list of Protocol Agents.
Log Messages 863

“Requested NAT Cannot Be Done”
Problem description: The logs show the error message “Requested NAT cannot be done”
Solution:
• A Dynamic NAT operation may be applied to the wrong type of traffic. Dynamic (many-to-one)
NAT is done by assigning different hosts the same IP address, but different ports. For this
reason, dynamic NAT does not work when the protocol in question does not use ports. Only
the TCP and UDP transport protocols use ports. See the TCP and UDP branches in the
Services tree in the Management Client to check which protocols are transported over TCP or
UDP.
• Dynamic NAT may run out of ports if there are too many simultaneous connections in relation
to the IP addresses and the port range you have configured for dynamic NAT. You can increase
the available ports for translation by adding a new IP address for your dynamic NAT rule or by
expanding the port range, if the rule does not currently use the whole range of high ports.
• If the Server Pool element is used, check the NAT rules. Because the Server Pool element
always does NAT, errors may occur when the Server Pool element is used and the same
connection matches an overlapping NAT rule.
• Check if the information message in the log states that dynamic NAT is denied due to
excessive number of connections. This may happen when a single host is opening
connections at an excessive rate to a single destination IP address and port through dynamic
source NAT. This message indicates the triggering of a self-protection mechanism, which
prevents excessive use of processing resources to dynamic NAT operations. Set up a static
NAT rule to allow these types of connections if it is not possible to adjust the connection
settings of the application.
Spoofed Packets
See Packets Are Dropped as Spoofed (page 903).
IPsec VPN Log Messages

See Reading VPN-related Logs (page 912) for general information and IPsec VPN Log Messages
(page 1005) for a listing of messages with descriptions.
Error Messages
Command Failed/Connect Timed out

Problem description: You try to command an engine using the Management Client and receive
an error.
Solution:
• Make sure that there is connectivity between the Management Server and the engine. Most
common connectivity problems include traffic filtering by an intermediate firewall and
incorrectly configured NAT configuration (a required NAT rule for the connection is missing or
the engine’s contact address is missing). The engine sends its status reports through the Log
Server, so a green operating status is no guarantee that the Management Server can reach
the engine.

• Try to refresh the engine’s policy. Read all messages displayed and make sure none of the
nodes perform a rollback to the previous policy. If policy installation fails. See Troubleshooting
Firewall Policy Installation (page 898). If this is a cluster that contains nodes that are out of
commission.
PKIX Validation Failed

Problem description: A Java-related error appears with various cryptic messages about “PKIX”.
Reason: One or both of the certificates needed for securing the internal connection has expired
or is damaged.
Solution: See Replacing Expired/Missing Certificates (page 870).
Policy Installation Errors

Problem description: Policy installation displays an error in the main policy installation panel
that logs the installation progress.
Solution: See Troubleshooting Firewall Policy Installation (page 898) or Troubleshooting IPS
Policy Installation (page 900).
Unexpected Error
Problem description: Some action in the Management Client displays a pop-up message
stating that an “unexpected error” has occurred.
Solution: Exit and relaunch the Management Client. If the condition persists, contact technical
support.
Error Messages 865

C HAPT ER 64
TROUBLESHOOTING CERTIFICATES
Digital certificates allow components to prove their identity to each other. StoneGate
Components use certificates in system communications and in VPNs.
Understanding Certificate-Related Problems (page 868)

Replacing Expired/Missing Certificates (page 870)
Dealing with Expiring Certificate Authorities (page 872)
867
Understanding Certificate-Related Problems
Note – Do not confuse certificates with licenses. Certificates are proof of identity that
components use to authenticate themselves in communications. Licenses are a proof of
purchase used for ensuring that your organization is a legal license holder of the software.
For troubleshooting licenses, see Troubleshooting Licensing (page 879).
There are two types of certificates that are used in StoneGate:

• StoneGate components use certificates to identify each other in system communications.
When a component has no valid certificate, contact between that component and other
StoneGate components is not possible. Depending on the components, policy installation
and log traffic may be affected. The certificates used in system communications are always
generated by the Internal Certificate Authority that runs on the Management Server.
• Certificates are also used in VPNs for authentication between remote gateways. These
certificates may be generated by any internal or external certificate authorities that both
gateways are configured to trust.
Problems Related to Certificate Validity Time
All certificates have a validity start date (“not before”) and a validity end date (“not after”). In
StoneGate, internally generated certificates are valid for three years from their creation. Expired
certificates must be replaced with new ones. Note that since each component interprets the
certificate validity according to their own internal clock, incorrect date or time settings may lead
to unexpected certificate rejections.
Example An external VPN gateway device defaults to 1970 when an error occurs in setting its time. In
this state, the device thinks a certificate issued today is not valid until decades into the future
and certificate authentication fails.
You can check the validity of internal certificates (of SMC servers, firewall and IPS engines) and
VPN Gateway Certificates in the Management Client:
• Internal certificates: Select ConfigurationConfigurationAdministration, navigate to
Other ElementsInternal Certificates, and open the properties of the certificate.
• VPN Gateway Certificates: Select ConfigurationConfigurationVPN, navigate to Other
ElementsCertificatesGateway Certificates, and open the properties of the certificate.
Problems Related to Certificate Authority Validity Time
StoneGate’s internal Certificate Authorities, Internal CA and internal VPN CA, are both valid for
ten years. A new Internal CA and a new VPN CA are automatically created six months prior to the
internal CA’s expiration date. The components that use certificates signed by the internal CAs
must receive new certificates that have been signed by the new internal CAs. Otherwise, the
system communications and VPN connections cannot function.
You can check the validity of internal CAs in the Management Client:
• Internal Certificate Authorities: Select ConfigurationConfigurationAdministration,
navigate to Other ElementsInternal Certificate Authorities, and open the properties of
the certificate authority.
868 Chapter 64 Troubleshooting Certificates

• Internal VPN CAs: Select ConfigurationConfigurationVPN, navigate to Other
ElementsCertificatesVPN Certificate Authorities, and open the properties of the
certificate authority.
When the system has created a new Internal CA, each component must receive a new
certificate signed by the new internal CA. The system automatically tries to create new
certificates for firewall and IPS engines (except for SOHO firewalls) and SSL VPN gateways. For
other components, you must always manually create new certificates. If the automatic
certificate creation fails, you must create new certificates manually also for firewall and IPS
engines and SSL VPN gateways.
When a new internal VPN CA has been created, the VPN gateways that trust the old VPN CA
must be made to trust the new VPN CA. VPN clients that use certificates for user authentication
also require new certificates signed by the new VPN CA.
Other Problems
Common certificate-related issues not related to the validity time include:
• Certificates used in system communications become invalid when the certificate authority
changes.
• This happens if the Management Server is reinstalled and the configuration is recreated
manually or by importing elements instead of importing a backup (backups contain
certificate authority information). If backup restoration is not an option, all system
components must receive a new certificate for system communications.
• In some cases, also restoring the Management Server backup may result in the internal
certificate authority being different from the certificate authority that was used to create
certificates for some components. The invalid certificates must be replaced with new
ones.
• Note that in this case, internally signed VPN certificates can be made valid by configuring
the issuing certificate authority as an additional trusted certificate authority for the VPNs.
• Certificates created for the security gateways for establishing the VPN during the VPN
configuration are stored on the gateway devices (firewall/VPN engines). These certificates are
not included in the Management Server backup, and are not changed in any way when a
Management Server backup is restored.
• Certificates may become unusable if the private key for that certificate is lost. This can
happen, for example, if the firewall engine hardware fails and needs to be replaced. Firewall
clusters share each VPN certificate and can synchronize the private key from node-to-node as
needed. If the private key is erased from a single firewall or from all the nodes of a cluster, a
new certificate must be created.
• Externally issued VPN certificates may be revoked by the certificate authority that issued
them. This safety measure is used when the certificate is suspected to be compromised.
This problem can only be solved by contacting the certificate issuer.
What’s Next?
 To recreate a certificate for an SMC server component, see Renewing SMC Server
Certificates (page 870).
 To recreate a system communications or VPN certificate for an engine, see Renewing
Engine Certificates (page 871).
 To make StoneGate firewall/VPN engines accept VPN certificates signed by a new or
different certificate authority, see Defining a VPN Certificate Authority (page 757).
Understanding Certificate-Related Problems 869

Related Tasks
 Checking When Internal Certificates or Internal CAs Expire (page 108)
 Checking When an Internal VPN CA Expires (page 766)
Replacing Expired/Missing Certificates
Renewing SMC Server Certificates

Problem descriptions:
• The system indicates that the certificate of the Management Server, Log Server, or Web
Portal Server has expired.
• The system indicates that the Certificate Authority that signed the certificate of the
Management Server, Log Server, or Web Portal Server is about to expire, a new Certificate
Authority has been created, and the server requires a new certificate.
• The components refuse communications attempts with each other.
If the Management Server certificate expires or is lost, it is not possible to log in using
Management Clients. Log Server certificate expiration or loss prevents log browsing, reporting,
and status monitoring from working correctly, and forces the engines to spool logs locally.
Solution: The certificates of any of the SMC server components can be renewed without
impacting any of the other components. The certificate generation requires authentication in the
form of an administrator login (unrestricted administrator permissions required).
 To generate new certificates

1. Stop the StoneGate server you want to re-certify.
Note – To certify a Log Server or a Web Portal Server, the Management Server must be
running and accessible through the network.
2. On the server you want to certify, open the <installation directory>/bin folder.
3. Run the correct script for the server type:
• primary Management Server: sgCertifyMgtSrv.[bat|sh
• secondary Management Server: sgOnlineReplication.[bat|sh]
• primary or secondary Log Server: sgCertifyLogSrv.[bat|sh]
• Web Portal Server: sgCertifyWebPortalServer.[bat|sh]
4. When prompted, log in using an administrator account with unrestricted permissions.
• If Domains are in use, you can also specify the Domain the Log Server or the Web Portal
Server belongs to. If you do not specify the Domain, the Shared Domain is used.
5. Make sure the Certify Again an Existing Server option is selected and that the correct
server is selected in the list below.
6. Click OK and wait for a confirmation.
No further action is required. When you restart the server, all other components accept the new
certificate, since it is issued by a certificate authority they trust. In this context, components
only trust the Internal Certificate Authority that issued also their own certificate. Administrators
who log in to the Management Client or to the StoneGate Web Portal receive a notification of the
certificate fingerprint change on the Management or Web Portal Server when they log in for the

first time after the server’s certificate is changed. If you want to check the certificate fingerprint
before accepting it, run the sg-ShowFingerprint command on the server. See Command Line
Tools (page 917).
Related Tasks
 See Management Center Commands (page 918) for more information on the command line
tools on the servers.
Renewing Engine Certificates

Problem descriptions:
• The system indicates that an engine component’s certificate has expired.
• The system indicates that the Certificate Authority that signed the component’s certificate is
about to expire or has expired, a new Certificate Authority has been created, and the engine
requires a new certificate.
• Components refuse connection attempts with each other.
If the certificate for system communications expires or is deleted, the firewalls and sensors
continue processing traffic normally but all communications with other components will cease.
In the case of a cluster, traffic may be disturbed if expired certificates prevent nodes from
synchronizing information. The same also happens if the Internal Certificate Authority that signs
the certificates for system communications is about to expire, and engines do not have new
certificates signed by the new Internal Certificate Authority that the system has automatically
created. See Dealing with Expiring Certificate Authorities (page 872).
If a certificate for VPN authentication expires or is deleted, VPNs that are configured to use
certificates (this includes any VPN involving StoneGate IPsec VPN clients) cannot be established
before the certificate is renewed. A VPN certificate renewal or change may cause a security
warning to appear to VPN client users connecting to the gateway.
Reason: Automatic certificate renewal may be disabled in your system or may fail due to the
lack of required information or due to information loss or incompatibility issues that depend on
the software versions used when the system was originally installed. Automatic certificate
renewal is not supported for SOHO Firewalls.
Solution: Renew the certificates manually. Renewing the certificate requires a reboot, but
otherwise your system and the network services are not affected by the certificate change.
To generate new certificates:
• For the engine certificates used for StoneGate system communications, renew the contact
between the engine and the Management Server using a new one-time password. See
Connecting Engines to the StoneGate Management Center (page 391) and Reconfiguring
• The VPN gateway certificates are created and managed separately from the certificates used
in system communications. If a VPN certificate has expired, renew the certificate as
explained in Renewing VPN Certificates (page 763). If the VPN certificate is invalid for some
Replacing Expired/Missing Certificates 871

other reason, delete the Gateway Certificate element in the Management Client and then
create a completely new certificate as explained in Creating and Signing VPN Certificates
(page 759).
Related Tasks
 See Engine Commands (page 926) for a command line tool listing.
Dealing with Expiring Certificate Authorities

Problem description:
• The system indicates that the Certificate Authority that signed the certificate of a component
is about to expire, a new Certificate Authority has been created, and a new certificate must
be generated for the component because the Certificate Authority has been renewed.
• The system indicates that a VPN gateway must be set to trust a new internal VPN Certificate
Authority that was created automatically.
• Components refuse connection attempts with each other.
Reason: The messages are trigged to show that the expiration date of a Certificate Authority
approaches, a new Certificate Authority has been automatically created, or that a Certificate
Authority has expired. The messages may also indicate that administrator actions are required
so that the system components can start using the new Certificate Authority.
Solution: If a Certificate Authority is about to expire, the components that use certificates
signed by the Certificate Authority require new certificates that are signed by a valid Certificate
Authority.
• Renewing an external certificate authority used in VPN configurations:
• Configure a new certificate authority and make sure it is a trusted certificate authority in
the VPN configurations.
• Create new certificates for the components involved in the VPN configuration, signed by
the new certificate authority. See Managing VPN Certificates (page 755) for more
information.
• Renewing internal certificate authorities used in securing system communications and in
VPNs:
• The system automatically generates a new Internal Certificate Authority and a new
internal VPN Certificate Authority six months before their expiration dates.
• Each component that uses certificates signed by the Internal Certificate Authority or the
internal VPN Certificate Authority requires a new certificate that is signed by the new
Internal Certificate Authority or internal VPN Certificate Authority.
• See the sections that follow for information on renewing certificates for different types of
components.
System Communications Certificates for the SMC Servers
You must manually create a new certificate for each Management Server, Log Server, and Web
Portal Server using the StoneGate command line tools. See Renewing SMC Server Certificates
(page 870).

System Communications Certificates for the Engines
To create a new certificate for a SOHO firewall, you must make initial contact from the SOHO
Firewall to the Management Server (see the SOHO Firewall’s Appliance Installation Guide for
more information).
For other engines, including SSL VPN Gateways, no administrator actions are usually needed.
Once the new Internal CA has been created, new certificates are automatically created for the
engines. However, if the automatic certificate renewal fails for certificates used in system
communications, you must make initial contact from the engine to the Management Server. See
Connecting Engines to the StoneGate Management Center (page 391). After successful initial
contact, a new certificate is automatically created for the engine.
Internal VPN Gateways
A new certificate is automatically created for the internal gateway. All you need to do is refresh
the policy on the firewall/VPN engine
External VPN Gateways
If an external gateway trusts the internal VPN CA and the internal VPN CA has been renewed,
you must create a new certificate for the external gateway and sign it with the new internal VPN
CA. You must also set the new VPN CA as a trusted CA in the External Gateway’s properties and
also in the properties of the VPN Profile element that is used in the VPN configuration. See
Managing VPN Certificates (page 755) for more information.
VPN Clients
When an IPsec VPN client connects to a gateway that trusts the new internal VPN CA, the IPsec
VPN client users must accept the fingerprint of the gateway’s certificate before they can connect
to the gateway. Inform the users that the fingerprint of the gateway’s certificate has changed
and provide the information for checking the fingerprint in the IPsec VPN client.
If certificates are used to authenticate IPsec VPN client users and the certificates have been
signed with the internal VPN CA, you must create new certificates for the IPsec VPN client users
using the new VPN CA. See Renewing VPN Certificates (page 763) for more information.
Dealing with Expiring Certificate Authorities 873

C HAPT ER 65
TROUBLESHOOTING ENGINE OPERATION
Issues covered here concentrate on errors and problems that are directly related to the
operation of firewall, sensor, and analyzer engines. Issues related to configuring individual
features of the system, such as issues related to designing and installing policies, are
covered in separate sections.
Node Does not Go or Stay Online (page 876)

Error Commanding an Engine (page 876)
Errors with Heartbeat and Synchronization (page 877)
Problems Contacting the Management Server (page 877)
875
Node Does not Go or Stay Online
Problem description: when you command a node online, it does not do so or turns itself offline
in a little while.
Solution:
If you have just updated the engines or you are using an evaluation license:
• Open the Administration Configuration view and check that your licenses are valid for the
version of engines you are using under Licenses in the tree view. If you need new licenses,
generate them at the Stonesoft web site, see Generating New Licenses (page 826).
If the nodes are in a cluster, and only one node at a time seems to stay online:
• Check whether the cluster is in Standby mode. Standby mode keeps one node online at a
time and uses the other nodes as backups in case the online node fails. See Adjusting
Firewall Clustering Options (page 419) or Adjusting Sensor Clustering Options (page 429).
• Refresh the policy of the cluster and check that the installation is successful so that neither
node rolls back to the previous configuration. All nodes in the cluster must have the exact
same configuration that has been installed in the same policy installation operation. You may
have to adjust the rollback timeout in the cluster’s properties if policy rollback on some node
is the problem, see Adjusting Firewall System Parameters (page 416). If policy installation
fails, see Troubleshooting Firewall Policy Installation (page 898).
• Check for alerts in the Logs view about tests failing, and if any of those tests are configured
to turn the node offline when they fail (tester will leave one node in a cluster online even if the
test fails on all nodes). If you see a test failure, it may indicate a genuine problem you need
to solve or the test may be misconfigured and may need to be disabled or reconfigured. See
more information in Getting Started with the Engine Tester (page 398).
See the Logs view for any alerts or logs regarding the functioning of the nodes.
• Certain internal error conditions (for example, heartbeat connection failures or missing
certificates) may cause nodes to go offline. These events are shown as logs and alerts.
Error Commanding an Engine

Problem description: you try to command an engine using the Management Client and receive
an error.
Solution:
• Refresh the engine’s policy. If there are disabled nodes in the same cluster, enable them
before refreshing the policy. Read all messages displayed and make sure none of the nodes
roll back to the previous policy. If policy installation fails, see Troubleshooting Firewall Policy
Installation (page 898).
• If policy installation fails and the status and statistics information displayed in the
Management Client is missing (status is displayed as unknown) even though the engine in
reality is online and processing traffic, the problem may be due to an expired certificate, see
Understanding Certificate-Related Problems (page 868).
876 Chapter 65 Troubleshooting Engine Operation

Errors with Heartbeat and Synchronization
Problem description: you receive alerts regarding the heartbeat connection between the nodes
in a cluster.
Solution:
• Apply normal network troubleshooting (check speed and duplex settings, cabling, etc.) to
ensure that the heartbeat link works reliably.
• You should have a primary and a backup heartbeat connection using completely separate
physical links.
• It is highly recommended that you use a dedicated link for both the primary and the backup
heartbeat. The heartbeat and state synchronization are time-critical communications. he
heartbeat connection is absolutely critical to the operation of a cluster. The cluster cannot
work without a reliable heartbeat connection.
If you have installed two or more StoneGate clusters with a single LAN as a shared heartbeat,
and you see extra log entries about unauthenticated heartbeat messages:
• Change the Heartbeat IP and the Synchronization IP so that each cluster uses a different
address. See Adjusting Firewall Clustering Options (page 419).
Problems Contacting the Management Server

Problem description: the engine cannot establish initial contact to the Management Server, or
all subsequent attempts to command the engine through the Management Client fail.
Solution: perform normal network troubleshooting. If there is a local firewall between a remote
site firewall and the Management Server, the local firewall blocks the communication. For a full
list of all system communications in all configurations, see Default Communication Ports
(page 933).
Example A firewall with reversed management connections (for example, because it has a dynamic IP
address) contacts the Management Server on port 8906, and you must create an Access rule
in the policy of the main site firewall to allow the connection:
• Source: remote site firewall
• Destination: contact address of the Management Server
• Service: SG-dynamic-control
• Action: Allow
Errors with Heartbeat and Synchronization 877

878 Chapter 65 Troubleshooting Engine Operation
C HAPT ER 66
TROUBLESHOOTING LICENSING
Licenses are a proof of purchase used for ensuring that your organization is a legal license
holder of the software.
Troubleshooting Licensing (page 880)

License Is Shown as ‘Retained’ (page 880)
License Is Shown as ‘Unassigned’ (page 881)
“Throughput Based License Exceeded” Alerts (page 881)
879
Troubleshooting Licensing
Note – Do not confuse Licenses with Certificates. Licenses are a proof of purchase (given
to you by Stonesoft) used for ensuring that your organization is a legal license holder of the
software. Certificates are proof of identity (generated in your installation of the system)
that components use to authenticate themselves in system communications. For
troubleshooting certificates, see Troubleshooting Certificates (page 867).
Licenses are introduced to the system as elements that you install in your Management Server.
You must install licenses to set up the components your organization has purchased.
Components that do not have a license do not work. However, on current appliance models
running Firewall/VPN 5.0 and IPS 5.0 or above, the licenses may be generated automatically.
If the Management Server does not have a valid license, you are shown a license-related dialog
each time you log in using the Management Client. You cannot create a working configuration
without a Management Server license, since most controls are disabled. If an engine
component is missing a license, you can create a configuration for it, but you cannot transfer
that configuration to the engine.
Basic troubleshooting information and solutions for the most common problems with licenses
are provided in the following topics:
• License Is Shown as ‘Retained’ (page 880)
• License Is Shown as ‘Unassigned’ (page 881)
• “Throughput Based License Exceeded” (page 859)
Related Tasks
 Getting Started with Licenses (page 824)
License Is Shown as ‘Retained’

Problem description: when you view the information for a license in the Management Client, the
State column displays “retained”.
Reason: Licenses can be generated based on the Management Server's proof-of-license (POL)
code instead of a fixed IP address. When you start using a Dynamic license, you bind it to the
correct engine or Log Server, and the system makes this binding fixed when you install the
component's policy. Because of this fixed binding, if you unbind a dynamic license, it is shown
as ‘Retained’ and it is not possible to reuse the Dynamic license on some other component or
delete it.
Solution: complete one of theprocedures listed below according to what fits your situation the
best.
• Rebind the license to the component it was previously bound to.
• Right-click the license and select Cancel Unbind.
• Replace the component's license with a new Dynamic license.
• Install a new Dynamic license into the system and bind it to the component that the
retained license is bound to. The state of the previous Dynamic license changes to
Unassigned and it can be rebound to some other component or deleted.
880 Chapter 66 Troubleshooting Licensing

• Replace the component's license with a new Static license:
• You can replace a Dynamic license directly with a Static license. Select the option
Replace by Static License from the right-click menu of the Dynamic license in the
Management Client. Note, that the Static license must be installed before you select the
option Replace by Static License.
• Delete the element for the component that the dynamic license is bound to
• After the element is deleted, the state of the Dynamic license changes to Unassigned
and it can be rebound to some other component or deleted.
License Is Shown as ‘Unassigned’

Problem description: when you import a new license, it does not attach itself to any
component, but is shown as ‘unassigned’.
Reason: The license does not contain identifying information that the Management Server could
use to attach the license to a component. This is normal for Dynamic licenses (for more
information on license types and states, see Checking License Validity and State (page 831)).
Solution: Right-click the license and select Bind to select which component you want to license.
If this is an engine license for a StoneGate appliance, make sure you attach the correct license
to the correct engine (since the license contains appliance model specific restrictions), and
refresh the engine’s policy. See Installing Licenses (page 828) for more information.
“Throughput Based License Exceeded” Alerts

See “Throughput Based License Exceeded” (page 859).
License Is Shown as ‘Unassigned’ 881

882 Chapter 66 Troubleshooting Licensing
C HAPT ER 67
TROUBLESHOOTING LOGGING
This section covers some common problems you may have with viewing logs or when
performing tasks related to the log files. For information about particular messages you may
see in the logs, see Log Messages (page 860).
Problems With Viewing Logs (page 884)

Logs Are Filling up the Storage Space (page 884)
Log Server Does not Run (page 885)
883
Problems With Viewing Logs
If the Logs view is unable to contact some Log Server:
• Check that the Log Server is running, and that the Log Server is reachable from the computer
used for running the Management Client. Logged data is not routed through the Management
Server, so a green status shown for a Log Server in the Management Client (based on
information that the Management Server has) is not an indication of whether the Log Server
is reachable for log browsing or not.
• If there is a NAT device between some Management Client and a Log Server, administrators
must select the correct Location for the Management Client in the status bar at the bottom
right corner of the Management Client window. See Getting Started with System
If some or all logs are not visible in the Logs view:
• Check that the filtering, time range, and source settings in the Logs view are correct and
make sure you have clicked Apply after making the latest changes in these settings.
• Check the logging options in your policies. Not all connections automatically create log
entries. The Alert, Stored, and Essential options generate permanent log entries. The
Transient option means that logs are not stored, they can only be viewed in the Current
Events mode in the Logs view when they reach the Log Server.
• Check that logs you want to keep are not being pruned, see Pruning Log Data (page 807). The
Log Server deletes selected logs according to how pruning is configured.
• Check that the logs are being transferred from the engines to the Log Server. The log entries
are spooled on the engines if a connection to the Log Server is unavailable. Connections
between engines and the Log Server should be shown as green in the System Status view.
• Depending on your logging settings and the number of engines that send data to the same
Log Server, the logging process may slow down due to a lack of resources on the engine, in
the network, or on the Log Server, see Logs Are Filling up the Storage Space (page 884).
Logs Are Filling up the Storage Space

Problem description: the hard disk of an engine or a Log Server is filling up with log files as
indicated by alerts you receive.
Solution:
If an engine is filling up with logs:
• Check that the Log Server is running. If it is not running, try to start it (see Log Server Does
not Run (page 885) if the Log server does not stay running). If the log server is running,
check for network problems between the engine and the Log Server. The log entries are
spooled on the engines if they cannot be sent to the Log Server. Stopping and restarting the
Log Server process may help in resetting the connection.
• If the volume of logs is extremely high, they may not be transferred quick enough, and logs
have to be spooled even though they are being transferred. If you suspect this is the case,
turn off all diagnostics logs for all engines that you are not actively troubleshooting (see
Enabling/Disabling Firewall/VPN Diagnostics (page 193)), turn off logging for all rules that
have connection tracking set to off (because these rules log each packet individually), and
check if logs that are currently pruned could be prevented from being generated in the first
place.
884 Chapter 67 Troubleshooting Logging

If the Log Server is filling up with logs:
• Set up log management tasks that archive and remove the oldest Log entries from the Log
Server hard disk, see Getting Started with Log Data Management (page 800). To avoid
problems in the future, set up tasks to run automatically at regular intervals.
• The logs are stored on the Log Server machine under a folder structure based on dates and
times (default location is <installation directory>/data/storage). In an emergency,
you can also move or delete old log entries manually. You should always avoid manual
handling of the newest entries.
Log Server Does not Run

Problem description: the Log Server is not running and does not stay running when you try to
start it.
Solution:
• To get more information, try to start the log server using the script <intallation
directory>/bin/sgStartLogSrv[.bat|.sh]. Startup messages are shown on the
command line and you may gain more information if the startup fails.
Possible issues and solutions include:
• The software version may be incorrect. The Log Server must have the exact same software
version as the Management Server. Upgrade components as necessary.
• The Log Server’s certificate for system communications may have expired, been deleted, or
become otherwise invalid, see Understanding Certificate-Related Problems (page 868).
• The Log Server may not have a license, the license may be bound to the wrong IP address, or
the IP address the license is bound to may not be active on the server, see Troubleshooting
Licensing (page 880).
• There may not be enough space for logs on the hard disk, see Logs Are Filling up the Storage
Space (page 884).
• Sometimes files that are necessary for the Log Server to run may be moved or deleted by
external processes, such as a virus scanners, or lost due to hard disk errors. In these types
of cases, Java shows an error message stating “Could not find the main class”. Reinstall the
same software version and check the configuration of the host computer to prevent the same
from occurring in the future.
Log Server Does not Run 885

886 Chapter 67 Troubleshooting Logging
C HAPT ER 68
TROUBLESHOOTING THE MANAGEMENT

CLIENT
This section concentrates on general problems you may encounter when using the
Management Client.
Cannot View Online Help: “Help File Not Found” (page 888)
Some Options Are Disabled (page 888)
Slow Startup and Use (page 889)
Problems Logging In with the Management Client (page 889)
Problems with Layout and Views (page 890)
Problems With Viewing Statistics (page 890)
Problems with Status Monitoring (page 890)
Problems Installing Web Start on an External Server (page 891)
887
Cannot View Online Help: “Help File Not Found”
Problem description: you try to open the Online Help in the Management Client, but you get an
error message instead.
Reason: the necessary files reside in the InstallerData directory in the installation source. If the
installer does not find this directory or the files within when the Management Client is installed,
the Online Help is not installed properly. If you need to copy installation files from one location
to another, make sure you include all directories.
Solution:
If the client is installed locally:
• Reinstall the Management Client with the correct files present at installation time or shut
down the Management Client and manually copy the necessary files as follows: copy the .jar
files from the installation source, folder StoneGate_SW_Installer/InstallerData/
managementclient into <installation directory>/lib on the local computer. Overwrite
the placeholder files by the same name that already exist in the destination directory.
If the client is installed through the integrated Web Start server:
• Copy the .jar files from the installation source directory StoneGate_SW_Installer/
InstallerData/managementclient to <installation directory>/webserver/
webapps/managementclient/lib on the Management Server computer. Overwrite the
placeholder files by the same name that already exist in the destination directory. Already
installed Web Start clients update their local copies of these files the next time they are
started.
Some Options Are Disabled

Problem description: some options are disabled (you can see them, but they are greyed out or
otherwise uneditable).
Solution:
• If nearly all controls are disabled, the Management Server license may not be installed or
valid, see Generating New Licenses (page 826) for directions on how to create and import a
license file. Make sure that the IP address in the license is correct and that the network
interface with that IP address is active on the Management Server.
• Your administrator permissions may restrict your actions. For example, Operator
administrators are only allowed to view the contents of the elements granted to them. They
are not allowed to change the elements’ properties. See Administrator Accounts (page 213)
for more information. If you want to edit an element that is locked, you must first unlock the
element. See Locking and Unlocking Elements (page 79).
• The disabled options may be part of an element or object created by the installation. These
system objects cannot be edited, but usually you can make copies of them and edit and use
the copies instead. Select the element in a Configuration view and check the History tab in
the Info panel. System elements display “System” as the Creator.
• The options may be part of a feature that is not supported by the engine version you are
using. If this is the case, you must upgrade the engines before you can use the feature. See
the Release Notes for information on new and enhanced features in different versions at
http://www.stonesoft.com/support/. For information on new features introduced in this
version of the Management Center, see What’s New? (page 27).
888 Chapter 68 Troubleshooting the Management Client

• Changing the disabled options may require selecting some other option first. Look for an
option to activate the feature or override the default values, or a way to change the default
values instead.
Slow Startup and Use

Problem description: the Management Client login and other operations are slow (e.g.,
refreshing a list of network elements takes a long time).
Solution: make sure the Management Server and Log Server hostnames can be resolved on the
computer running the Management Client (even if the Management Client is running on the
same computer as the server components). Add the IP address and hostname pairs into the
local hosts file on the client computer:
• In Linux: /etc/hosts
• In Windows: \WINNT\system32\drivers\etc\hosts
Log browsing is also slowed down if all selected Sources (Log Servers) are not available (data is
displayed only after queries time out). Exclude temporarily unavailable Log Servers from Sources
and make sure that the Location is set correctly for your Management Client (in the status bar)
if there is a NAT device in between your client and a Log Server.
Problems Logging In with the Management Client

If the Management Client reports a connection problem:
• Make sure you entered the address correctly on the login screen. If there is a NAT device in
between the Management Client and the Management Server, the IP address used must be
the NATed address. Locations and Contact Addresses are not used for selecting the correct
address when you are just logging in.
• Verify that the Management Server is running.
• Verify that the network between the Management Client and the Management Server is
working and routes the traffic correctly. See Default Communication Ports (page 933) for the
ports and protocols used for the communications. Note that these communications are not
allowed in the Default template for StoneGate firewalls.
If you see a certificate expiration message:
• The Management Server certificate has expired. See Renewing SMC Server Certificates
(page 870).
If you have forgotten your password:
• See Forgotten Passwords (page 854).
Slow Startup and Use 889

Problems with Layout and Views
If a view that was previously visible is now missing:
1. Select the appropriate view from the View menu. If the view is not listed, it is not available
in this window.
2. If the view is still not visible, select ViewLayoutReset Layout from the menu.
If all views you want to view on screen are visible, but they are laid out in the wrong way:
• You can drag and drop the views by their titles to different predefined positions on screen and
resize them by dragging the borders.
• You can reset the layout to the default positions, select ViewLayoutReset Layout from
the menu.
Problems With Viewing Statistics

If you can see some types of statistics for an element, but not other types:
• This is normal. All statistics are not compatible with all element types.
If an element does not show any statistics at all:
• If this is a server element, this is normal. Servers do not produce statistical information. Only
engine elements do.
• Check that the Primary Log Server is set correctly in the Management Server properties, that
this Log Server is running, and that the network connections are up between the engines, the
Log Server, and the Management Server. Statistical information is sent from the engines to
the Log Server, which relays the information to the Management Server.
Problems with Status Monitoring

If a status icon for an element is always white:
• The status monitoring for the element is turned off. To turn it on, see Monitoring Task
Execution (page 106).
If you do not know what the status icon is trying to show:
• Place the mouse pointer over the element and wait for a tooltip to show to view the element’s
status as text. For more information, see Monitoring the System (page 83).
If the status in the Management Server indicates problems, but the engine is processing traffic
normally:
• Check network connectivity: status information is normally sent from the engines to the Log
Server, which then relays the information to the Management Server. There is also a backup
channel directly from the engines to the Management Server. See Default Communication
Ports (page 933).
If no information is available on the Appliance Status tab in the Info panel:
• Appliance Status information is not displayed automatically. Click Refresh on the Appliance
Status tab to view the information. Appliance Status information is only available for engine
versions 4.3 or higher.

Problems Installing Web Start on an External Server
Problem description: the automatic Web Start installation using the webstart_setup.vbs or
webstart_setup.sh scripts fails.
Solution: manually configure the Web Start files.
 To configure Web Start files manually

1. Copy the Web Start folder to your workstation. The Web Start software can be found on your
product CD-ROM in the StoneGate_SW_Installer/Webstart directory.
2. Edit the following files in a text editor and enter the correct path of the Web Start folder on
your Web server or network drive on the codebase row at the beginning of each file:
Table 68.1 Files to be Edited
File name Example

codebase=”http://www.example.com/webstart”
smcclient.jnlp Or
codebase=”file://localhost/C:/webstart”
bouncycastle.jnlp Or
smc_help.jnlp Or
3. Save and close each file.

4. Put a link to the smcclient.jnlp file on your Web site. An example start page is provided with
the Web Start package, containing the link to start the application.
5. If necessary, modify the configuration of the Web server to return the appropriate MIME
type for.jnlp-files (application/x-java-jnlp-file). Consult the manual of your Web
server for instructions on how to configure the MIME type.
Problems Installing Web Start on an External Server 891

C HAPT ER 69
TROUBLESHOOTING NAT
This section concentrates on some common problems you may encounter with NAT
definitions.
Troubleshooting NAT Errors (page 894)

NAT Is Not Applied Correctly (page 894)
NAT Is Applied When it Should Not Be (page 895)
893
Troubleshooting NAT Errors
Consider the following when troubleshooting NAT issues:
• A Dynamic NAT operation cannot be applied to all types of traffic. Dynamic (many-to-one) NAT
is done by assigning different hosts the same IP address but different ports, so that the
subsequent replies can be recognized and forwarded correctly. For this reason, dynamic NAT
does not work when the protocol in question does not use ports (only one connection can be
handled at a time). Only the TCP and UDP transport protocols use ports. See the TCP and
UDP branches in the Services tree in the Management Client to check which protocols are
transported over TCP or UDP. Use static translation for other protocols, or check if the
communicating application supports NAT traversal (tunneling the protocol inside TCP or UDP).
• Dynamic NAT may run out of ports if there are too many simultaneous connections in relation
to the IP addresses and the port range you have configured for dynamic NAT. You can increase
the available ports for translation by adding a new IP address for your dynamic NAT rule or by
expanding the port range, if the rule does not currently use the whole range of high ports. The
number of simultaneous NATed connections equals the number of IP addresses multiplied by
the number of ports.
• Check the NAT rules for definitions that overlap with the address translation done configured
in an Outbound Multi-Link or Server Pool element or the NAT pool defined for VPN clients in
the Firewall element’s properties. Errors may occur when one of the listed elements is used
and the same connection matches an overlapping NAT rule, because the elements also use
NAT. Naturally, only one address translation operation can be done for each packet and
overlapping definitions may therefore cause conflicts. Overlap within the NAT rules alone is
allowed, since the rules are resolved based on their order (first matching rule is applied).
• Check that the NAT definitions do not overlap with an IP address that is used by some
physical host present in the network (this configuration error is most common in the case of
source address translation for a DMZ or external IP address). IP address conflicts are not any
less harmful to connectivity when NAT is involved.
NAT Is Not Applied Correctly

Problem description: NAT is not applied at all or is applied incorrectly.
Solution:
• Any connection that you want to NAT must be allowed by an Access rule with the connection
tracking option active. No NAT of any kind can be applied to packets that are not tracked as
part of a connection.
• If the target of the translation is traffic that is entering or exiting a VPN tunnel, enable
address translation for traffic transmitted over that VPN in the properties of the VPN element
(default setting is to disable all address translation for tunnelled VPN traffic). The setting
affects only traffic wrapped inside the VPN tunnel, not the tunnel itself (the encrypted
packets).
• If traffic is not translated at all or the wrong translation is applied, check the NAT rules: make
a rule search with the original (before translation) source and destination address and check
if the traffic matches the wrong NAT rule higher up in the rule table. Only the first matching
rule is considered. Note that NAT rules with an empty NAT cell are valid and specify that
addresses are not translated for matching traffic.
• In addition to NAT rules, NAT definitions are also used in a NetLink or Server Pool elements,
and as a NAT pool defined for VPN clients in the Firewall element’s properties. There must not
be additional NAT operations defined for the same connections in the NAT rules.
894 Chapter 69 Troubleshooting NAT

NAT Is Applied When it Should Not Be
Problem description: the firewall translates an IP address to some other IP address even
though it should not.
Solution:
• The firewall reads the NAT rules from top to bottom and only the first rule that matches is
considered, so you can make exceptions to rules by placing a different, partially overlapping
rule above. Leaving the NAT cell empty tells the firewall that addresses in any connections
that match the rule should not be translated. For more information, see Editing NAT Rules
(page 545).
• For VPN traffic, you can also enable and disable address translation for all traffic transmitted
over a VPN in the properties of the VPN element (default setting is to disable all address
translation for tunnelled VPN traffic). The setting affects only traffic wrapped inside the VPN
tunnel, not the tunnel itself (the encrypted packets).
• Alongside the NAT rules, NAT definitions are also used in NetLink and Server Pool elements,
and as a NAT pool defined for VPN clients in the Firewall element’s properties. In the case of
NetLinks, NAT rules are used to select traffic for balancing, and only the actual IP addresses
used for the translation are defined in the NetLink elements. NAT is required for the operation
of these features and you must exclude the connections in question from the scope of these
features to disable NAT.
NAT Is Applied When it Should Not Be 895

896 Chapter 69 Troubleshooting NAT
C HAPT ER 70
TROUBLESHOOTING POLICIES
This section covers some common problems you may encounter when working with policies
and the rules that they contain.
Troubleshooting Firewall Policy Installation (page 898)

Troubleshooting IPS Policy Installation (page 900)
Troubleshooting Rules (page 900)
897
Troubleshooting Firewall Policy Installation
Problem description: the policy installation fails, or there is a warning message indicating
problems in the policy installation window.
Solution: see below for most common problems and messages:
• The Engine Performs a Roll-Back at Policy Installation (page 898)
• The Management Server Contact to Nodes Times Out (page 898)
• Policy Installation Fails for Some Other Reason (page 899)
• Warning “Automatic Proxy ARP Option Is Ignored” (page 899)
The Engine Performs a Roll-Back at Policy Installation

Problem description: The policy installation reports that the Management Server can contact
the engines and installs the new policy successfully, but then the policy installation results in a
roll-back to the previously installed policy version.
Reason: The roll-back is a safety mechanism that prevents changing the engines’ policy in ways
that cut the connectivity between the engines and the Management Server. After each policy
installation, the engine contacts the SMC using its new configuration and automatically revert
their policy if the contact does not succeed within a time-out period.
Solution:
• Make sure the policy and the configuration changes you have made do not prevent
communications between the Management Server and the engine.
• Check the IPv4 Access Rules and NAT rules (as applicable). You can additionally validate
the policy to see if there are issues in it that prevent the policy installation. See Validating
Rules Automatically (page 556). The rule search is useful for finding the first rule that
matches the connections. See Searching in Rules (page 514).
• Check the Routing. You can use the Route Query tool to check where the packets will be
routed after a policy installation. See Checking Routes (page 456).
• Check the Locations and Contact Addresses of the system components, which are
required if NAT is applied to these system communications. See Getting Started with
• The rollback occurs after a timeout set in the engine element’s advanced properties. If you
are sure that there are no configuration or policy design issues, you can increase the timeout
to allow for longer delays in contact. This may help if the timeout is caused by poor network
reliability or delays caused by processing a policy that is extremely large considering the
engine’s available resources. See Adjusting Firewall System Parameters (page 416).
The Management Server Contact to Nodes Times Out

Problem description: The engine is up and running, but policy installation fails when the
Management Server is contacting the nodes or the Management Server is left waiting for
contact from a node (node-initiated contact is active) that never happens.
Reason: There is no network-level connectivity, the engine or the Management Server uses the
wrong IP address, or the engine and the Management Server reject each others’ certificates.
Solution:
• Check for network problems, like faulty or loose cables, mismatching speed/duplex settings,
IP addresses, and routing.
898 Chapter 70 Troubleshooting Policies

• Check the Locations and Contact Addresses of the system components, which are required if
NAT is applied to these system communications. See Getting Started with System
• In a cluster, all nodes that the Management Server tries to contact must be reachable and
operational to install a policy on any of the clustered engines. If you have taken an engine
down for maintenance, you must temporarily disable it to install the policy on the other
cluster members. See Disabling Nodes of a Cluster Temporarily (page 195).
• If the problem seems to be related to certificates, you can recertify the engine to re-establish
contact between the engine and the Management Center. See Getting Started with
Connecting Engines to the SMC (page 392).
Policy Installation Fails for Some Other Reason

• If there policy installation ends with an error, read the messages both in the main window and
in the Issues tab below and correct as necessary. Note that warnings do not prevent policy
installation; you can still press Continue in the policy installation even if a warning is
triggered. You can also validate the policy separately to see if there are issues that prevent
you from installing it. See Validating Rules Automatically (page 556).
• Try installing the policy with the “Keep Previous Configuration Definitions” option
deselected. Normally, the option should be selected, but under certain conditions, the old
configuration definitions may not be compatible with the new policy, so the firewall cannot
fulfill this request and policy installation fails.
Caution – As the policy is installed with the “Keep Previous Configuration Definitions”
option deselected, even some currently active connections that are allowed in the new
policy may be cut. The applications must then reopen the connections.
Warning “Automatic Proxy ARP Option Is Ignored”

• The “Automatic Proxy ARP option in NAT rule <rule tag> is ignored: none of the CVI interfaces
are directly connected to the network in question” warning is shown when proxy ARP has
been defined but there is no matching CVI network configured in the firewall element.
Automatic proxy ARP is used in NAT to handle ARP requests to the translated IP address for
hosts in networks that are directly connected to the firewall. This warning can be due to
incorrect IP-address or netmask setting, the (not directly connected) Network in question
missing from the Routing view, or selecting the option for a NAT rule that involves an IP
address for which the firewall cannot act as an ARP proxy.
• Related settings can be configured in NAT rules (Editing NAT Rules (page 545)), in a Server
Pool element (Configuring Outbound Multi-Link Settings (page 461)), in the firewall element
(Firewall Interface Configuration (page 343)), and in the Routing view (Getting Started with
Routing (page 440)).
Troubleshooting Firewall Policy Installation 899

Troubleshooting IPS Policy Installation
You install the IPS policy only on the sensor; the analyzer policy is automatically updated in the
same policy installation. If either policy installation fails, check for the common problems listed
in this section. You should also validate the policy to see if there are issues in it that prevent the
installation. See Validating Rules Automatically (page 556).
Check the software version on your sensors and analyzers (shown in the Info panel when you
select the element in the Management Client).
• A sensor and its connected analyzer must have the same software version.
• Make sure that a current dynamic update package is imported and activated on the
Management Server.
• See the release notes for information regarding version compatibility between the engine and
SMC software versions.
If the Management Server is not able to contact the engines, check the connection monitoring
information in the System Status view:
• If the problem seems to be related to certificates (possibly indicated by SSL-related or
“connection refused” messages), you can recertify the engine to re-establish contact
between the engine and the Management Center. See Getting Started with Connecting
Engines to the SMC (page 392).
• Check for network problems, like faulty or loose cables, mismatching speed/duplex settings
etc.
Troubleshooting Rules
Validating Rules
You can automatically validate a policy and check the rules for invalid configurations, for
example, if policy installation fails. See Validating Rules Automatically (page 556) for more
information.
Rule That Allows ANY Service Does Not Allow All Traffic
Problem description: some connection you want to allow is stopped.
Solution:
If your problem is related to the IPS policies, note that in IPS policies, Access rules allow all
connections by default. If some connection you want to allow is stopped because of an IPS
Access rule, your Access rules contain a specific rule that defines these connections must be
stopped. If your problem is related to inspection rules, see Inspection Rules Produce False
Positives (page 901).
In firewall Access rules, even if you set the Source, Destination, and Service to ANY and set the
rule to allow the traffic, certain connections may still be discarded.
• Connections with a protocol that assigns ports dynamically must be allowed using the
appropriate Protocol Agent, so that the Firewall can track the assigned port.

• For a Protocol Agent to be used in a rule with ANY as the Service, there must be a matching
rule with Continue as the action further up in the rule table with a Service in which the correct
Protocol Agent is used.
• The Default template contains a rule that does this for some, but not all protocols that use a
dynamic port assignment. Add your own rules as necessary.
• Connections that violate the standard TCP connection sequence are dropped. If you must
allow connections in your network for some application that implements TCP incorrectly, you
may need to adjust or even disable connection tracking in the Access rules for those
connections. See Defining Firewall “Allow” Action Options (page 523). Note that NAT
operations are not possible without connection tracking. We recommend that you disable
logging for rules that have connection tracking set to off, because such rules create a new log
entry for each and every packet.
Inspection Rules Produce False Positives

Problem description: the IPS produces alerts or terminates traffic that you consider to be
normal.
Solution: (do one of the following)
• If the Situation is not valid in your environment under any conditions, change the action for
the Situation to Permit in the rule tree.
• If the Situation is not valid between some known hosts, add an Inspection rule exception
above the rule that produces false positives for the Source, Destination, and Situation that
produce false positives and set the action to Permit. This can be done manually or based on
a log entry through its right-click menu.
• If the Situation is a custom one, adjust the parameters in the Situation to better match the
traffic pattern that you want to detect.
How to Enable Passthrough for PPTP Traffic

To allow PPTP passthrough, add matching Access rule(s) with the following two services:
• The TCP Service for PPTP. The default Service element for PPTP uses the standard destination
port 1723. Check the actual port used and create a new Service with a different port, if
necessary.
• The IP Service for GRE (IP protocol 47).
Make sure that the GRE traffic is not matched against any dynamic NAT rule, including the
dynamic NAT rule required to load-balance connections between NetLinks in a Multi-Link
configuration. Use static NAT instead if IP address translation is required or configure the
communicating applications to encapsulate the traffic in TCP or UDP (NAT traversal mode).
Dynamic NAT cannot be applied, because it uses ports to keep track of connections using the
same IP address. GRE works directly on top of IP and does not have the concept of ports, so it
is not possible to do the same with GRE, requiring a static translation that forms a fixed one-to-
one relationship between an original and translated IP address (use a static IP address to IP
address or network to same-size network mapping in the NAT rules).
Even with static NAT, some PPTP implementations require extra setup (for example,
encapsulation of the packets) to work correctly when IP addresses are translated.
Troubleshooting Rules 901

Traffic I Want to Allow Is Stopped by the Firewall
 To troubleshoot why traffic is not passing through the firewall
1. In the Logs view, check if the connection is logged.
• Add a quick filter for both the source and destination IP address of the traffic you want to
allow through the New button of the Query view and click Apply.
• If the logs show that the connection is discarded or refused by a rule, click the Rule Tag
link in the log entry to check the rule.
• See Troubleshooting Alerts, Errors, and Log Messages (page 857) for some common
messages you may see in the logs.
2. Check the Access rules and NAT rules of the active policy for rules matching the same
source, destination, and service.
2a. Open the Search Rules panel through the policy view’s toolbar and drag and drop the
corresponding elements to the search fields at the bottom of the rule table.
2b. Select Show Only Matching Rules from Options in the search panel.
2c. Deselect Do Not Match ANY from Options in the search panel.
2d. If several rules are shown, the topmost rule is the one that counts, unless the Source
VPN cell (in IPv4 Access rules) has a definition that does not match. The other cells are
not used for matching, but define options for what happens when traffic does match.
3. If the first matching Access rule is set to allow the traffic, check that other parts of the rule
are correct:
• Some protocols require the correct Protocol Agent, which is set by including the correct
Service with the correct Protocol attached. In some cases, you may need to change the
options of the Protocol Agent. See Using Protocol Elements (page 579).
• ANY rules do not use most Protocol Agents by default. See Rule That Allows ANY Service
Does Not Allow All Traffic (page 900).
• You can create new Services for any source or destination port or port range as needed.
• The Connection Tracking Action options define if stateful inspection is used and how strict
the checks are. Connection tracking allows NAT rules to be applied to the connection and
a rule table where reply packets do not need to be separately allowed. The firewall checks
that the communications follow the standards of the protocol used and discards invalid
communications. If invalid communications need to be allowed, you may need to adjust
connection tracking options. See Defining Firewall “Allow” Action Options (page 523).
4. If there is a matching NAT rule, make sure that they are applied correctly. Particularly,
dynamic NAT must only be used for protocols that work on top of TCP or UDP, since dynamic
NAT uses ports to keep track of the translated connections.
5. Check your routing configuration. If Routing is incorrectly configured on the firewall, packets
may be dropped because the firewall has no route where to send them. See Getting Started
with Routing (page 440).

Packets Are Dropped as Spoofed
StoneGate generates antispoofing rules automatically based on your routing configuration.
Generally, traffic is only allowed if the IP address seen in the communications corresponds to
the IP address space that is defined for routing through that interface in the Routing view.
Normally, communications require this routing information in any case for any reply packets to
be correctly routed, but in cases where communications are one-way, you can make exceptions
to the antispoofing in the Antispoofing view.
By default, the antispoofing tree is read by picking the most specific entry defined in the view
(for example, a definition of a single IP address is picked over a definition of a whole network). If
some IP address must be allowed access through two or more different interfaces, the definition
for each interface must be at the same level of detail for the IP address in question.
Example If Interface A contains a Host element for 192.168.10.101 and Interface B contains a
Network element for 192.168.10.0/24, connections from 192.168.10.101 are considered
spoofed if they enter through Interface B. If this is not desired, the Host element must be
added also under Interface B (in addition to the Network element already included).
The behavior explained above can be changed by setting the more general setting (network) as
Absolute through its right-click menu in the antispoofing tree. This allows the address through
the interface even if there is a more specific definition attached to some other interface.
Antispoofing also discards packets that are in a routing loop: if the firewall accepts a packet, but
then receives the exact same packet again through a different interface, the firewall drops it.
This makes no difference to the success of communications, but saves the firewall and other
equipment in your network from handling the same packet over and over again until it finally
expires. If this is the case, you must correct the routing in your network. Often, routing loops are
indicated by “NIC index changed” information in logs that discard the connection (the same
packet enters the firewall a second time, but through a different interface - usually because the
device where the firewall is configured to send the packet routes the packet right back to the
firewall).
Unsupported Definitions in IPv6 Access Rules

Elements used in the Source and Destination fields of the IPv6 Access rules must contain an
IPv6 address. Elements that contain only an IPv4 address cannot be used, and cause an error
message indicating the rule is invalid. Make sure that all elements used in the Source and
Destination field of the IPv6 Access Rules contain an IPv6 address.
Troubleshooting Rules 903

C HAPT ER 71
TROUBLESHOOTING REPORTING
This section concentrates on common problems you may encounter when generating reports
from raw statistical and log data stored on the Log Server.
Troubleshooting Reporting (page 906)

No Report is Generated at All (page 906)
Empty Report Sections or Incomplete Data (page 907)
905
Troubleshooting Reporting
Error messages for reports are shown in the Comment column of the Stored Reports view.
Check the status of the report task there before you proceed with the troubleshooting.
• No Report is Generated at All (page 906)
• Empty Report Sections or Incomplete Data (page 907)
No Report is Generated at All

Problem description: you try to run a report but no report is generated. There may be an error
message displayed.
Solution:
• If the report seems to generate, but you cannot find it in the Stored Reports view, you may
have inadvertently created the report without selecting the Stored option. Try creating the
report again and make sure you have selected all the outputs you want to produce.
• If the report generation does not begin, and there is no error indicated, you may have
accidentally defined an end time that is in the future (remember the delay in the Start Earliest
field). Check the start time indicated for the report task. The time is interpreted according to
the clock of the computer you are using to run the Management Client; make sure the time
and timezone settings are correct.
• If the “out of memory” error appears, check if you have placed one or more IP address-based
top rate items under progress sections in the Report Design:
• Generating reports with such a design consumes large amounts of memory, as you are
collecting full progress information for every IP address that appears in your logs over the
chosen period of time (the unnecessary data is discarded only after the top items are
selected at the completion of the report task).
• To reduce the memory load, use a Drill-down top rate design, which first finds the top IP
addresses and then gets the progress information on those.
• Memory consumption can also be reduced by restricting the amount of data included in
the report (for example, set a shorter time range).
• If the “unreachable server” error appears on the report task’s row after the date and time,
some Log Server defined in the system is not running or is not reachable from the
Management Server. If you have defined Log Server elements that do not currently represent
any physical, running Log Server, check the Exclude This Log Server from Statistics and
Reporting option in the properties of such Log Server elements.
Caution – Be very careful when excluding Log Servers from reporting. If you inadvertently
select this setting for a Log Server that is in use, there is no warning that the generated
reports are missing parts of the log data.
906 Chapter 71 Troubleshooting Reporting

Empty Report Sections or Incomplete Data
Problem description: your report generates, but does not contain all the data that you think it
should (there are empty sections or the data displayed seems incorrect).
Solution:
• If you get sections that say “No Data”, check that the log data that the section requires is in
the active log data directory of your Log Server(s) (archived logs are not included in reporting).
Open the Logs view, make sure only Active Log Data is selected for all Log Servers on the
Sources tab, select the same time period and filter that you used in the report, and click
Apply. The logs shown correspond to the log data available for generating the logs. Also take
note of the next point below.
• If you are only missing information on traffic volumes (for example, Traffic by Source IP) check
your Access rules. Traffic information is available only on connections that are handled by
rules for which you have decided to collect accounting information
• The collected accounting information is shown in the Logs view for log entries that have
“Connection Closed” as their Event (see the Details panel for those entries). Note that
connection closing may not be logged at all, depending on the logging options of your
Access rules.
• If accounting data has not been collected at all, traffic volumes are unknown and the
report sections on traffic volumes return “No Data”.
• If only some rules collect accounting data, only the traffic that matches those rules is
included in the report sections on traffic volumes.
• Alternatively, the report items listed under Counters can be used to generate reports on
traffic volumes. The data for these items comes from stored summaries of the statistical
data that you can view as live statistics in an Overview. This data is always stored and
includes information on all traffic.
• To start collecting information on traffic volumes from now on, see Defining Access Rule
Logging Options (page 528).
• If you are missing a large amount of data (all data from one or more Log Servers), check in
the properties of all Log Servers in use that the Exclude This Log Server from Statistics
and Reporting option is not selected. Log Servers with this option selected are completely
ignored in all reporting.
• The time range you enter is interpreted according to the clock and time zone setting of the
computer you are using to run the Management Client. If these are not correctly set in the
operating system, the report period may be different from what you intend.
Empty Report Sections or Incomplete Data 907

908 Chapter 71 Troubleshooting Reporting
C HAPT ER 72
TROUBLESHOOTING UPGRADES
This section concentrates on common problems you may encounter when upgrading the
StoneGate system components.
Upgrade Fails Because of Running Services (page 910)

“StoneGate will not be installed properly” (page 910)
909
Upgrade Fails Because of Running Services
Problem description: you cannot upgrade because the upgrade reports that some services are
still running.
Solution:
• Check the Services window in Windows and stop any StoneGate services that are still running
(Management Server, Log Server, or Web Portal Server).
• If all Services are stopped in the Windows Services window, but the upgrade still reports that
services are still running, set the services to Manual startup and reboot the computer.
“StoneGate will not be installed properly”

Problem description: you see a pop-up messge “StoneGate will not be installed properly”
during an installation or upgrade.
Reason: this message is shown if any anomaly is detected during the installation.
Solution:
To find the cause of the problem:
• Check the installation log in the installation directory for messages regarding the upgrade.
• If you are skipping versions, check the Release Notes for the version you are installing and
make sure the upgrade you attempted is possible. The Release Notes will also list any known
issues that may cause errors during the upgrade.
To solve problems indicated:
• Missing files are one of the most common errors. This can happen if you copy installation
source files manually. Check that you have copied all necessary installation source files and
folders an run the installation again. If you have not checked the integrity of the installation
files, compare the checksum of your local files to the correct checksum at the Stonesoft
website as instructed in Obtaining the SMC Installation Files (page 835).
• Start the component in question. The message is shown for many types of errors, and the
component may still be able to run without problems.
• If you are unable to get the component running, uninstall the existing installation and install
the component as a new installation. In the case of an upgrade, you can restore all elements,
licenses, certificate, etc. from a backup you have taken through the Management Client, the
command line script, or in the installation wizard when you did the upgrade. The backup taken
with the previous version is valid for restoration on the upgraded system (see the Release
Notes for any version-specific limitations or exceptions).
910 Chapter 72 Troubleshooting Upgrades

C HAPT ER 73
TROUBLESHOOTING VPNS
This section concentrates on some common problems you may encounter when creating and
managing VPNs.
Checking Automatic VPN Validation Results (page 912)

Reading VPN-related Logs (page 912)
VPN Certificate Issues (page 913)
Problems with Internal to External Gateway VPN (page 913)
Problems Connecting With a StoneGate VPN Client (page 914)
911
Checking Automatic VPN Validation Results
StoneGate has an automatic VPN validation that checks the settings you have selected are
compatible with each other.
 To check VPN issues

1. Right-click the VPN element that defines the topology and tunnels for the problematic VPN
and select Preview VPN or Edit VPN. The VPN editor opens in preview or edit mode.
2. Switch to the Issues tab in the secondary panel. If the Issues tab is not visible, select the
ViewIssues item in the menu.
3. If issues are displayed, read the descriptions and fix the problems that are pointed out.
Reading VPN-related Logs

The firewall logs contain information on IPsec VPN negotiations. This section helps you find the
relevant logs. For reference information on the most common VPN-related messages in the logs,
see IPsec VPN Log Messages (page 1005). To view logs of VPN traffic, see Monitoring VPNs
(page 753).
Log messages related to the VPN negotiations contain the value “IPsec” in the “Facility” field,
which is a good filtering criterion for viewing IPsec messages. The “IKE Cookie” and “IPsec SPI”
fields contain identifiers related to each particular VPN instance, which helps further in reading
and filtering the logs. The “Situation” and “Information Message” fields include the actual VPN-
related events (details of which are explained in the topic referred above). If possible, examine
logs from the devices at both ends of the VPN tunnel for more complete information.
Tip – Right-click a VPN log entry and select Search Related Events to see logs related to the same
VPN negotiation.
You can collect more detailed information by enabling the IPsec diagnostics. For VPN clients,
you should also enable authentication and DHCP relay diagnostics. See Enabling/Disabling
Firewall/VPN Diagnostics (page 193) for instructions.
Additionally, log messages generated by Access rules (which are not included if filtering
specifically for IPsec logs) may contain relevant information on the connections that the gateway
sees and if VPN traffic is directed correctly to VPN tunnels by the policy.
A normal VPN tunnel negotiation proceeds as follows:
1. The negotiations start when a connection matches a rule in the StoneGate Firewall Policy
that triggers the VPN negotiation (or a similar mechanism at the other end).
2. The gateway at the source end of the connection or the VPN client (the initiator, I) contacts
the gateway at the other end (the responder, R) to establish trust and exchange keys in
the IKE Phase 1 negotiations.
3. If Phase 1 negotiation succeeds, IKE Phase 2 negotiations begin. At this stage, the
gateways agree on further settings used for handling the connection.
4. If Phase 2 negotiations succeed, the VPN tunnel is ready and ESP or AH packet(s) (the
actual traffic) can be seen in the logs. New connections that are opened through the VPN
are logged using a VPN-specific log message “New Connection Through VPN”.
912 Chapter 73 Troubleshooting VPNs

VPN Certificate Issues
Your internal gateway always needs a certificate if VPN clients connect to it. In a gateway-to-
gateway VPN, certificates are required when the VPN Profile used includes a certificate-based
authentication method (RSS Signatures or DSS Signatures).
Certificate Acceptance
By default, the gateways only accept certificates signed by your Management Server. To accept
certificates from other sources, you must define the Certificate Authority (CA) that signed the
certificate as trusted. See Defining a VPN Certificate Authority (page 757). By default, all
Gateways and all VPNs accept any valid CA that you have configured in the system. You can
configure the trusted CAs at the Gateway level (Defining Trusted CAs for a Gateway (page 726)),
and at the VPN level (Defining Trusted CAs for a VPN (page 742)). A CA must be trusted on both
levels to be accepted as a trusted CA for a VPN.
Creating, Signing, Renewing, Transferring to Gateways
Internally signed certificates are created, uploaded to the engines, and renewed automatically if
automatic certificate management is selected in the properties of the internal Gateway element.
You can manually create certificate requests, import certificates, and sign certificate requests
in the VPN Configuration view under the Other ElementsCertificates branch of the tree. Any
certificate request you create is, by default, also immediately signed using the internal CA and
uploaded to the engine. To disable this action (for example, to sign the certificate using an
external CA), you must deactivate this option in the new certificate request you create.
To sign or upload a certificate, first display the certificates and then select the corresponding
item in the Tools menu above the panel that displays the certificates.
For detailed instructions, see Getting Started With VPN Certificates (page 756). For information
on troubleshooting VPN certificates, see Understanding Certificate-Related Problems
(page 868).
Problems with Internal to External Gateway VPN

StoneGate is IPsec compliant, and it can form a VPN with any other fully IPsec compliant device.
Lists of VPN solutions that have been found IPsec compatible in testing are published by the
VPN Consortium (www.vpnc.org) and ICSA labs (www.icsalabs.com).
Note – Make sure that you have successfully installed or refreshed the policy on all
affected firewall/VPN engines after you have made changes to any part of the VPN
configuration.
When creating a VPN with an external gateway:

• There are no settings that would always work with a device of a certain brand and model.
Most IPsec settings depend on user preference and there are many alternative settings that
you can use regardless of the type of gateway.
• Although the settings can in large part be selected based on preference, always take special
care to ensure that all VPN settings are exactly the same at both ends (for both gateways at
both ends: typically, four definitions in all).
VPN Certificate Issues 913

• Ensure that also matching networks and netmasks are defined at both ends. In StoneGate,
all networks you want to be accessible through the VPN must be placed in a Site element
attached to the correct Gateway element. The networks defined must be identical at the other
end.
• One commonly missed setting is the SA (Security Association) setting, which can be per net
or per host. Some gateways may not have an explicit setting for this. Find out the setting
used.
• For non-StoneGate devices, check for parameters that are explicitly set in StoneGate but not
on the other device (find out the default settings used).
• If the VPN works when the connection is initiated from one end, but not when initiated from
the other, even though the firewall’s policy has rules for both ways, the problem may be due to
overlapping, but mismatching lifetime or encryption domain (in StoneGate, the IP address
definitions in Site elements).
• Matching the settings of different devices may sometimes be difficult because of differences
in the user interfaces and terminology used. The Virtual Private Network Consortium tests the
interoperability of IPsec compliant devices using a certain profile. Various manufacturers
(including Stonesoft) have produced step-by-step instructions for setting up a VPN matching
this profile. See http://www.vpnc.org/InteropProfiles/. Consult these documents to see how
the same VPN is configured in various different devices.
Problems Connecting With a StoneGate VPN Client

If NAT is used and the configuration download succeeds, but the client cannot connect to the
VPN gateway after that:
• If NAT is done between the VPN client and the firewall, you must set the Contact Address for
interface(s) that are used as a VPN endpoint. The Contact Address tells the VPN Clients the
external NATed address they must contact. See Defining Contact IP Addresses (page 62).
After the changes, refresh the firewall policy and make sure the VPN clients download a new
configuration from the engine.
If NAT should be used to translate the VPN client address, but NAT is not done:
• Check the VPN properties and see if the “Enable NAT with this VPN” option is selected. NAT is
only done if the option is selected.
• Check that the NAT rules are correct. In most cases, NAT is performed using the NAT Pool
address range defined in the Firewall element’s properties (Advanced Settings tab) and the
same traffic should not match any of the NAT rules in the firewall’s policy (except in some
cases a rule that specifically defines that no NAT is performed on this traffic to prevent
subsequent NAT rules from matching).
For any general problems:
• Make sure the VPN Client version is up to date. Older clients may have known issues
preventing correct operation and may not support all features configured for the gateway.
• Check for any VPN-capable devices between the StoneGate gateway and the VPN client; these
may sometimes attempt to take part in the VPN negotiations.
• Check the firewall logs for clues. See Reading VPN-related Logs (page 912).
914 Chapter 73 Troubleshooting VPNs

A PPENDICES
In this section:
Command Line Tools - 917
Default Communication Ports - 933
Predefined Aliases - 943
Regular Expression Syntax - 947
SNMP Traps and MIBs - 961
Schema Updates for External LDAP Servers - 973
Log Fields - 975
Keyboard Shortcuts - 1019
Glossary - 1025
Index - 1055
915
916
APPENDIX A
COMMAND LINE TOOLS
This appendix describes the command line tools for StoneGate Management Center and the
engines.
Management Center Commands (page 918)

Engine Commands (page 926)
Server Pool Monitoring Agent Commands (page 931)
917
Management Center Commands
Most of the Management Server and Log Server commands are found in the <installation
directory>/bin/ directory. In Windows, the command line tools are *.bat script files. In
Linux, the files are *.sh scripts.
Note – Using the Management Client is the recommended configuration method, as most
of the same tasks can be done through it.
Commands that require parameters must be run through the command line (cmd.exe in
Windows). Commands that do not require parameters can alternatively be run through a
graphical user interface, and may be added as shortcuts during installation.
Table A.1 Management Center Command Line Tools
Command Description
Displays or exports logs from archive. This command is only
available on the Log Server. The operation checks privileges for
the supplied administrator account from the Management Server
to prevent unauthorized access to the logs.
Enclose details in double quotes if they contain spaces.
Host specifies the address of the Management Server. If the
parameter is not defined, the loopback address is used.
login defines the username for the account that is used for
this operation. If this parameter is not defined, the username
root is used.
pass defines the password for the user account.
sgArchiveExport format defines the file format for the output file. If this
[ host=<address> ] parameter is not defined, the XML format is used.
[ login=<login name> ]
i defines the source from which the logs will be exported. Can
pass=<password>
be a folder or a file. The processing recurses into subfolders.
[ format=CSV|XML ]
i=<input file> o defines the destination file where the logs will be exported. If
[ o=<output file> ] this parameter is not defined, the output is displayed on screen.
[ f=<filter file> ] f defines a file that contains the filtering criteria you want to use
[ e=<filter expression> ] for filtering the log data. You can export log filters individually in
[ -h | -help ] [ -v ] the Management Client through ToolsSave for Command Line
Tools in the filter’s right-click menu.
e allows you to type in a filter expression manually (using the
same syntax as exported filter files).
-h or -help displays information on using the script.
-v displays verbose output on the command execution.
Example (exports logs from one full day to a file using a filter):
sgArchiveExport login=admin pass=abc123
i=c:/stonesoft/stonegate/data/archive/firewall/
year2009/month12/day01/ f=c:/stonesoft/
stonegate/export/MyExportedFilter.flp
format=CSV o=MyExportedLogs.csv
918 Appendix A Command Line Tools

Table A.1 Management Center Command Line Tools (Continued)
Command Description
Creates a backup of Log Server configuration data. The backup
file is stored in the <installation directory>/backups/
directory.
sgBackupLogSrv
Twice the size of log database is required on the destination
drive. Otherwise, the operation fails.
Also see sgRestoreLogBackup.
Creates a complete backup of the Management Server (including

both the local configuration and the stored information in the
configuration database). The backup file is stored in the
<installation directory>/backups/ directory.
sgBackupMgtSrv
Twice the size of the Management Server database is required
on the destination drive. Otherwise, the operation fails.
Also see sgRestoreMgtBackup and
sgRecoverMgtDatabase.
Contacts the Management Server and creates a new certificate

for the Log Server to allow secure communications with other
system components. Renewing an existing certificate does not
require changing the configuration of any other system
sgCertifyLogSrv components.
[host=<management server address>
[/<domain>]]
Domain specifies the administrative Domain the Log Server
belongs to if the system is divided in administrative Domains. If
the Domain is not specified, the Shared Domain is used.
Creates a new certificate for the Management Server to allow

secure communications between the StoneGate system
sgCertifyMgtSrv
components. Renewing an existing certificate does not require
changes on any other system components.
Contacts the Management Server and creates a new certificate

for the Web Portal Server to allow secure communications with
other system components. Renewing an existing certificate does
not require changing the configuration of any other system
sgCertifyWebPortalSrv components.
[host=<management server address> Host specifies the address of the Management Server. If the
[/<domain>]] parameter is not defined, the loopback address is used.
Domain specifies the administrative Domain the Web Portal
Server belongs to if the system is divided in administrative
Domains. If the Domain is not specified, the Shared Domain is
used.
Changes the Management Server’s IP address in the Log

Server’s local configuration to the IP address you give as a
sgChangeMgtIPOnLogSrv <IP address> parameter. Use this command if you change the Management
Server’s IP address. Restart the Log Server service after this
command.
Management Center Commands 919

Command Description
Changes the Management Server’s IP address in the local
configuration to the IP address you give as a parameter. Use this
sgChangeMgtIPOnMgtSrv <IP address>
command if you change the Management Server’s IP address.
Restart the Management Server service after this command.
sgClient Starts a locally installed StoneGate Management Client.
Creates an unrestricted (superuser) administrator account. The

sgCreateAdmin Management Server needs to be stopped before running this
command.
Exports elements stored on the Management Server to an XML

file.
Enclose details in double quotes if they contain spaces.
Domain specifies the administrative Domain for this operation if
sgExport the system is divided in administrative Domains. If the Domain is
[host=<management server address> not specified, the Shared Domain is used.
[/<domain>]]
pass=<password>
root is used.
file=<file path and name>
type= <all|nw|ips|sv|rb|al> pass defines the password for the user account.
[-recursion] type specifies which types of elements are included in the
[-system] export file: all for all exportable elements, nw for network
[name= <element name 1, element name 2, elements, ips for IPS elements, sv for services, rb for security
...>] policies, or al for alerts.
recursion includes referenced elements in the export, for
example, the network elements used in a policy that you export.
system includes any system elements that are referenced by
the other elements in the export.
name allows you to specify by name the element(s) that you want
to export.

Command Description
Controls highly available (active and standby) Management
Servers.
the system is divided in administrative Domains. If the Domain is
not specified, the Shared Domain is used.
root is used.
sgHA [host=<management server address> -h or -help displays information on using the script.
[/<domain>]] -set-active sets a standby Management Server as the active
[ login=<login name> ] Management Server, sets the formerly active Management
pass=<password> Server as a standby Management Server, and synchronizes the
[-h|-help] database between them.
[-set-active]
-set-standby sets the active Management Server as a
[-set-standby]
standby Management Server.
[-force-active]
[-sync] -force-active sets a standby Management Server as the
active Management Server without synchronizing the database
with the formerly active Management Server.
-sync functions differently on a standby Management Server
and an active Management Server. If you run it on an active
Management Server, it replicates the active database to every
standby Management Server that does not have the Disable
Database Replication option selected in its properties. If you
run it on a standby Management Server, it replicates the active
database from the active Management Server only to this
standby Management Server (regardless of whether the Disable
Database Replication option is selected in the standby
Management Server’s properties).
Imports StoneGate Management Server database elements from

a StoneGate XML file. When importing, existing (non-default)
elements are overwritten if both the name and type match.
sgImport parameter is not defined, the loopback address is used.
[host=<management server address> Domain specifies the administrative Domain for this operation if
[/<domain>]] the system is divided in administrative Domains. If the Domain is
[ login=<login name> ] not specified, the Shared Domain is used.
pass=<password>
file=<file path and name>
root is used.
file defines the file whose contents you want to import.

Command Description
Imports and exports a list of Users and User Groups in an LDIF
file from/to a StoneGate Management Server’s internal LDAP
database. To import User Groups, all User Groups in the LDIF file
must be directly under the stonegate top-level group
(dc=stonegate).
The user information in the export file is stored as plaintext.
Handle the file securely.
sgImportExportUser Host specifies the address of the Management Server. If the
[host=<management server address> parameter is not defined, the loopback address is used.
[/<domain>]] Domain specifies the administrative Domain for this operation if
[ login=<login name> ] the system is divided in administrative Domains. If the Domain is
pass=<password> not specified, the Shared Domain is used.
action=[import|export] login defines the username for the account that is used for
file=<file path and name> this operation. If this parameter is not defined, the username
root is used.
action defines whether users are imported or exported.
file defines the file that is used for the operation.
Example: sgImportExportUser login=admin
pass=abc123 action=export
file=c:\temp\exportedusers.ldif
Imports an additional language to the Web Portal end-user

interface. You can run the command when the Web Portal Server
service is running, but the imported language does not become
available until the service is restarted.
the system is divided in administrative Domains. If the Domain is
not specified, the Shared Domain is used.
sgImportWebClientLanguage
[host=<management server address>
[/<domain>]]
root is used.
pass=<password> pass defines the password for the user account.
file=<file path and name> file defines the file that is used for the operation. The
imported file must use the UTF-8 or UTF-16 text encoding. The
file name must follow the format
messages_XX[_YY[_ZZ]].txt where XX is the two-character
ISO language code, YY the ISO country code and ZZ the ISO
language variant code. The country code and language variant
code are optional.
Example: sgImportWebClientLanguage
host=192.168.1.101/Helsinki login=ricky
pass=abc123 file=messages_sv_fi.txt

Command Description
Creates a ZIP file that contains copies of configuration files and
the system trace files. The resulting ZIP file is stored in the
sgInfo logged in user’s home directory. The file location is displayed on
the last line of screen output. Provide the generated file to
Stonesoft support for troubleshooting purposes.
Located in <installation directory>/bin/install. Creates a

sgReinitializeLogServer new Log Server configuration if the configuration file has been
lost.
Restores a Management Server backup from one Management

Server on another Management Server.
-h | --help options display the help message
backup BACKUPNAME option specifies the location of the
sgReplicate [-h|--help]
backup file. If this is not specified, you are prompted to select
[-nodiskcheck]
the backup file from a list of files found in the backups
[backup BACKUPNAME]
directory.
standby-server
MANAGEMENT_SERVER_NAME -nodiskcheck option disables the free disk space check
before the backup restoration.
standby-server MANAGEMENT_SERVER_NAME option
specifies the name of the Management Server on which you are
running the script.
Restores logs from archive files to the Log Server. This command
is available only on the Log Server.
ARCHIVE_DIR is the number of the archive directory (0 – 31)
sgRestoreArchive ARCHIVE_DIR from where the logs will be restored. By default, only archive
directory 0 is defined. The archive directories can be defined in
the <installation directory>/data/
LogServerConfiguration.txt file:
ARCHIVE_DIR_xx=PATH.
Restores the Certificate Authority (CA) or the Management

sgRestoreCertificate Server certificate from a backup file in the <installation
directory>/backups/ directory.
Restores the Log Server (logs and/or configuration files) from a

sgRestoreLogBackup backup file in the <installation directory>/backups/
directory.
Restores the Management Server (database and/or

sgRestoreMgtBackup configuration files) from a backup file in the <installation
directory>/backups/ directory.
Note! This script is located in the <installation

directory>/uninstall/ directory.
sgRevert Reverts to the previous installation saved during the upgrade
process. The previous installation can be restored at any time,
even after a successful upgrade.

Command Description
Displays the CA certificate’s fingerprint on the Management
sgShowFingerPrint
Server.
Starts the Log Server’s database. (The Log Server’s database is

sgStartLogDatabase started and stopped automatically when starting/stopping the
Log Server service.)
sgStartLogSrv Starts the Log Server and its database.
Starts the Management Server’s database. There is usually no

sgStartMgtDatabase
need to use this script.
sgStartMgtSrv Starts the Management Server and its database.
sgStartWebPortalSrv Starts the Web Portal Server.
sgStopLogSrv Stops the Log Server.
sgStopMgtSrv Stops the Management Server and its database.
Stops the Management Server’s database. There is usually no

sgStopMgtDatabase
need to use this script.
sgStopWebPortalSrv Stops the Web Portal Server.
Stops the Management Server service when run without

arguments. To stop a remote Management Server service,
provide the arguments to connect to the Management Server.
sgStopRemoteMgtSrv [host HOST] HOST is the Management Server’s host name if not localhost.
[port PORTNUM] [login LOGINNAME]
PORT is the Management Server’s Management Client port
[pass PASSWORD]
number (by default, 8902).
LOGINNAME is a StoneGate administrator account for the login.
PASSWORD is the password for the administrator account.

Command Description
Displays or exports current or stored logs. This command is
available on the Log Server.
Enclose the file and filter names in double quotes if they contain
spaces.
The pass parameter defines the password for the user account
used for this operation.
The e parameter defines the filter that you want to use for
filtering the log data. Type the name as shown in the
Management Client. The f parameter defines the StoneGate
exported filter file that you want to use for filtering the log data.
sgTextBrowser pass=PASSWORD The format parameter defines the file format for the output file.
[ e=FILTER_EXPRESSION ] If this parameter is not defined, the XML format is used.
[ f=FILTER_FILE ] The host parameter defines the address of the Management
[ format=CSV|XML ] Server used for checking the login information. If this parameter
[host=Management Server address is not defined, Management Server is expected to be on the
[/domain]] same host where the script is run. If Domains are in use, you
[login=LOGIN_NAME ] can specify the Domain the Log Server belongs to. If domain is
[ o=OUTPUT_FILE ] not specified, the Shared Domain is used.
[ m=current|stored ] The login parameter defines the username for the account that
[ -v ] [ -h ] is used for this export. If this parameter is not defined, the
username root is used.
The o parameter defines the destination output file where the
logs will be exported. If this parameter is not defined, the output
is displayed on screen.
The m parameter defines whether you want to view or export logs
as they arrive on the Log Server (current) or logs stored in the
active storage directory (stored). If this option is not defined, the
current logs are used.
The -h option displays information on using the script.
The -v option displays verbose output on command execution.

Engine Commands
The commands in the following two tables can be run on the command line on the analyzer,
firewall, and/or sensor engines. SOHO firewalls do not provide a command line interface.
Table A.2 StoneGate-Specific Command Line Tools on Engines
Engine
Command Description
Type
Can be used to view, add, or delete active blacklist entries.
The blacklist is applied as defined in Access Rules.
Commands:
show displays the current active blacklist entries in format:
engine node ID | blacklist entry ID | (internal) | entry creation
time | (internal) | address and port match | originally set
duration | (internal) | (internal). Use the -f option to specify a
storage file to view (/data/blacklist/db_<number>).
sg-blacklist The -v option adds operation’s details to the output.
show [-v] [-f FILENAME] | add creates a new blacklist entry. Enter the parameters (see
add [ below) or use the -i option to import parameters from a file.
[-i FILENAME] | del deletes the first matching blacklist entry. Enter the
[src IP_ADDRESS/MASK] parameters (see below) or use the -i option to import
[dst IP_ADDRESS/MASK] parameters from a file.
[proto {tcp|udp|icmp|NUM}] iddel NODE_ID ID removes one specific blacklist entry on
one specific engine. NODE_ID is the engine’s ID, ID is the
[srcport PORT{-PORT}]
blacklist entry’s ID (as shown by the show command).
[dstport PORT{-PORT}]
flush deletes all blacklist entries.
[duration NUM]
Add/Del Parameters:
]| firewall, Enter at least one parameter. The default value is used for the
del [ sensor parameters that you omit. You can also save parameters in a
[-i FILENAME] | text file; each line in the file is read as one blacklist entry.
[src IP_ADDRESS/MASK] src IP_ADDRESS/MASK defines the source IP address and
[dst IP_ADDRESS/MASK] netmask to match. Matches any IP address by default.
[proto {tcp|udp|icmp|NUM}] dst IP_ADDRESS/MASK defines the destination IP address
[srcport PORT{-PORT}] and netmask to match. Matches any IP address by default.
[dstport PORT{-PORT}] proto {tcp|udp|icmp|NUM} defines the protocol to match
by name or protocol number. Matches all IP traffic by default.
[duration NUM]
srcport PORT[-PORT] defines the TCP/UDP source port or
]|
range to match. Matches any port by default.
iddel NODE_ID ID |
dstport PORT[-PORT] defines the TCP/UDP destination
flush port or range to match. Matches any port by default.
duration NUM defines in seconds how long the entry is kept.
Default is 0, which cuts current connections, but is not kept.
Examples:
sg-blacklist add src 192.168.0.2/32 proto tcp
dstport 80 duration 60
sg-blacklist add -i myblacklist.txt
sg-blacklist del dst 192.168.1.0/24 proto 47

Table A.2 StoneGate-Specific Command Line Tools on Engines (Continued)
Engine
Command Description
Type
Can be used to edit boot command parameters for future
bootups.
--primary-console=tty0|ttyS PORT,SPEED
parameter defines the terminal settings for the primary
sg-bootconfig console.
[--primary- --secondary-console= [tty0|ttyS PORT,SPEED]
console=tty0|ttyS parameter defines the terminal settings for the secondary
PORT,SPEED] console.
[--secondary-console= --flavor=up|smp [-kdb] parameter defines whether the
[tty0|ttyS PORT,SPEED]] analyzer, kernel is uniprocessor or multiprocessor.
[--flavor=up|smp] firewall,
--initrd=yes|no parameter defines whether Ramdisk is
sensor
[--initrd=yes|no] enabled or disabled.
[--crashdump=yes|no|Y@X] --crashdump=yes|no|Y@X parameter defines whether
[--append=kernel options] kernel crashdump is enabled or disabled, and how much
[--help] memory is allocated to the crash dump kernel (Y). The default
is 24M. X must always be 16M.
apply
--append=kernel options parameter defines any other
boot options to add to the configuration.
--help parameter displays usage information.
apply command applies the specified configuration options.
Use this only if you want to return a StoneGate appliance to

analyzer, its factory settings.
sg-clear-all firewall,
Clears all configuration from the engine. You must have a local
sensor
console connection to the engine to use this command.
Used to display or change the status of the node.

status [-c SECONDS] command displays cluster status.
sg-cluster When -c SECONDS is used, status is shown continuously with
the specified number of seconds between updates.
[status [-c SECONDS]]
online command sends the node online.
[online]
lock-online command sends the node online and keeps it
[lock-online]
firewall online even if another process tries to change its state.
[offline]
offline command sends the node offline.
[lock-offline]
lock-offline command sends the node offline and keeps
[standby] it offline even if another process tries to change its state.
[safe-offline] standby command sets an active node to standby.
safe-offline command sets the node to offline only if
there is another online node.
Used for establishing a trust relationship with the

analyzer, Management Server as part of engine installation or
sg-contact-mgmt firewall, reconfiguration (see sg-reconfigure below). The engine
sensor contacts the Management Server using the one-time password
created when the engine’s initial configuration is saved.
Engine Commands 927

Engine
Command Description
Type
Deletes VPN-related information (use vpninfo command to
view the information). Option -d (for delete) is mandatory.
-u deletes the VPN session of the named VPN client user. You
can enter the user account in the form <username@domain> if
there are several user storage locations (LDAP domains).
sg-ipsec -d
-si deletes the VPN session of a VPN client user based on
[-u <username[@domain]> | session identifier.
-si <session id> |
-ck deletes the IKE SA (Phase one security association)
-ck <ike cookie> | firewall
based on IKE cookie.
-tri <transform id>
-ri <remote ip> | -tri deletes the IPSEC SAs (Phase two security associations)
-ci <connection id>] for both communication directions based on transform
identifier.
-ri deletes all SAs related to a remote IP address in gateway-
to-gateway VPNs.
-ci deletes all SAs related to a connection identifier in
gateway-to-gateway VPNs.
Can be used in scripts to create log messages with the

specified properties.
sg-logger -f FACILITY_NUMBER parameter defines the facility for the
log message.
-f FACILITY_NUMBER
-t TYPE_NUMBER parameter defines the type for the log
-t TYPE_NUMBER analyzer, message.
[-e EVENT_NUMBER] firewall,
-e EVENT_NUMBER parameter defines the log event for the
[-i "INFO_STRING"] sensor
log message. The default is 0 (H2A_LOG_EVENT_UNDEFINED).
[-s] -i "INFO_STRING" parameter defines the information
[-h] string for the log message.
-s parameter dumps information on option numbers to stdout
-h parameter displays usage information.
Configures a new hard drive. This command is only for

StoneGate appliances that support RAID (Redundant Array of
Independent Disks) and have two hard drives.
-status option displays the status of the hard drive.
-add options adds a new empty hard drive.
sg-raid analyzer,
Use -add -force if you want to add a hard drive that already
[-status] [-add] [-re-add] firewall,
contains data and you want to overwrite it.
[-force] [-help] sensor
-re-add adds a hard drive that is already partitioned. This
command prompts for the drive and partition for each
degraded array.
Use -re-add -force if you want to check all the arrays.
-help option option displays usage information.

Engine
Command Description
Type
Used for reconfiguring the node manually.
--boot option applies bootup behavior. Do not use this option
sg-reconfigure unless you have a specific need to do so.
analyzer,
[--boot] --maybe-contact option contacts the Management Server
firewall,
[--maybe-contact] if requested. This option is only available on firewall engines.
sensor
[--no-shutdown] --no-shutdown option allows you to make limited
configuration changes on the node without shutting it down.
Some changes may not be applied until the node is rebooted.
Runs cryptography tests on the engine.

sg-selftest [-d] [-h] firewall -d option runs the tests in debug mode.
-h option displays usage information.
analyzer, Displays information on the engine’s status.

sg-status [-l] [-h] firewall, -l option displays all available information on engine status.
sensor -h option displays usage information.
Switches the engine between the active and the inactive

partition. This change takes effect when you reboot the
engine.
You can use this command, for example, if you have upgraded
an engine and want to switch back to the earlier engine
version. When you upgrade the engine, the active partition is
switched. The earlier configuration remains on the inactive
partition. To see the currently active (and inactive) partition,
analyzer, see the directory listing of /var/run/stonegate (ls-l /
sg-toggle-active SHA1 SIZE |
firewall, var/run/stonegate.
--force [--debug] sensor
The SHA1 SIZE option is used to verify the signature of the
inactive partition before changing it to active. If you downgrade
the engine, check the checksum and the size of the earlier
upgrade package by extracting the signature and size files
from the sg_engine_[version.build]_i386.zip file.
--debug option reboots the engine with the debug kernel.
--force option switches the active configuration without first
verifying the signature of the inactive partition.
Upgrades the node by rebooting from the installation CD-ROM.

sg-upgrade firewall Alternatively, the node can be upgraded remotely using the
Management Client.
analyzer,
sg-version firewall, Displays the software version and build number for the node.
sensor
Engine Commands 929

Engine
Command Description
Type
Gathers system information you can send to Stonesoft
support if you are having problems. Use this command only
when instructed to do so by Stonesoft support.
-f option forces sgInfo even if the configuration is encrypted.
analyzer, -d option includes core dumps in the sgInfo file.
sginfo
firewall, -s option includes slapcat output in the sgInfo file.
[-f] [-d] [-s] [-p] [--] [--help] sensor -p option includes passwords in the sgInfo file (by default
passwords are erased from the output).
-- option creates the sgInfo file without displaying the
progress
--help option displays usage information.
The table below lists some general operating system commands that may be useful in running
your StoneGate engines. Some commands can be stopped by pressing Ctrl+c.
Table A.3 General Command Line Tools on Engines
Command Description
dmesg Shows system logs and other information. Use the -h option to see usage.
halt Shuts down the system.
Displays IP address information. Type the command without options to see usage.
ip
Example: type ip addr for basic information on all interfaces.
Tests connectivity with ICMP echo requests. Type the command without options to
ping
see usage.
ps Reports the status of running processes.
reboot Reboots the system.
scp Secure copy. Type the command without options to see usage.
sftp Secure FTP. Type the command without options to see usage.
SSH client (for opening a terminal connection to other hosts). Type the command
ssh
without options to see usage.
tcpdump Gives information on network traffic. Use the -h option to see usage.
Displays the top CPU processes taking most processor time. Use the -h option to
top
see usage.
Traces the route packets take to the specified destination. Type the command without
traceroute
options to see usage.
Displays VPN information and allows you to issue some basic commands. Type the
vpninfo
command without options to see usage.

Server Pool Monitoring Agent Commands
You can test and monitor the Server Pool Monitoring Agents on the command line with the
commands described in the table below.
Table A.4 Server Pool Monitoring Agent Commands
Command Description
Allows you to test different configurations before activating them.
-d Don’t Fork as a daemon. All log messages are printed to stdout
or stderr only.
-v level Set the verbosity level. The default level is 5. Levels 6-8
are for debugging where available.
-c path Use the specified path as the first search directory for the
sgagentd [-d] configuration.
[-v level] test [files]
[-c path] Run in the test mode - status queries do not receive a response. If
[test [files]] you specify the files, they are used for reading the configuration
instead of the default files. The output is directed to syslog or
[syntax [files]]
eventlog instead of the console where the command was run unless
you use the -d option.
syntax [files]
Check the syntax in the configuration file. If no files are specified,
the default configuration files are checked. The output is directed to
syslog or eventlog instead of the console where the command was
run unless you use the -d option.
Server Pool Monitoring Agent Commands 931

Table A.4 Server Pool Monitoring Agent Commands (Continued)
Command Description
Sends a UDP query to the specified host and waits for a response
until received, or until the timeout limit is reached.
The request type can be defined as a parameter. If no parameter is
given, status is requested. The commands are:
status - query the status.
info - query the agent version.
proto - query the highest supported protocol version.
-p port Connect to the specified port instead of the default port.
sgmon -t timeout Set the timeout (in seconds) to wait for a response.
[status|info|proto] -a id Acknowledge the received log messages up to the specified
[-p port] id. Each response message has an id, and you may acknowledge
[-t timeout] more than one message at a given time by using the id parameter.
[-a id] Note that messages acknowledged by sgmon will no longer appear
host in the firewall logs.
host
The IP address of the host to connect to. To get the status locally,
you may give localhost as the host argument. This parameter is
mandatory.
Return value:
0 if the response was received
1 if the query timed out
-1 in case of an error

APPENDIX B
DEFAULT COMMUNICATION PORTS
This chapter lists the default ports used in connections between StoneGate components and
the default ports StoneGate uses with external components.
Management Center Ports (page 934)

Firewall/VPN Engine Ports (page 936)
IPS Engine Ports (page 940)
933
Management Center Ports
The illustrations below present an overview to the most important default ports used in
communications between the Management Center (SMC) components and from the SMC to
external services. See Table B.1 for a complete list of default ports.
Illustration B.1 Destination Ports for Basic Communications Within SMC

Management Client
Log Server Management Server

TCP: TCP:
8914-8918 8902-8913
+ 3021 (Log
Server
Certificate
Request)
Illustration B.2 Default Destination Ports for Optional SMC Components and Features
External LDAP Server
Stonesoft’s Update Service TCP: External RADIUS Server

389
Log TCP: UDP:

Server Management
443 Server 1812
Web Portal Secondary
Server Management Server
TCP:
3020 TCP: TCP:
8916 8902-8913 8903 TCP:
8917 8916 8907 8902-8913
8917
TCP, UDP: Monitored
+ 3021
Third Party
162/5162 (Certificate
Components
514/5514 Request)
Win/Linux)
UDP:
161
934 Appendix B Default Communication Ports

The table below lists all default ports SMC uses internally and with external components. Many
of these ports can be changed. The name of corresponding default Service elements are also
included for your reference. For information on communications between SMC components and
the engines, see the separate listings.
Table B.1 Management Center Default Ports
Listening Port/ Contacting Service Element

Service Description
Host Protocol Hosts Name
Management
53/UDP, Client,
DNS server DNS queries. DNS (UDP)
53 TCP Management
Server, Log Server
Management External LDAP queries for display/

LDAP server 389/TCP LDAP (TCP)
Server editing in the Management Client.
SNMPv1 trap reception from third

162/UDP, Monitored third party components. Port 162 is used
Log Server SNMP (UDP)
5162/UDP party components if installed on Windows, port 5162 if
installed on Linux.
514/TCP, Syslog reception from third party

514/UDP, Monitored third components. Port 514 is used if Syslog (UDP)
Log Server
5514/TCP, party components installed on Windows, port 5514 if [Partial match]
5514/UDP installed on Linux.
Log Server,
Log Server 3020/TCP Alert sending. SG Log
Web Portal Server
8914- Management
Log Server Log browsing. SG Data Browsing
8918/TCP Client
8916- SG Data Browsing

Log Server Web Portal Server Log browsing.
8917/TCP (Web Portal Server)
Management Log Server, Web System communications certificate SG Log Initial

3021/TCP
Server Portal Server request/renewal. Contact
Management
Management 8902-
Client, Log Server, Monitoring and control connections. SG Control
Server 8913/TCP
Web Portal Server
Monitored
SNMP status probing to external IP
Third Party 161/UDP Log Server SNMP (UDP)
addresses.
Components
Primary Secondary
8903, Database replication (pull) to the
Management Management SG Control
8907/TCP secondary Management Server.
Server Servers
Management Center Ports 935

Table B.1 Management Center Default Ports (Continued)
Listening Port/ Contacting Service Element

Service Description
Host Protocol Hosts Name
RADIUS authentication requests for
administrator logins. The default
RADIUS Management RADIUS
1812/UDP ports can be modified in the
server Server (Authentication)
properties of the RADIUS Server
element.
Secondary Primary
8902- Database replication (push) to the
Management Management SG Control
8913/TCP secondary Management Server.
Servers Server
Update packages, engine upgrades,

Stonesoft Management and licenses from
443/TCP HTTPS
servers Server update.stonesoft.com and
smc.stonesoft.com.
Log data export to syslog servers.

514/UDP, , Syslog (UDP)
Syslog Server Log Server The default ports can be modified in
5514/UDP [Partial match]
the LogServerConfiguration.txt file.
Firewall/VPN Engine Ports

The illustrations below present an overview to the most important default ports used in
communications between firewall/VPN engines and the SMC and between clustered firewall
engines. See Table B.2 for a complete list of default ports for the fully-featured firewall/VPN
engines and Table B.3 for a list of default ports for SOHO Firewalls.
Illustration B.3 Destination Ports for Basic Firewall/VPN Engine Communications

Log Server Firewall Other Node(s) in the Cluster
TCP: TCP: TCP:

636 3002
3020
4950 3003
Management Server 4987 3010
8888 UDP: Multicast
TCP: Or none* (Heartbeat
3021 3000
3001 interfaces)
3023
8906* *Single Firewalls with “node-
initiated contact” selected.

Illustration B.4 Destination Ports for Basic SOHO Firewall Engine Communications
SOHO Firewall
NTP Time Server Log Server

UDP: TCP:
123 Manage- 8923
ment Server
TCP:
8922
8924
Illustration B.5 Default Destination Ports for Firewall/VPN Engine Service Communications
LDAP Server RADIUS Server
TACACS+
DNS Server
TCP: UDP: Server
TCP, UDP: 389 1812 TCP:
53 636 1645 49
Server Pool RPC Server
UDP: TCP, UDP:

7777 111
DHCP Server SNMP Server
UDP: Firewall UDP:

UDP: 68 161 UDP:
67 162
UDP: UDP:
500 500
4500 2746
VPN Clients 4500 VPN Gateways
UDP:
500
2746
4500
Firewall/VPN Engine Ports 937

The table below lists all default ports StoneGate Firewall/VPN uses internally and with external
components. Many of these ports can be changed. The name of corresponding default Service
elements are also included for your reference.
Table B.2 Firewall/VPN Default Ports
Listening Contacting Service Element

Port/Protocol Service Description
Host Hosts Name
Anti-virus
signature 80/TCP Firewall Anti-virus signature update service. HTTP
server
BrightCloud BrightCloud web filtering update BrightCloud

2316/TCP Firewall
Server service. update
Relayed DHCP requests and requests

DHCP server 67/UDP Firewall from a firewall that uses dynamic IP BOOTPS (UDP)
address.
53/UDP,
DNS server Firewall Dynamic DNS updates. DNS (TCP)
53/TCP
Firewall 67/UDP Any DHCP relay on firewall engine. BOOTPS (UDP)
Firewall 68/UDP DHCP server Replies to DHCP requests. BOOTPC (UDP)
Firewall 161/UDP SNMP server SNMP monitoring. SNMP (UDP)
VPN clients,
Firewall 500/UDP VPN negotiations, VPN traffic. ISAKMP (UDP)
VPN gateways
Management
Firewall 636/TCP Internal user database replication. LDAPS (TCP)
Server
User authentication (Telnet) for SG User

Firewall 2543/TCP Any
Access rules. Authentication
StoneGate SG UDP
Firewall 2746/UDP UDP encapsulated VPN traffic.
VPN gateways Encapsulation
SG State Sync
3000-3001/
(Multicast), SG
UDP FW/VPN Heartbeat and state synchronization
Firewall State Sync
3002-3003, engine between clustered firewalls.
(Unicast), SG Data
3010/TCP
Sync
VPN client,
Firewall 4500/UDP VPN traffic using NAT-traversal. NAT-T
VPN gateways
Management SG Remote
Firewall 4950/TCP Remote upgrade.
Server Upgrade
Management Management Server commands and

Firewall 4987/TCP SG Commands
Server policy upload.

Table B.2 Firewall/VPN Default Ports (Continued)

Host Hosts Name
Connectivity monitoring; monitoring of
Management
Firewall 8888/TCP blacklists, connections, and status SG Monitoring
Server
for old engine versions.
Management
Firewall 15000/TCP Server, Blacklist entries. SG Blacklisting
analyzer
External LDAP queries, including

LDAP server 389/TCP Firewall LDAP (TCP)
StartTLS connections.
Log and alert messages; monitoring

Log Server 3020/TCP Firewall of blacklists, connections, status, SG Log
and statistics.
Management System communications certificate

3021/TCP Firewall SG Initial Contact
Server request/renewal (initial contact).
Management SG Reverse
3023/TCP Firewall Monitoring (status) connection.
Server Monitoring
Management connection for Single

Management SG Dynamic
8906/TCP Firewall Firewalls with “node-initiated contact”
Server Control
selected.
RADIUS
RADIUS 1812, 1645/
Firewall RADIUS authentication requests. (Authentication),
server UDP
RADIUS (Old)
111/UDP, 111/ SUNRPC (UDP),

RPC server Firewall RPC number resolve.
TCP Sun RPC (TCP)
Server Pool Polls to the servers’ Server Pool

SG Server Pool
Monitoring 7777/UDP Firewall Monitoring Agents for availability and
Monitoring
Agents load information.
SNMP server 162/UDP Firewall SNMP traps from the engine. SNMP Trap (UDP)
TACACS+
49/TCP Firewall TACACS+ authentication requests. TACACS (TCP)
server
500/UDP,
2746/UDP VPN traffic. Ports 2746 and 4500
VPN gateways (StoneGate Firewall may be used depending on ISAKMP (UDP)
gateways only), encapsulation options.
or 4500 UDP.
Firewall/VPN Engine Ports 939

Table B.3 SOHO Firewall Default Ports

Host Hosts Name
SOHO Firewall
500/UDP VPN gateway Internet Key Exchange (IKE) for IPsec. ISAKMP (UDP)
engine
Configuration and status

Management
8922/TCP SOHO Firewall communication to the Management SG SOHO Control
Server
Server.
Management System communications certificate SG SOHO Initial

8924/TCP SOHO Firewall
Server request/renewal (initial contact). Contact
NTP server 123/UDP SOHO Firewall Time synchronization. NTP (UDP)
RADIUS RADIUS
1812/UDP SOHO Firewall RADIUS authentication requests.
server (Authentication)
IPS Engine Ports

The illustration below presents an overview to the most important default ports used in
communications between IPS engines and the SMC and between clustered sensor engines. See
Table B.4 for a complete list of default ports.
Illustration B.6 Default Destination Ports for Basic IPS System Communications
Log Server
TCP:
3020 Other Node(s) in
TCP: Sensor the Cluster
18890
TCP: TCP:
Analyzer 4950 3002
Management 18889 3003
TCP: 3010
Server
4950
18888 UDP:
TCP: 3000
3021
3023

The table below lists all default ports StoneGate IPS uses internally and with external
components. Many of these ports can be changed. The name of corresponding default Service
elements are also included for your reference.
Table B.4 IPS-Specific Ports

Hosts Hosts Name
Syslog messages forwarded to
Analyzer 514/UDP Syslog server Syslog (UDP)
Analyzer.
Management SG Remote-
Analyzer 4950/TCP Remote upgrade.
Server Upgrade
Management SG Commands
Analyzer 18889 Management connection.
Server (Analyzer)
Analyzer 18890/TCP Sensor Event data sent from the Sensors. SG Event Transfer
BrightCloud BrightCloud web filtering update BrightCloud

2316/TCP Sensor
Server service. update
Log and alert messages from

Analyzers; recording file transfers
Analyzer,
Log Server 3020/TCP from Sensors; and monitoring of SG Log
Sensor
blacklists, status, and statistics from
Sensors.
Management Sensor, System communications certificate

3021/TCP SG Initial Contact
Server analyzer request/renewal (initial contact).
Management Sensor, Backup monitoring (status) SG Reverse

3023/TCP
Server analyzer connection. Monitoring
SG State Sync
3000-3001/
(Multicast), SG
UDP
Sensor Sensor Heartbeat between the cluster nodes. State Sync
3002,3003,
(Unicast), SG Data
3010/TCP
Sync
Management SG Remote
Sensor 4950/TCP Remote upgrade.
Server Upgrade
Management SG Commands
Sensor 18888/TCP Management connection.
Server (Sensor)
Management
Sensor, Server,
15000/TCP Blacklist entries. SG Blacklisting
firewall analyzer,
sensor
IPS Engine Ports 941

APPENDIX C
PREDEFINED ALIASES
This appendix lists the predefined Aliases that exist in the system. The predefined Aliases are
used in the Firewall’s default system policies. Some of them may be useful when you create
your own Firewall and IPS rules.
Pre-Defined User Aliases (page 944)

System Aliases (page 944)
943
Pre-Defined User Aliases
User Aliases are usually created by administrators, but there are also some pre-defined user
aliases in the system. User Aliases are preceded with one $ character. Table C.1 lists all the
editable user Aliases automatically created by StoneGate Management Center. These Aliases
are used in the firewalls’ default DHCP Relay Sub-Policy.
Table C.1 System-defined User Aliases
Pre-Defined User Alias Description

$ DHCP address pools Addresses that can be allocated by DHCP server(s).
$ DHCP address pools for

Address pools for assigning virtual IP addresses to VPN clients.
IPsec VPN Clients
$ DHCP servers All DHCP servers defined for the firewall.
$ DHCP servers for IPsec The DHCP servers defined for assigning virtual IP addresses to VPN
VPN Clients clients.
System Aliases
System Aliases are non-editable Aliases created by StoneGate. The System Aliases are
preceded with two $$ characters. Table C.2 lists the definitions of all the System Aliases. These
Aliases are used in the firewall’s default system policies.
Table C.2 System Aliases
System Alias Description

IP addresses (of CVIs on clusters) which have DHCP
$$ DHCP Enabled Interface Addresses
relay enabled.
$$ DHCP Enabled interface addresses for IPsec IP addresses (of NDIs on clusters) which have
VPN clients DHCP relay enabled for VPN Clients.
IP address of the DHCP-assigned DNS server for

$$ DHCP Interface X.dns
interface number X.
IP address of the DHCP-assigned default router for

$$ DHCP Interface X.gateways
interface number X.
$$ DHCP Interface X.ip DHCP-assigned IP address for interface number X.
$$ DHCP Interface X.net Network behind the dynamic IP interface number X.
$$ Interface ID X.ip First IP address (CVI) of Physical Interface ID X.
Directly connected networks behind Physical

$$ Interface ID X.net
Interface ID X.
$$ Local Cluster All addresses of the cluster.
$$ Local Cluster (CVI addresses only) All CVI addresses of the cluster.
944 Appendix C Predefined Aliases

Table C.2 System Aliases (Continued)
System Alias Description

$$ Local Cluster (DHCP Interface Addresses) All DHCP-assigned IP addresses of the engine.
$$ Local Cluster (NDI addresses only) All NDI addresses of all nodes in the cluster.
$$ Local Cluster (NDI for heartbeat addresses

Heartbeat NDI addresses of all nodes in the cluster.
only)
$$ Local Cluster (NDI for management Management NDI address(es) of all nodes in the
addresses only) cluster.
$$ Log Servers IP addresses of all Log Servers.
$$ Management Servers IP addresses of all Management Server.
$$ Valid DHCP Address Pools for IPsec VPN Address pools defined for assigning virtual IP
clients addresses to VPN clients.
$$ Valid DHCP Servers All DHCP servers defined for the firewall.
The DHCP servers defined for assigning virtual IP

$$ Valid DHCP Servers for IPsec VPN clients
addresses to VPN clients.
System Aliases 945

946 Appendix C Predefined Aliases
APPENDIX D
REGULAR EXPRESSION SYNTAX
Regular expressions are used to define patterns in traffic for custom Situations, which can be
used in Inspection rules in StoneGate Firewall and IPS.
Syntax for StoneGate Regular Expressions (page 948)

Special Character Sequences (page 950)
Pattern-Matching Modifiers (page 951)
Bit Variable Extensions (page 952)
Variable Expression Evaluation (page 954)
System Variables (page 958)
Independent Subexpressions (page 959)
Parallel Matching Groups (page 960)
947
Syntax for StoneGate Regular Expressions
StoneGate custom Situations are often defined as text strings using regular expression patterns
for matching byte sequences in network traffic.
The expression matching starts always at the beginning of the traffic stream. For this reason,
‘.*’ is usually necessary at the beginning of a regular expression to indicate that there can be
an undefined number of bytes in the traffic stream preceding the expression.
The regular expression string consists of one or more branches that are separated by the ‘|’
logical OR symbol as follows: “branch-1|branch-2| . . .”. A branch contains one or more regular
expressions one after another. The Situation matches if any of the regular expression branches
separated by ‘|’ matches to the network traffic byte stream.
Note – Regular expressions are case sensitive. Space characters are included in the
matching process unless the modifier (?S) or (?x) is used to ignore spaces.
The StoneGate regular expressions are described in Table D.1.
Table D.1 StoneGate Regular Expression Syntax
Sequence Description Example

‘2’, ‘A’, ‘foo’ match exactly to the
<char> Matches only the defined characters. defined characters: ‘2’, ‘A’, and ‘foo’
respectively.
matches any character, including the null

character \x00 and a missing character. Matches
. (dot) ‘.’ matches any single character or byte.
also other than printable characters, such as the
linefeed.
‘\x4d’ matches hexadecimal value ‘4d’

Matches the hexadecimal byte value ranging from
\x<hex> which represents the decimal value 77
\x00 to \xFF.
and the ASCII character ‘M’.
‘[15aB]’ matches when any of the

characters ‘1’, ‘5’, ‘a’, or ‘B’ in the
[<char>] Match any of the characters in the list.
matching location of the inspected
string.
‘[^aBc]’ matches if none of the

Matches when none of the characters in the list is characters ‘a’, ‘B’, or ‘c’ is present in
[^<char>]
present. the matching location of the inspected
string.
‘[a–f]’ matches any character within

[<char1>– Matches all the characters ranging from <char1>
the range from ‘a’ to ‘f’, with ‘a’ and ‘f’
<char2>] to <char2>, these two characters included.
included.
948 Appendix D Regular Expression Syntax

Table D.1 StoneGate Regular Expression Syntax (Continued)
Sequence Description Example

Used in bracket expression to match any character
of the defined class.
The <class> can be: alnum [0-9A-Za-z], alpha
[A-Za-z], ascii (ascii char), blank (space or tab), ‘[[:digit:]]’ matches any digit, e.g.
[:<class>:]
cntrl (control char), digit [0-9], graph (alnum 1, 5, or 7.
or punct), lower [a-z], print (printable char),
punct [.,”’!?;:], space (any space char), upper
[A-Z], word (alnum + ‘_’ char), xdigit [0-9A-Fa-f].
Used for escaping special metacharacters to be

‘\[’ matches the ‘[’ character instead of
interpreted as normal characters, in this case as
\<char> interpreting it as the regular expression
<char>. The metacharacters are: \|)(][^-
class metacharacter.
*+?.#
Anything starting with ‘# ’ up to the linefeed

(\x0a) or the carriage return (\x0d) character is ‘# my comment.’ is not used in the
#<text>
considered as a comment and not used in the matching process.
matching process.
(<expr1>| Matches if either the sub-expression <expr1> or

‘a(bc|de)’ matches ‘abc’ and ‘ade’.
<expr2>) <expr2> matches.
It is also possible to indicate repeated, consecutive regular expressions by using quantifiers as

described in Table D.2.
Table D.2 StoneGate Regular Expression Quantifiers
Quantifier Description Example

Matches if there are zero or more consecutive ‘a*’ matches ‘<empty>’, ‘a’, ‘aa’ and so
<expr>*
<expr> strings. on.
Matches if there are one or more consecutive ‘a+’ matches ‘a’, ‘aa’, ‘aaa’ and so on,
<expr>+
<expr> strings. but not the empty string.
<expr>? Matches if there is zero or one <expr> string. ‘a?’ matches ‘<empty>’ and ‘a’.
{num} matches exactly num times the

expression. “a{5,}” matches five or more
{num,} matches num or more times the consecutive ‘a’.
<expr>{n,m}
expression. “a{5,7}” matches five, six, or seven
{num,max} matches at least num and no more consecutive ‘a’.
than max times the expression.
The ‘*’ and ‘+’ wildcard characters in the middle of a regular expression pattern can easily
result in an expression that has a very large number of different matching states. For this
reason, they must be used with care. The computed matching pattern can grow exponentially,
thus becoming too complex for efficient use on the Sensors.
Syntax for StoneGate Regular Expressions 949

Use the “{num,max}” quantifier where possible, instead of the ‘*’ and ‘+’ bounds. Variables
can also be used to break down the pattern to smaller chunks as described in Bit Variable
Extensions (page 952).
Illustration D.1 provides an example regular expression.
Illustration D.1 Example regular expression

# This expression matches any of the following patterns in the traffic:
# ‘/bin/{ash|bash|csh|ksh|sh|tcsh}’
# First, match ‘/bin/sh’ with zero or more characters in front of it:

.*/bin/sh|
# or match ‘/bin/’ with zero or more characters in front of it,
# followed by ‘ash’, ‘csh’, or ‘ksh’:
.*/bin/[ack]sh|
# or match ‘/bin/’ with zero or more characters in front of it,
# followed by ‘bash’ or ‘tcsh’:
.*/bin/(ba|tc)sh
# Alternatively, this expression with all the patterns can be integrated

# into one, for example: .*/bin/(ba|tc|[ack])?sh
Special Character Sequences

The printable characters are defined simply by typing them in the regular expression. The
hexadecimal values \xHH can also be used to match any byte value (e.g., ASCII character). In
addition, there are some shorthands for common non-printable characters and character
classes. The special character sequences are listed in Table D.3.
Table D.3 Special Character Sequences
Sequence Description
\a Bell (BEL) = \x07
\t Horizontal tab (HT) = \x09
\n Linefeed (LF) = \x0A
\f Formfeed (FF) = \x0C
\r Carriage return (CR) = \x0D
\e Escape (ESC) = \x1B
\OOO Octal code OOO of the character.
\xHH Hexadecimal code HH of the character.
\c<char> Control character that corresponds to Ctrl+<char>
\w "word" class character = [A-Za-z0-9_]
\W Non-"word" class character = [^A-Za-z0-9_]
\s Whitespace character = [ \t\r\n\f]

Table D.3 Special Character Sequences (Continued)
\S Non-whitespace character = [^ \t\r\n\f]
\d Digit character = [0-9]
\D Non-digit character = [^0-9]
Backspace (BS) = \x08

\b
Note: allowed only in bracket expressions.
\Q Quotes all metacharacters between the \Q and \E. Backslashes are considered
as normal characters.
<expr>
For example, “\QC:\file.exe\E” matches the “C:\file.exe” string, not the
\E
“C:\x0Cile.exe” string where \x0C is the formfeed “\f”.
Pattern-Matching Modifiers
The StoneGate regular expression syntax has Perl-like extensions. The pattern-matching
modifiers are extensions that can be used to control the matching process in more detail. The
modifiers are enabled with (?<modifiers>) and disabled with a minus (?-<modifiers>),
where <modifiers> is a list of one or more modifiers.
The modifiers (?C), (?L), and (?s)are enabled by default. The pattern-matching modifiers are
listed in Table D.4.
Table D.4 Pattern-Matching Modifiers
“Case insensitive mode”
When enabled, case insensitive matching is used for the uppercase and lowercase letters.
(?i) Thus, a letter matches regardless of its capitalization.
When disabled, the letters are matched case-sensitively so that capitalization is taken into
account in the matching process.
“Single line mode”

When enabled, the dot character ‘.’ matches also the null character \x00 and a missing
character in addition to matching any character (including linefeed and other non-printable
(?s) characters).
When disabled, the linefeed or a missing character are not matched.
This modifier is enabled by default. Use (?-s) to disable it.
“Extended readability mode”

When enabled, equals to enabling (?C), (?L), and (?S). Comments, linefeeds and spaces are
(?x) not used in the matching process, allowing to use them for readability of the expression.
When disabled, equals to disabling (?C), (?L), and (?S).Comments, linefeeds and spaces are
used in the matching process.
Pattern-Matching Modifiers 951

Table D.4 Pattern-Matching Modifiers (Continued)
“Allow comments mode”
When enabled, anything after the hash character ‘# ’ is considered as a comment and not
included in the matching process.
(?C)
When disabled, the hash character ‘# ’ and anything following are used in the matching
process.
This modifier is enabled by default. Use (?-C) to disable it.
“Ignore linefeeds mode”

When enabled, the linefeed and carriage return characters are not included in the matching
process unless specifically defined (\x0A or \n for linefeed and \x0D or \r for carriage
(?L)
return).
When disabled, the linefeeds and carriage returns are used in the matching process.
This modifier is enabled by default. Use (?-L) to disable it.
“Ignore spaces mode”

When enabled, the space and horizontal tab characters are not used in the matching process
(?S)
unless specifically defined (\x20 for space and \x09 or \t for horizontal tab).
When disabled, the space and horizontal tab characters are used in the matching process.
(?<modifiers> Applies the <modifiers> modifiers only to the subexpression <sub-expr>. These
:<sub-expr>) modifiers are not used in other parts of the regular expression.
Bit Variable Extensions

Variables can be used to define regular expression patterns that are related to each other.
These relations can be expressed with the variables so that the regular expression matches
only when all the related patterns match. Complex matching with multiple Situations is also
possible, as the variables and the variable values are shared with all the Situations in a
Situation Group.
A variable extension can use the following expressions:
• A value setting expression defines the values for one or more variables when the
corresponding top-level branch matches.
For example, (?{var_a=1}) sets the value 1 for the variable var_a.
• A conditional expression inspects the values defined for one or more variables so that the
corresponding top-level branch matches, and the optional variable setting expressions are
processed only if the conditional expression is true.
For example, (?{var_b==1}) matches when the variable var_b is equal to 1.
• When using both variable expression types for the same top-level branch, the implication
operator ‘->’ must be used.
For example, (?{var_a==1->var_a=0}) matches when the variable var_a is equal to 1, and
finally sets the value for this variable to be 0.

Each variable is unique within the Situation or Situation Group where the variable is used. The
name of a Situation variable can be anything consisting of alphanumeric and underscore
characters [A-Za-z_0-9]. The variable name must not begin with a digit. The variable has a
boolean value that can be either 0 or 1. The variable values persist through each individual
traffic stream.
Note – In variable expressions a single equal sign ‘=’ sets a value for a variable, whereas
two consecutive equal signs ‘==’ evaluate the value of a variable.
Variables are defined with the expressions listed in Table D.5.
Table D.5 Variable Extensions
The expression matches and the <var> variable’s value is set to
(?{<var>=<value>}) <value> (0 or 1). Multiple value setting expressions can be defined by
separating them with a comma ‘,’.
Sets the <var> variable’s value to <value> (0 or 1). The ignore

(?{<var>=<value>,ignore}) keyword is used to indicate a partial match that does not trigger response
alone but requires another matching branch.
The expression matches only when the <var> variable’s value is

(?{<var>==<value>}) <value>. Multiple conditional expressions can be defined by separating
them with ‘&&’.
The expression matches only when the <var1> variable’s value is

(?{<var1>==<value1>->
<value1>. When the condition is true, the <var2> variable’s value is set
<var2>=<value>})
to <value2>.
(?{...}) can be used in the two top-level branches that are separated by the logical OR symbol ‘|’.
A variable extension is processed only when its top-level branch matches.
Illustration D.2 Expression with Variables

# Expression matches only when ‘POST /attack.asp?’ string is followed
# by ‘Content-Type: application/x-www-form-urlencoded’ string
# with any number of bytes in between.
(?i)#case-insensitive mode
.*POST /attack.asp\?(?{match=1,ignore})|#does not trigger response alone

.*Content-Type: application/x-www-form-urlencoded(?{match==1->match=0})
The expression in Illustration D.2 detects two different strings in the same connection. The
variable is used so that the response is triggered only when the first branch matches, followed
by the second branch match. Neither of the branches trigger the response alone.
Note – A ‘*’ or ‘?’ wildcard in a middle of an expression can result in a computed matching
pattern that is too complex for efficient use on the Sensors. Therefore, it is recommended
to divide the pattern into two branches as in Illustration D.2.
Bit Variable Extensions 953

Variable Expression Evaluation
Variable expression evaluation is an extension to regular expression syntax that provides the
ability to parse values from the input stream, perform arithmetic operations, detect large blocks
of data, and use variable larger than one bit. This allows you to create more precise and reliable
Situations in cases that are difficult with the traditional regular expression syntax.
Table D.6 Variable Expression Syntax
(?[<expression>]) <expression> is one or more comma-separated expressions
Variables can be 1, 8, 16, 32 or 64 bits long. By default, a variable is one bit (either 0 or 1). The
default variable size in bits can be changed with a postfix that contains a "@" sign and the
number of bits.
Example test@32 means that the variable test is 32 bits long.
If the variable name is prefixed with a dollar sign ($), the variable is matched against the current
connection instead of the current stream. This matching in both client to server and server to
client traffic.
Example $command_seen@32 checks that a certain command has been issued by the client and the
server has accepted the command without errors.
Each expression has a value after evaluation. The type of the value can be a 32-bit or 64-bit
unsigned integer, or a void. The results of Expressions can be used to perform basic integer
arithmetic, variable assignment, and comparisons. The order of operations is similar to that of
the C programming language, for example A + B * C is A + (B * C), not (A + B) * C. The '->' is
lowest in precedence. Statements inside parentheses () are always evaluated first, so the order
of operations can be overridden with parentheses,
Table D.7 Operations on Expression Results
false Always evaluates to a false.
true Always evaluates to a true.
A literal number in decimal, octal and hexadecimal format, for example

<number>
"32" or "0x20".
Sets a value returned by expression <expr> to a variable <var>. See

<var> = <expr>
variable syntax below.
Adds the value of variable <var> with the value returned by expression
<var> += <expr>
<expr> and sets the result to variable <var>.
Subtracts the value from variable <var> by the value returned by

<var> -= <expr>
expression <expr> and sets the result to variable <var>.
Multiplies the value of <var> by the value returned by expression <expr>

<var> *= <expr>
and sets the result to variable <var>.

Table D.7 Operations on Expression Results (Continued)
Divides the value of <var> with the value returned by expression <expr>
<var> /= <expr>
and sets the result to variable <var>.
Divides the value of <var> with the value returned by expression <expr>
<var> %= <expr>
and sets the modulo of result to variable <var>.
Shifts the value of <var> to left by number of steps returned by expression

<var> <<= <expr>
<expr> and sets the result to variable <var>.
Shifts the value of <var> to right by number of steps returned by

<var> >>= <expr>
expression <expr> and sets the result to variable <var>.
Performs bitwise AND with the value of variable <var> and the value
<var> &= <expr>
returned by expression <expr> and sets the result to variable <var>.
Performs bitwise OR with the value of variable <var> and the value
<var> |= <expr>
Performs bitwise XOR with the value of variable <var> and the value
<var> ^= <expr>
<expr_a> -> <expr_b> Expression <expr_b> is evaluated only if <expr_a> is true.
<expr_a> ? <expr_b> : Expression <expr_b> is evaluated only if <expr_b> is true and expression
<expr_c> <expr_c> is evaluated if <expr_a> is false.
<expr_a> == <expr_b> Test if expressions <expr_a> and <expr_b> return an equal value.
<expr_a> != <expr_b> Test if expressions <expr_a> and <expr_b> do not return an equal value.
Test if expression <expr_b> returns higher value than expression

<expr_a> < <expr_b>
<expr_a>.
Test if expression <expr_b> returns higher or equal value than expression

<expr_a> <= <expr_b>
<expr_a>.
Test if expression <expr_a> returns higher value than expression

<expr_a> > <expr_b>
<expr_b>.
Test if expression <expr_a> returns higher or equal value than expression

<expr_a> >= <expr_b>
<expr_b>.
Performs bitwise AND with expressions <expr_a> and <expr_b> and

<expr_a> & <expr_b>
returns the result.
Performs bitwise OR with expressions <expr_a> and <expr_b> and returns

<expr_a> | <expr_b>
the result.
Performs bitwise XOR with expressions <expr_a> and <expr_b> and

<expr_a> ^ <expr_b>
returns the result.
Performs AND with expressions <expr_a> and <expr_b> and returns the
<expr_a> && <expr_b>
result.
Variable Expression Evaluation 955

Table D.7 Operations on Expression Results (Continued)
Performs OR with if expressions <expr_a> and <expr_b> and returns the
<expr_a> || <expr_b>
result.
<var>++, ++<var> Increase value of variable <var> by one.
<var>--, --<var> Decrease value of variable <var> by one.
-<expr> Negate the result of the expression <expr>.
~<expr> Bitwise invert the result of the expression <expr>.
!<expr> Perform NOT operation with the expression <expr>.
Stream Operations
The binary data from the input stream can be read into variables with the following expressions:
Table D.8 Binary Data Variable Expressions
Parse big endian value. <size> is the size of the value to be read in bits,
parse_be@<size>
and it can be one of the following: 8, 16, 24, 32, 40, 48, 56 or 64.
Parse little endian value. <size> is the size of the value to be read in bits,
parse_le@<size>
and it can be one of the following: 8, 16, 24, 32, 40, 48, 56 or 64.
ASCII values can be read from the input stream with the following expressions:
Table D.9 ASCII Data Variable Expressions
Parse ASCII decimal value. <length> is the maximum number of the
characters to parse. The actual number of parsed digits in the variable
parse_dec(<length>)
$parse_length@32. If no characters could be parsed, then the variable is
set to zero.
parse_dec(<is available>) The actual number of parsed digits is available in the variable.
Parse ASCII hexadecimal value. <length> is the maximum number of the

parse_hex(<length>)
set to zero.
parse_hex(<is available>) The actual number of parsed digits is available in the variable.
Parse ASCII value; parses hexadecimal if the string starts with "0x", octal
if the string starts with zero ("0") and decimal otherwise. <length> is the
parse_int(<length>) maximum number of the characters to parse. The actual number of
parsed digits in the variable $parse_length@32. If no characters could be
parsed, then the variable is set to zero.

Table D.9 ASCII Data Variable Expressions (Continued)
parse_int(<is available>) The actual number of parsed digits is available in the variable.
Parse ASCII octal value. <length> is the maximum number of the

parse_oct(<length>)
set to zero.
parse_oct(<is available>) The actual number of parsed digits is available in the variable.
Miscellaneous operations with the input stream:
Table D.10 Miscellaneous Input Stream Operations
Calculates a 32-bit CRC value starting from the current byte up to number
CRC(<length>) of bytes specified by <length> parameter. This function is suitable to
detect large binary blocks from the input stream.
skip(<length>) Skip <length> number of bytes.
Launch independent subexpression. See section "Independent

regexp(<regexp>)
Subexpression" for more information.
Other Expressions
Table D.11 Other Expressions
Generate a situation. This expression is used to generate a situation
sid()
indicating a match.
sid(<id>) Generate a specific situation specified by <id>.
cancel Stop matching in the current level.
cancel_fp_ctx Stop matching in the current fingerprinting context.
Illustration D.3 provides an example of a regular expression that launches a variable expression.
Illustration D.3 Expression with Variable Expression

# Launches a variable expression when byte 20h (space character) is seen in
# the input stream. The evaluation first assigns variable aa@16 a value of
# 8, checks if the value of variable bb@32 is 47, and if so, generates a
# situation.
.*\x20(?[aa@16=8, bb@32==47 -> sid()])
Variable Expression Evaluation 957

When (?[]) is used (at the end of a regular expression branch or elsewhere), the situation is
not reported automatically. sid() must be used explicitly. This is different from (?{}), where
the situation is automatically reported if ignore is not used.
System Variables
The syntax of the system variables is the same as for other variables (see Table D.5), except
that the variable’s value is not user-changeable.
Table D.12 System Variables
$major The major version number of the StoneGate engine.
$minor The minor version number of the StoneGate engine.
$patch The patch level number of the StoneGate engine.
$build The build number of the StoneGate engine.
$fpver The version number of the current fingerprint matching engine.
The current destination port of the connection. This value can be used to
$dport
limit matching to traffic that is destined to a specific port.
The byte that is under inspection when counted from the beginning of the
$offset
traffic stream.
Number of digits parsed by last parse_dec(), parse_hex(), parse_oct() or

$parse_length@32
parse_in() expression. See Stream Operations below.
Illustration D.4 provides example of an offset expression that matches when

'\xff\x53\x4d\x42\x25' occurs in the stream, so that \x25 is the 25th byte in the stream.
Illustration D.4 Expression with Variables

# Expression matches when '\xff\x53\x4d\x42\x25' occurs in the stream with
\x25 as the # 25th byte in the stream. The 25th byte in the stream has an
offset value
# of 24.
.*\xff\x53\x4d\x42\x25(?{$offset==24})

Independent Subexpressions
Independent subexpressions allow another regular expression to be launched independently
from the main regular expression. The syntax for the independent subexpression is as follows:
Table D.13 Independent Subexpression Syntax
<regular_expression> is a normal StoneGate regular expression
(?><regular_expression>)
launched independently from the main regular expression.
<expression> is a comparison expression that is evaluated before the

(?>(?{<expression>})<regular_ independent subexpression <regular_expression> is launched.
expression>) <regular expression> is launched only if <expression> evaluates to
true.
Within (?[...]) independent subexpressions can be launched by

regex(<regular_expression>).
Illustration D.5 provides an example of a regular expression that launches independent
subexpression.
Illustration D.5 Expression with Independent Subexpressions

# Main expression matches when a GET string has been seen in the input stream
# and launches an independent subexpression. The independent subexperssion
# detects whether the parameter for the GET request is longer than 400
# characters.
*GET(?>\s*[^\s]{400})
Illustration D.6 provides an example of an independent subexpression that includes a

precondition parameter check. The independent subexpression is launched only if the
precondition expression evaluates to true.
Illustration D.6 Independent Subexpression with Precondition Parameter Check

# Launches independent subexpression for a Content-length: HTTP header only
# if it is seen in a POST request.
(?x)
(?i)
.*POST(?{post_seen=1,ignore})|
.*\nContent-length:(?>(?{post_seen==1}[^\n]{1024})
Independent Subexpressions 959

Parallel Matching Groups
StoneGate allows you to set different regular expressions to be matched in parallel groups
within one Situation Context. Normally, manual situation group definitions are not needed and
StoneGate automatically compiles all your custom Situations in the same group (group 0).
Manual group definitions is needed if the IPS policy upload fails due to fingerprint/DFA
compilation problems that may occur with complex regular expressions.
To use grouping, add a new preprocessing tag to the beginning of the regular expression:
Table D.14 Preprocessing Tag for Setting a Group for Matching
Syntax Description
#!!GROUP(X)
'X' is the group number from 0 to 7. The comment is optional. If you do not
Comment
specify the group with this tag, the Situation is processed in group zero.
#!!#
Illustration D.7 Setting a parallel Matching Group
#!!GROUP(1)
This heavy regular expression is matched in parallel matching group 1.
#!!#
#Insert regular expression below

APPENDIX E
SNMP TRAPS AND MIBS
StoneGate Firewall/VPN and IPS engines can send SNMP traps on system events. The traps
are configured using SNMP Agent elements. Additionally, the Tester entries can be configured
to send SNMP traps. The SNMP traps are listed in Table E.1.
Table E.1 SNMP Traps for StoneGate Firewall/VPN and IPS
Objects
Trap Name Description
Included
(Firewall only) Policy was installed on the firewall
fwPolicyInstall fwSecurityPolicy
engine.
ipsPolicyInstall ipsSecurityPolicy (IPS only) Policy was installed on the IPS engine.
nodeBoot - Node bootup complete.
nodeHwmon nodeHwmonEvent Hardware monitoring system has detected problems.
nodeOffline nodeOperState Node changed to offline or standby state.
nodeOnline nodeOperState Node changed to online state.
nodeShutdown - Node is shutting down.
nodeTestFailure nodeTestIdentity Test subsystem reported a test failure on the node.
(Firewall only) Login failed on the firewall engine’s

nodeFailedUserLogin nodeLastLogin
console or through SSH.
nodeUserLogin nodeLastLogin Login initiated on the engine’s console or through SSH.
(Firewall only) Logout on the firewall engine’s console

nodeUserLogout nodeLastLogin
or through SSH.
961
The STONESOFT-SMI-MIB defines the top-level enterprise registrations for the Stonesoft’s
products in the .iso.org.dod.internet.private.enterprises.stonesoft branch (OID
.1.3.6.1.4.1.1369). The StoneGate specific MIBs are:
• STONESOFT-FIREWALL-MIB (Table E.2)
• STONESOFT-IPS-MIB (Table E.3)
• STONESOFT-NETNODE-MIB (Table E.4).
The StoneGate Firewall/VPN MIB files can be downloaded from the Stonesoft website at http://
www.stonesoft.com/.
The StoneGate Firewall/VPN also supports objects in the following standard MIBs:
• IF-MIB (RFC 2863 and RFC 2233) (Table E.5)
• IP-MIB (RFC 2011) (Table E.6)
• SNMP-USER-BASED-SM-MIB (RFC 3414) (Table E.7).
• SNMPv2 MIB (RFC 3418) (Table E.8)
Table E.2 STONESOFT-FIREWALL-MIB Objects
Object Name Object Description in MIB

fwPolicyTime The time when the security policy was installed to the firewall
fwSecurityPolicy Name of the current security policy on the firewall
fwSoftwareVersion Version string of the firewall software
Table E.3 STONESOFT-IPS-MIB Objects

ipsPolicyTime The time when the security policy was installed to the IPS engine
ipsSecurityPolicy Name of the current security policy on the IPS engine
ipsSoftwareVersion Version string of the IPS software
Table E.4 STONESOFT-NETNODE-MIB Objects

nodeClusterId The identification number of the cluster this node belongs to
nodeCPULoad The CPU load percentage on the node
nodeHwmonEvent Reason for the hardware monitoring event
nodeLastLogin The most recent login event on the node
nodeLastLoginTime Timestamp of the most recent login event on the node
nodeMemberId Node's member identification within the cluster
nodeOperState The operative (clustering) state of the node
nodeTestIdentity Identification string of a nodeTest
962 Appendix E SNMP Traps and MIBs

Table E.4 STONESOFT-NETNODE-MIB Objects (Continued)

nodeTestResult The most recent result of the nodeTest
nodeTestResultTime The timestamp of the most recent result of the nodeTest
Table E.5 IF-MIB Supported Objects

The desired state of the interface. The testing(3) state indicates that no operational
packets can be passed. When a managed system initializes, all interfaces start with
ifAdminStatus ifAdminStatus in the down(2) state. As a result of either explicit management action or
per configuration information retained by the managed system, ifAdminStatus is then
changed to either the up(1) or testing(3) states (or remains in the down(2) state).
This object is an 'alias' name for the interface as specified by a network manager, and
provides a non-volatile 'handle' for the interface. On the first instantiation of an
interface, the value of ifAlias associated with that interface is the zero-length string. As
and when a value is written into an instance of ifAlias through a network management
set operation, then the agent must retain the supplied value in the ifAlias instance
associated with the same interface for as long as that interface remains instantiated,
including across all re- initializations/reboots of the network management system,
ifAlias
including those which result in a change of the interface's ifIndex value. An example of
the value which a network manager might store in this object for a WAN interface is the
(Telco's) circuit number/identifier of the interface. Some agents may support write-
access only for interfaces having particular values of ifType. An agent which supports
write access to this object is required to keep the value in non-volatile storage, but it
may limit the length of new values depending on how much storage is already occupied
by the current values for other interfaces.
A textual string containing information about the interface. This string includes the
ifDescr name of the manufacturer, the product name and the version of the interface
hardware/software.
The 64-bit wide number of packets, delivered by this sub-layer to a higher (sub-)layer,
which were addressed to a multicast address at this sub-layer. For a MAC layer
protocol, this includes both Group and Functional addresses. This object is a 64-bit
ifHCInMulticastPkts version of ifInMulticastPkts. Discontinuities in the value of this counter can occur at re-
initialization of the management system, and at other times as indicated by the value
of ifCounterDiscontinuityTime.
The 32-bit ifInMulticastPkts reports the low 32-bits of this counter’s value.
The 64-bit wide total number of octets received on the interface, including framing
characters. This object is a 64-bit version of ifInOctets. Discontinuities in the value of
ifHCInOctets this counter can occur at re-initialization of the management system, and at other
times as indicated by the value of ifCounterDiscontinuityTime.
The 32-bit ifInOctets reports the low 32-bits of this counter’s value.
963
Table E.5 IF-MIB Supported Objects (Continued)

which were not addressed to a multicast or broadcast address at this sub-layer. This
object is a 64-bit version of ifInUcastPkts. Discontinuities in the value of this counter
ifHCInUcastPkts can occur at re-initialization of the management system, and at other times as
indicated by the value of ifCounterDiscontinuityTime.
The 32-bit ifInUcastPkts reports the low 32-bits of this counter’s value.
The 64-bit wide total number of octets transmitted out of the interface, including
framing characters. This object is a 64-bit version of ifOutOctets. Discontinuities in the
ifHCOutOctets value of this counter can occur at re-initialization of the management system, and at
other times as indicated by the value of ifCounterDiscontinuityTime.
The 32-bit ifOutOctets reports the low 32-bits of this counter’s value.
The 64-bit wide total number of packets that higher-level protocols requested be
transmitted, and which were not addressed to a multicast or broadcast address at this
sub-layer, including those that were discarded or not sent. This object is a 64-bit
ifHCOutUcastPkts version of ifOutUcastPkts. Discontinuities in the value of this counter can occur at re-
initialization of the management system, and at other times as indicated by the value
The 32-bit ifOutUcastPkts reports the low 32-bits of this counter’s value.
An estimate of the interface's current bandwidth in units of 1,000,000 bits per second.
If this object reports a value of `n' then the speed of the interface is somewhere in the
range of `n-500,000' to `n+499,999'. For interfaces which do not vary in bandwidth or
ifHighSpeed
for those where no accurate estimation can be made, this object contains the nominal
bandwidth. For a sub-layer which has no concept of bandwidth, this object must be
zero.
A unique value, greater than zero, for each interface. It is recommended that values are
assigned contiguously starting from 1. The value for each interface sub-layer must
ifIndex
remain constant at least from one re-initialization of the entity's network management
system to the next re- initialization.
The number of inbound packets which were chosen to be discarded even though no
errors had been detected to prevent their being deliverable to a higher-layer protocol.
One possible reason for discarding such a packet could be to free up buffer space.
ifInDiscards
Discontinuities in the value of this counter can occur at re-initialization of the
management system, and at other times as indicated by the value of
ifCounterDiscontinuityTime.
For packet-oriented interfaces, the number of inbound packets that contained errors
preventing them from being deliverable to a higher-layer protocol. For character-
oriented or fixed-length interfaces, the number of inbound transmission units that
ifInErrors contained errors preventing them from being deliverable to a higher-layer protocol.


which were addressed to a multicast address at this sub-layer. For a MAC layer
protocol, this includes both Group and Functional addresses. Discontinuities in the
ifInMulticastPkts value of this counter can occur at re-initialization of the management system, and at
other times as indicated by the value of ifCounterDiscontinuityTime.
This object reports the low 32-bits of the 64-bit ifHCInMulticastPkts counter’s value.
The 32-bit wide total number of octets received on the interface, including framing
characters. Discontinuities in the value of this counter can occur at re-initialization of
ifInOctets the management system, and at other times as indicated by the value of
This object reports the low 32-bits of the 64-bit ifHCInOctets counter’s value.
which were not addressed to a multicast or broadcast address at this sub-layer.
ifInUcastPkts management system, and at other times as indicated by the value of
This object reports the low 32-bits of the 64-bit ifHCInUcastPkts counter’s value.
The value of sysUpTime at the time the interface entered its current operational state.
ifLastChange If the current state was entered prior to the last re-initialization of the local network
management subsystem, then this object contains a zero value.
Indicates whether linkUp/linkDown traps are generated for this interface. By default,
ifLinkUpDownTrapEnable this object must have the value enabled(1) for interfaces which do not operate on 'top'
of any other interface (as defined in the ifStackTable), and disabled(2) otherwise.
The size of the largest packet which can be sent/received on the interface, specified in
ifMtu octets. For interfaces that are used for transmitting network datagrams, this is the size
of the largest network datagram that can be sent on the interface.
The textual name of the interface. The value of this object must be the name of the
interface as assigned by the local device and must be suitable for use in commands
entered at the device's `console'. This might be a text name, such as `le0' or a simple
port number, such as `1', depending on the interface naming syntax of the device. If
several entries in the ifTable together represent a single interface as named by the
ifName
device, then each will have the same value of ifName. Note that for an agent which
responds to SNMP queries concerning an interface on some other (proxied) device,
then the value of ifName for such an interface is the proxied device's local name for it.
If there is no local name, or this object is otherwise not applicable, then this object
contains a zero-length string.
The number of network interfaces (regardless of their current state) present on this
ifNumber
system.
965

The current operational state of the interface. The testing(3) state indicates that no
operational packets can be passed. If ifAdminStatus is down(2) then ifOperStatus is
down(2). If ifAdminStatus is changed to up(1) then ifOperStatus changes to up(1) if the
interface is ready to transmit and receive network traffic; it changes to dormant(5) if
ifOperStatus
the interface is waiting for external actions (such as a serial line waiting for an
incoming connection); it remains in the down(2) state if and only if there is a fault that
prevents it from going to the up(1) state; it remains in the notPresent(6) state if the
interface has missing (typically, hardware) components.
The number of outbound packets which were chosen to be discarded even though no
errors had been detected to prevent their being transmitted. One possible reason for
ifOutDiscards discarding such a packet could be to free up buffer space. Discontinuities in the value
of this counter can occur at re-initialization of the management system, and at other
For packet-oriented interfaces, the number of outbound packets that could not be
transmitted because of errors. For character-oriented or fixed-length interfaces, the
number of outbound transmission units that could not be transmitted because of
ifOutErrors
errors. Discontinuities in the value of this counter can occur at re-initialization of the
The 32-bit wide total number of octets transmitted out of the interface, including
framing characters. Discontinuities in the value of this counter can occur at re-
ifOutOctets initialization of the management system, and at other times as indicated by the value
This object reports the low 32-bits of the 64-bit ifHCOutOctets counter’s value.
The 32-bit wide total number of packets that higher-level protocols requested be
transmitted, and which were not addressed to a multicast or broadcast address at this
sub-layer, including those that were discarded or not sent. Discontinuities in the value
ifOutUcastPkts of this counter can occur at re-initialization of the management system, and at other
This object reports the low 32-bits of the 64-bit ifHCOutUcastPkts counter’s value.
The interface's address at its protocol sub-layer. For example, for an 802.x interface,
this object normally contains a MAC address. The interface's media-specific MIB must
ifPhysAddress define the bit and byte ordering and the format of the value of this object. For
interfaces which do not have such an address (e.g., a serial line), this object must
contain an octet string of zero length.
This object has a value of false(2) if this interface only accepts packets/frames that
are addressed to this station. This object has a value of true(1) when the station
accepts all packets/frames transmitted on the media. The value true(1) is only legal on
ifPromiscuousMode
certain types of media. If legal, setting this object to a value of true(1) may require the
interface to be reset before becoming effective. The value of ifPromiscuousMode does
not affect the reception of broadcast and multicast packets/frames by the interface.


An estimate of the interface's current bandwidth in bits per second. For interfaces
which do not vary in bandwidth or for those where no accurate estimation can be made,
this object must contain the nominal bandwidth. If the bandwidth of the interface is
ifSpeed greater than the maximum value reportable by this object then this object must report
its maximum value (4,294,967,295) and ifHighSpeed must be used to report the
interface’s speed. For a sub-layer which has no concept of bandwidth, this object must
be zero.
The type of interface. Additional values for ifType are assigned by the Internet Assigned
ifType Numbers Authority (IANA), through updating the syntax of the IANAifType textual
convention.
Table E.6 IP-MIB Supported Objects

icmpInAddrMaskReps The number of ICMP Address Mask Reply messages received.
icmpInAddrMasks The number of ICMP Address Mask Request messages received.
icmpInDestUnreachs The number of ICMP Destination Unreachable messages received.
icmpInEchoReps The number of ICMP Echo Reply messages received.
icmpInEchos The number of ICMP Echo (request) messages received.
The number of ICMP messages which the entity received but determined as having
icmpInErrors
ICMP-specific errors (bad ICMP checksums, bad length, etc.).
The total number of ICMP messages which the entity received. Note that this counter
icmpInMsgs
includes all those counted by icmpInErrors.
icmpInParmProbs The number of ICMP Parameter Problem messages received.
icmpInRedirects The number of ICMP Redirect messages received.
icmpInSrcQuenchs The number of ICMP Source Quench messages received.
icmpInTimeExcds The number of ICMP Time Exceeded messages received.
icmpInTimestampReps The number of ICMP Timestamp Reply messages received.
icmpInTimestamps The number of ICMP Timestamp (request) messages received.
icmpOutAddrMaskReps The number of ICMP Address Mask Reply messages sent.
icmpOutAddrMasks The number of ICMP Address Mask Request messages sent.
icmpOutDestUnreachs The number of ICMP Destination Unreachable messages sent.
icmpOutEchoReps The number of ICMP Echo Reply messages sent.
icmpOutEchos The number of ICMP Echo (request) messages sent.
967
Table E.6 IP-MIB Supported Objects (Continued)

The number of ICMP messages which this entity did not send due to problems
discovered within ICMP such as a lack of buffers. This value must not include errors
icmpOutErrors discovered outside the ICMP layer such as the inability of IP to route the resultant
datagram. In some implementations there may be no types of error which contribute
to this counter's value.
The total number of ICMP messages which this entity attempted to send. Note that
icmpOutMsgs
this counter includes all those counted by icmpOutErrors.
icmpOutParmProbs The number of ICMP Parameter Problem messages sent.
The number of ICMP Redirect messages sent. For a host, this object will always be
icmpOutRedirects
zero, since hosts do not send redirects.
icmpOutSrcQuenchs The number of ICMP Source Quench messages sent.
icmpOutTimeExcds The number of ICMP Time Exceeded messages sent.
icmpOutTimestampReps The number of ICMP Timestamp Reply messages sent.
icmpOutTimestamps The number of ICMP Timestamp (request) messages sent.
ipAdEntAddr The IP address to which this entry's addressing information pertains.
The value of the least-significant bit in the IP broadcast address used for sending
datagrams on the (logical) interface associated with the IP address of this entry. For
ipAdEntBcastAddr example, when the Internet standard all-ones broadcast address is used, the value
will be 1. This value applies to both the subnet and network broadcasts addresses
used by the entity on this (logical) interface.
The index value which uniquely identifies the interface to which this entry is
ipAdEntIfIndex applicable. The interface identified by a particular value of this index is the same
interface as identified by the same value of RFC 1573's ifIndex.
The subnet mask associated with the IP address of this entry. The value of the mask
ipAdEntNetMask
is an IP address with all the network bits set to 1 and all the hosts bits set to 0.
The size of the largest IP datagram which this entity can re-assemble from incoming
ipAdEntReasmMaxSize
IP fragmented datagrams received on this interface.
The default value inserted into the Time-To-Live field of the IP header of datagrams
ipDefaultTTL originated at this entity, whenever a TTL value is not supplied by the transport layer
protocol.
The indication of whether this entity is acting as an IP router in respect to the

ipForwarding forwarding of datagrams received by, but not addressed to, this entity. IP routers
forward datagrams. IP hosts do not (except those source-routed via the host).
The number of input datagrams for which this entity was not their final IP destination,
as a result of which an attempt was made to find a route to forward them to that final
ipForwDatagrams destination. In entities which do not act as IP routers, this counter will include only
those packets which were Source-Routed via this entity, and the Source-Route option
processing was successful.


The number of IP datagram fragments that have been generated as a result of
ipFragCreates
fragmentation at this entity.
The number of IP datagrams that have been discarded because they needed to be
ipFragFails fragmented at this entity but could not be, e.g., because their Don't Fragment flag
was set.
ipFragOKs The number of IP datagrams that have been successfully fragmented at this entity.
The number of input datagrams discarded because the IP address in their IP

header's destination field was not a valid address to be received at this entity. This
count includes invalid addresses (e.g., 0.0.0.0) and addresses of unsupported
ipInAddrErrors
Classes (e.g., Class E). For entities which are not IP routers and therefore do not
forward datagrams, this counter includes datagrams discarded because the
destination address was not a local address.
The total number of input datagrams successfully delivered to IP user-protocols

ipInDelivers
(including ICMP).
The number of input IP datagrams for which no problems were encountered to

prevent their continued processing, but which were discarded (e.g., for lack of buffer
ipInDiscards
space). Note that this counter does not include any datagrams discarded while
awaiting re-assembly.
The number of input datagrams discarded due to errors in their IP headers, including
ipInHdrErrors bad checksums, version number mismatch, other format errors, time-to-live
exceeded, errors discovered in processing their IP options, etc.
The total number of input datagrams received from interfaces, including those
ipInReceives
received in error.
The number of locally addressed datagrams received successfully but discarded

ipInUnknownProtos
because of an unknown or unsupported protocol.
The interface on which this entry's equivalence is effective. The interface identified
ipNetToMediaIfIndex by a particular value of this index is the same interface as identified by the same
value of RFC 1573's ifIndex.
ipNetToMediaNetAddress The IpAddress corresponding to the media-dependent `physical' address.
ipNetToMediaPhysAddress The media-dependent `physical' address.
The type of mapping. Setting this object to the value invalid(2) has the effect of
invalidating the corresponding entry in the ipNetToMediaTable. That is, it effectively
disassociates the interface identified with said entry from the mapping identified with
said entry. It is an implementation- specific matter as to whether the agent removes
ipNetToMediaType
an invalidated entry from the table. Accordingly, management stations must be
prepared to receive tabular information from agents that corresponds to entries not
currently in use. Proper interpretation of such entries requires examination of the
relevant ipNetToMediaType object.
969

The number of output IP datagrams for which no problem was encountered to prevent
their transmission to their destination, but which were discarded (e.g., for lack of
ipOutDiscards
buffer space). Note that this counter would include datagrams counted in
ipForwDatagrams if any such packets met this (discretionary) discard criterion.
The number of IP datagrams discarded because no route could be found to transmit

them to their destination. Note that this counter includes any packets counted in
ipOutNoRoutes
ipForwDatagrams which meet this `no-route' criterion. Note that this includes any
datagrams which a host cannot route because all of its default routers are down.
The total number of IP datagrams which local IP user- protocols (including ICMP)
ipOutRequests supplied to IP in requests for transmission. Note that this counter does not include
any datagrams counted in ipForwDatagrams.
The number of failures detected by the IP re-assembly algorithm (for whatever

reason: timed out, errors, etc.). Note that this is not necessarily a count of discarded
ipReasmFails
IP fragments since some algorithms (notably the algorithm in RFC 815) can lose
track of the number of fragments by combining them as they are received.
ipReasmOKs The number of IP datagrams successfully re-assembled.
ipReasmReqds The number of IP fragments received which needed to be reassembled at this entity.
The maximum number of seconds which received fragments are held while they are
ipReasmTimeout
awaiting reassembly at this entity.
Table E.7 SNMP-USER-BASED-SM-MIB Objects

The total number of packets received by the SNMP engine which were dropped
usmStatsDecryptionErrors
because they could not be decrypted.
usmStatsNotInTimeWindows
because they appeared outside of the authoritative SNMP engine's window.
usmStatsUnknownEngineIDs because they referenced an snmpEngineID that was not known to the SNMP
engine.
usmStatsUnknownUserNames
because they referenced a user that was not known to the SNMP engine.
usmStatsUnsupportedSecLevels because they requested a security Level that was unknown to the SNMP engine
or otherwise unavailable.
usmStatsWrongDigests
because they didn't contain the expected digest value.
An advisory lock used to allow several cooperating Command Generator

usmUserSpinLock Applications to coordinate their use of facilities to alter secrets in the
usmUserTable.

Table E.7 SNMP-USER-BASED-SM-MIB Objects (Continued)

The status of this conceptual row. Until instances of all corresponding columns
are appropriately configured, the value of the corresponding instance of the
usmUserStatus column is 'notReady'. In particular, a newly created row for a
user who employs authentication, cannot be made active until the
corresponding usmUserCloneFrom and usmUserAuthKeyChange have been set.
Further, a newly created row for a user who also employs privacy, cannot be
usmUserStatus made active until the usmUserPrivKeyChange has been set. The RowStatus TC
[RFC2579] requires that this DESCRIPTION clause states under which
circumstances other objects in this row can be modified: The value of this
object has no effect on whether other objects in this conceptual row can be
modified, except for usmUserOwnAuthKeyChange and
usmUserOwnPrivKeyChange. For these 2 objects, the value of usmUserStatus
MUST be active.
Table E.8 SNMPv2-MIB Supported Objects

Indicates whether the SNMP entity is permitted to generate authenticationFailure
traps. The value of this object overrides any configuration information; as such, it
provides a means whereby all authenticationFailure traps may be disabled. Note
snmpEnableAuthenTraps
that it is strongly recommended that this object be stored in non-volatile memory
so that it remains constant across re-initializations of the network management
system.
The total number of ASN.1 or BER errors encountered by the SNMP entity when
snmpInASNParseErrs
decoding received SNMP messages.
The total number of SNMP messages delivered to the SNMP entity which used a
snmpInBadCommunityNames
SNMP community name not known to said entity.
The total number of SNMP messages delivered to the SNMP entity which
snmpInBadCommunityUses represented an SNMP operation which was not allowed by the SNMP community
named in the message.
The total number of SNMP messages which were delivered to the SNMP entity and
snmpInBadVersions
were for an unsupported SNMP version.
The total number of messages delivered to the SNMP entity from the transport
snmpInPkts
service.
The total number of GetRequest-PDUs, GetNextRequest-PDUs, GetBulkRequest-

PDUs, SetRequest-PDUs, and InformRequest-PDUs delivered to the SNMP entity
snmpProxyDrops which were silently dropped because the transmission of the (possibly translated)
message to a proxy target failed in a manner (other than a time-out) such that no
Response-PDU could be returned.
An advisory lock used to allow several cooperating SNMPv2 entities, all acting in a
manager role, to coordinate their use of the SNMPv2 set operation. This object is
snmpSetSerialNo
used for coarse-grain coordination. To achieve fine-grain coordination, one or more
similar objects might be defined within each MIB group, as appropriate.
971
Table E.8 SNMPv2-MIB Supported Objects (Continued)

The total number of GetRequest-PDUs, GetNextRequest-PDUs, GetBulkRequest-
PDUs, SetRequest-PDUs, and InformRequest-PDUs delivered to the SNMP entity
which were silently dropped because the size of a reply containing an alternate
snmpSilentDrops
Response-PDU with an empty variable-bindings field was greater than either a
local constraint or the maximum message size associated with the originator of
the request.
The textual identification of the contact person for this managed node, together
sysContact with information on how to contact this person. If no contact information is
known, the value is the zero-length string.
A textual description of the entity. This value must include the full name and
sysDescr version identification of the system's hardware type, software operating-system,
and networking software.
The physical location of this node (e.g., `telephone closet, 3rd floor'). If the
sysLocation
location is unknown, the value is the zero-length string.
An administratively assigned name for this managed node. By convention, this is

sysName the node's fully qualified domain name. If the name is unknown, the value is the
zero-length string.
The vendor's authoritative identification of the network management subsystem

contained in the entity. This value is allocated within the SMI enterprises subtree
(1.3.6.1.4.1) and provides an easy and unambiguous means for determining
sysObjectID
`what kind of box' is being managed. For example, if vendor `Flintstones, Inc.' was
assigned the subtree 1.3.6.1.4.1.4242, it could assign the identifier
1.3.6.1.4.1.4242.1.1 to its `Fred Router'.
A value which indicates the set of services that this entity may potentially offers.
The value is a sum. This sum initially takes the value zero, Then, for each layer, L,
in the range 1 through 7, that this node performs transactions for, 2 raised to (L -
1) is added to the sum. For example, a node which performs only routing functions
would have a value of 4 (2^(3-1)). In contrast, a node which is a host offering
sysServices application services would have a value of 72 (2^(4-1) + 2^(7-1)). Note that in the
context of the Internet suite of protocols, values must be calculated accordingly:
layer functionality 1 physical (e.g., repeaters) 2 datalink/subnetwork (e.g.,
bridges) 3 Internet (e.g., supports the IP) 4 end-to-end (e.g., supports the TCP) 7
applications (e.g., supports the SMTP) For systems including OSI protocols, layers
5 and 6 may also be counted.
The time (in hundredths of a second) since the network management portion of
sysUpTime
the system was last re-initialized.

A PPEN DI X F
SCHEMA UPDATES FOR EXTERNAL LDAP

SERVERS
This section lists the StoneGate-specific LDAP classes and attributes that you add to the
schema of external LDAP servers’.
The StoneGate specific attribute and class names start with “sg”. The classes are listed in
Table F.1.
Table F.1 StoneGate Specific LDAP Classes
Class Description
sggroup StoneGate user group
sguser StoneGate user account
The StoneGate specific attributes are listed in Table F.2.
Table F.2 StoneGate Specific LDAP Attributes
Attribute Related Classes Description

sgactivation sguser Activation date for the user account.
sgauth sggroup, sguser Authentication service for the user or group.
Number of days the user account is valid after the

sgdelay sggroup, sguser
activation.
Last day when the user account is valid and the user
sgexpiration sguser
can log in.
Indicates the type of the group: a subtree or discrete

sggrouptype sggroup
group.
The Distinguished Name (DN) for the user member of

sgmember sggroup
this group.
973
Table F.2 StoneGate Specific LDAP Attributes (Continued)
Attribute Related Classes Description

sgpassword sguser MD5 message digest hash of the user password.
sgpresharedkey sguser IPsec PreSharedKey for the user account.
sgsubjectaltnames sguser IPsec certificate SubjectAltNames for the user account.
sgvirtualip sggroup, sguser Virtual IP allocation allowed for the user.
Example schema updates are provided in the Management Servers’ <installation

directory>/samples/LDAPSamples/LDAP/ directory:
• SG_AD.ldif is an example schema update for Windows Server 2003 and 2008 Active
Directory. For additional considerations and instructions on extending the schema, consult
Microsoft’s Documentation:
• For Windows 2003, see http://technet.microsoft.com/en-us/library/
cc759633%28WS.10%29.aspx.
• For Windows 2008, see http://technet.microsoft.com/en-us/library/
cc771796%28WS.10%29.aspx.
• SG-v3.schema is an example schema update in the LDAPv3 format (RFC 2252) used by
OpenLDAP v.2.0.x and later, for example.
• SG-schema.conf is an example schema update in slapd.conf format, used by Netscape
Directory server and OpenLDAP version 1.2.11, for example.
In addition to updating the directory schema, there may be some server-specific requirements.
For the Netscape and the OpenLDAP version 1.2.11 servers, you must configure the following
lines to the LDAP server’s slapd.conf configuration file after stopping the LDAP service:
Illustration F.1 Additional Configuration for OpenLDAP v1.2.11 and Netscape Server
include /etc/openldap/slapd.at.conf
include /etc/openldap/slapd.oc.conf
include /etc/openldap/sg-schema.conf
schemacheck on
For the OpenLDAP server versions 2.0 and later, you must configure the following lines to the
LDAP server’s slapd.conf configuration file after stopping the LDAP service:
Illustration F.2 Additional Configuration for OpenLDAP version 2.0 or later

include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/sg-v3.schema
974 Appendix F Schema Updates for External LDAP Servers

APPENDIX G
LOG FIELDS
Log Entry Fields (page 976)

Facility Field Values (page 997)
Type Field Values (page 999)
Action Field Values (page 1000)
Event Field Values (page 1000)
IPsec VPN Log Messages (page 1005)
Audit Entry Types (page 1010)
Syslog Entries (page 1014)
Log Fields Controlled by the Additional Payload Option (page 1015)
Connection States (page 1016)
975
Log Entry Fields
The following tables list the fields of the log entry table and the corresponding XML fields
exported to syslog for exportable log entry fields. The rights of the administrator who views the
logs and the log type(s) that the administrator has selected for viewing determine which fields
are displayed.
• Non-exportable Log Entry Fields (page 976).
• Exportable Alert Log Entry Fields (page 980).
• Exportable Alert Trace Log Entry Fields (page 980).
• Exportable Audit Log Entry Fields (page 981).
• Exportable Firewall Log Entry Fields (page 982).
• Exportable IPS Log Entry Fields (page 984).
• Exportable IPS Recording Log Entry Fields (page 996).
• Exportable SSL VPN Log Entry Fields (page 997).
Non-exportable Log Entry Fields

The following log entry fields can be displayed in the log table, but cannot be exported to syslog.
Table G.1 Non-exportable Log Entry Fields
Field Description
Identifier of an additional situation that was detected
Additional Situation
simultaneously with the situation that triggered the log event.
Blacklist response.Blacklist
Duration of blacklisting in seconds.
duration
Blacklist response.Blacklist Firewall or sensor that blacklisted the traffic that triggered the log
executor event.
Blacklist response.Endpoint1
Blacklisted IP addresses for Endpoint1.
addr
Netmask for blacklisted Endpoint1 IP address (32 = host address).
mask
Blacklisted Endpoint1 port (empty = all ports).
port
Blacklisted Endpoint1 port range.
port range
Blacklisted IP addresses for Endpoint2.
addr
Netmask for blacklisted Endpoint2 IP address (32 = host address).
mask
Blacklisted Endpoint2 port (empty = all ports).
port
976 Appendix G Log Fields

Table G.1 Non-exportable Log Entry Fields (Continued)
Field Description
Blacklisted Endpoint2 port range.
port range
ID number of firewall node for which the blacklist request is

Blacklist response.Firewall ID assigned (this must match the Firewall ID given to the blacklist
Analyzer module).
Blacklist response.IP Protocol IP protocol of the blacklist response.
Blacklist response.Value missing

Blacklist Response field for which value resolving failed.
in
Certificate verify error TLS/SSL Certificate verify error code related to this event.
The policy used to decide a response after successful correlation.

Correlation base component ID Usually the value of this field is the same as “Component ID”, and
the field is omitted.
Data type Data type of the log.
Element Domain Administrative Domain of the element associated with the event.
The VPN Endpoint through which the traffic that triggered the log
Endpoint
event was sent or received.
Ethernet main type Ethernet frame main type (Ethernet 2, IPX, LLC, SNAP).
Event type Description of the event triggered the log creation.
GRE protocol Protocol number of the GRE payload packet.
GRE version Version of the GRE header.
IP frag conflict range.IP frag

Total number of conflicting bytes.
different bytes

First conflicting byte in the IP fragment.
different bytes first

Last conflicting byte in the IP fragment.
different bytes last

Value of the first conflicting byte in the latest fragment.
different new first

Value of the last conflicting byte in the latest fragment.
different new last

Value of the first conflicting byte in an earlier fragment.
different old first

Value of the last conflicting byte in an earlier fragment.
different old last
Log Entry Fields 977

Field Description
IPv6 extension header type as indicated by the next header value of
IPv6 extension header type
the preceding header.
IPv6 extension header length as indicated by the value of the

IPv6 extension header’s length
hdr_ext_len field in the extension header.
IPv6 hop limit Hop limit field in the IPv6 header.
IPv6 option data length IPv6 option data length.
IPv6 option offset IPv6 option offset from the beginning of the IPv6 extension header.
IPv6 option type IPv6 option type.
IPv6 routing final destination Final destination address in the IPv6 routing header.
IPv6 routing header type IPv6 routing header type.
IPv6 routing segments left Segments left value in the IPv6 routing header.
LLC DSAP Logical Link Control Destination Service Access Point.
LLC SSAP Logical Link Control Source Service Access Point.
The administrative Domain in which the action that triggered the log
Login Domain
event was taken.
Normalized URI normalization was used to find the match.
Overview Observed overview.
Overview Name Name of the observed overview.
Overview Section Summary of the observed section definition.
Reference event ID.Ref Comp Id Sender identifier of the referred event.
Reference event ID.Ref Creation

Creation time of the referred event.
Time
Reference event ID.Ref Event ID Identifier of the referred event.
Roles Roles of the Administrator who triggered the event.
The VPN Security Gateway through which the traffic that triggered
Security Gateway
the log event was sent or received.
Sender Domain Administrative Domain from which the log entry was sent.
Sender module version.Sender

Build number of the engine that generated the event.
build

Major version of the engine module that generated the event.
module major

Field Description
Minor version of the engine module that generated the event.
module minor

Patch version of the engine module that generated the event.
module pl
SNAP Organization Code Subnetwork Access Protocol Organization Code.
SSL/TLS Domain Domain name field in SSL/TLS certificate related to the event.
State Connection state in connection monitoring.
Subexpression Count The number of concurrent independent subexpressions.
TCP urgent pointer Urgent pointer value in the TCP header.
TCP window size TCP receive window size.
TCP window shrinkage The amount by which the TCP window shrunk.
Threshold Check Time Threshold measurement end time.
Threshold Description Description of threshold limitation.
Threshold Measured Value Value exceeding the threshold.
TLS Alert Description TLS/SSL alert message description.
TLS Alert Level TLS/SSL alert message alert level.
TLS cipher suite TLS/SSL cipher suite.
TLS compression method TLS/SSL compression method.
TLS Protocol Version TLS/SSL protocol version.
Number of tunneling protocol layers encapsulating this protocol

Tunneling level
layer.
User and Group Information User and Group Information related to the event.
Virus Identifier Virus Identifier.
The VPN through which the traffic that triggered the log event was
VPN
sent or received.

Exportable Alert Log Entry Fields
Table G.2 Alert Log Entry Fields
Field Syslog Export Field Description

Acknowledged ACK Acknowledged alert.
Alert Type ALERT Type of alert.
Component ID COMP_ID The identifier of the creator of the log entry.
Creation Time TIMESTAMP Log entry creation time.
Data Identifier LOG_ID Data Identifier of the log entry.
Description LONG_MSG Long field description of the alert.
Dst Addr DST Packet destination IP address.
Event ID EVENT_ID Event identifier, unique within one sender.
Information
INFO_MSG A description of the log event that further explains the entry.
message
Protocol PROTOCOL Connection IP protocol.
Reception time RECEPTION_TIME Time when the entry was received by the Log Server.
Reference event
REF_EVENT Reference to a related event.
ID
Rule Tag RULE_ID Rule tag of the rule that triggered the log event.
Sender NODE_ID IP address of the engine or server that sent the log entry.
Sender type SENDER_TYPE The type of engine or server that sent the log entry.
Severity ALERT_SEVERITY Severity of the situation related to the alert event.
Situation SITUATION The identifier of the situation that triggered the log event.
Exportable Alert Trace Log Entry Fields

Table G.3 Alert Trace Log Entry Fields

Address EVENT_ADDRESS Destination for the alert notification.
Alert Event EVENT_TYPE Type of alert event.
Alert Identifier EVENT_LOG_ID Data Identifier of the alert.
Alert Time EVENT_TIME Timestamp of the alert.

Table G.3 Alert Trace Log Entry Fields (Continued)

Event description EVENT_INFO Description of the alert event.
Storage Server STORAGE_SERVER_ID Server where the alert is stored.
User EVENT_USER User who executed the action that produced the alert.
Exportable Audit Log Entry Fields

Table G.4 Audit Log Entry Fields

Administrator USER_ORIGINATOR Administrator who triggered the audit event.
Client IP address CLIENT_IP_ADDRESS Address of the client that triggered the audit event.
Elements OBJECT_NAME Elements being manipulated in the audit event.
The Incident case to which the logs and/or audit events are
Incident case INCIDENT_CASE
related.
Information
message
Operation type TYPE_DESCRIPTION Type of action that triggered the audit entry.
Origin name ORIGIN_NAME Name of the component that triggered the audit event.
Result RESULT Result state after the audited event.

Exportable Firewall Log Entry Fields
Table G.5 Firewall Log Entry Fields

Acknowledged ACK Acknowledged alert.
Action of the rule that triggered the log event. The action
values are Allow, Discard, Refuse, Terminate, Wait for
Action ACTION
further actions, and Wait for authentication. For more
information on action values, see Table G.12.
Auth. Rule Tag AUTH_RULE_ID Rule number of the rule that triggered the log event.
Auth. User AUTH_NAME Username of the authorized user related to this event.
Bytes Rcvd ACC_RX_BYTES Number of bytes received during the connection.
Number of bytes sent during the connection. The number of

Bytes Sent ACC_TX_BYTES
bytes sent is counted when accounting entries are created.
The DSCP Mark associated with the traffic that triggered the
DSCP Mark DSCP_MARK
log event.
Dst Port DPORT TCP or UDP destination port in the packet header.
Elapsed time of the connection in seconds. The elapsed

Elapsed Time ACC_ELAPSED time is recorded when accounting entries are created at the
time of connection closing.
The event that triggered the log creation, for example, New
Event EVENT connection, Connection closed, Connection discarded. For
more information on event values, see Table G.12.
Firewall subsystem that generated the log event. For more

Facility FACILITY
information on facility values, see Table G.9
FP situation FP_SITUATION Situation identifier of a matching fingerprint.
ICMP code field. ICMP code provides further information

ICMP code ICMP_CODE about message type (for example, network unreachable).
For more information, refer to RFC 792 and RFC 950.

Table G.5 Firewall Log Entry Fields (Continued)

The ICMP identifier recorded by the engine when ICMP
packets pass through the firewall. The ICMP identifier may
be used by the echo sender to aid in matching the replies
ICMP ID ICMP_ID with the echo requests. For example, the identifier might be
used like a port in TCP or UDP to identify a session. For
more information on ICMP ID and the ICMP protocol, refer to
RFC 792 and RFC 950.
IKE Cookie IKE_COOKIE IKE Cookie used in the VPN negotiation.
Information
message
The IPsec Security Parameter Index (SPI) is the connection

IPsec SPI IPSEC_SPI identifier of the IPsec connection. The IPsec SPI value is
displayed as a hexadecimal number.
NAT Dst NAT_DST Translated packet destination IP address.
NAT Dst Port NAT_DPORT Translated packet destination protocol port.
Nat Rule Tag NAT_RULE_ID The rule number of the NAT rule that triggered the log event.
NAT Src NAT_SRC Translated packet source IP address.
NAT Src Port NAT_SPORT Translated packet source protocol port.
The priority assigned to the traffic according to the QoS

Priority QOS_PRIORITY
policy.
Protocol Agent SRVHELPER_ID Protocol Agent numerical ID code.
The Quality of Service class assigned to the traffic

QoS Class QOS_CLASS
according to the QoS policy.
Reference event
ID
Round trip time for outbound Multi-Link link testing. Time

Round trip RTT indicated is from sending queries to the first reply. The unit
is 0.01 seconds.
Special field for filtering logs using the defined services.

Service SERVICE
Does not appear in the log entry table.

Table G.5 Firewall Log Entry Fields (Continued)

Severity ALERT_SEVERITY Severity of the situation related to the log event.
Src Addr SRC Packet source IP address.
Src IF Srcif Defined source interface number for the firewall cluster.
Src Port SPORT TCP or UDP source port in the packet header.
Src VLAN SRC_VLAN The source VLAN ID number (up to 4095).
Syslog is a system service used in some operating

Syslog SYSLOG_TYPE systems, e.g., UNIX- and software packages. For more
information on syslog and syslog types, refer to RFC 3164.
Log entry severity type. For more information on type values,

Type TYPE
see Table G.10.
Exportable IPS Log Entry Fields

Table G.6 IPS Log Entry Fields

Agent mem usage AGENT_MEMUSAGE Memory usage of each IPS agent.
Attacker IP IP_ATTACKER IPv4 address of the attacking host.
Firewall that blacklisted the traffic that triggered the log

Blacklist executor FIREWALL_ID
event.
Blacklist response BLACKLIST_RESPONSE Firewall blacklist response that triggered the log event.
The identifier of the cluster to which the node that created

Cluster ID CLUSTER_ID
the log entry belongs.
Connection The application could not continue analyzing the traffic

CONNECTION_ANALYSIS_END
analysis end stream after this event.
Connection The connection was dropped by a Drop Response in the

DROP_CONNECTION
dropped rule.
Content type of
SIP_CONTENT_TYPE Content type of the SIP message body.
message body
Correlation base The policy that decides the response after successful
CORRELATION_COMP_ID
component ID correlation.

Table G.6 IPS Log Entry Fields (Continued)

Correlation begin NTP stamp of the beginning of the time frame for a match to
TIME_FRAME_BEGIN
time a correlation situation.
Correlation end NTP stamp of the end of the time frame for a match to a
TIME_FRAME_END
time correlation situation.
Datagram dropped DROP_DATAGRAM The datagram was dropped by a Drop Response in the rule.
Description LONG_MSG Long field description of the alert.
TCP or UDP destination port in the packet header. Included

Destination port PORT_DEST only for backwards compatibility with legacy IPS engines. For
other cases, use Dst Port.
DNS class DNS_CLASS DNS resource record class.
DNS hdr ancount DNS_HDR_ANCOUNT DNS answers count.
DNS hdr arcount DNS_HDR_ARCOUNT DNS additional section count.
DNS hdr flag tc DNS_HDR_FLAG_TC DNS header flag TC.
DNS hdr id DNS_HDR_ID DNS message ID.
DNS hdr is
DNS_HDR_IS_REQUEST DNS message is a request.
request
DNS hdr nscount DNS_HDR_NSCOUNT DNS authority section count.
DNS hdr opcode DNS_HDR_OPCODE DNS operation code.
DNS hdr qdcount DNS_HDR_QDCOUNT DNS questions count.
DNS hdr rcode DNS_HDR_RCODE DNS return code.
DNS name length DNS_NAME_LENGTH Length of DNS name in a message.
DNS offset DNS_OFFSET DNS message offset where the situation occurs.
DNS pointer DNS_POINTER Name pointer in a DNS message.
DNS qclass DNS_QCLASS Query resource record class in a DNS message.
DNS qname DNS_QNAME First queried name in a DNS message.
DNS qtype DNS_QTYPE Query type in a DNS message.
DNS section DNS_SECTION Section name in a DNS message.
DNS type DNS_TYPE DNS resource record type.
DNS UDP payload DNS_UDP_PAYLOAD UDP payload size of a DNS message.


DNS UDP payload
DNS_UDP_PAYLOAD_BY_OPT UDP payload advertised in a DNS OPT record.
by opt
Dst Port DPORT TCP or UDP destination port in the packet header.
Error id ERROR_ID Identifier of the error that triggered the log event.
Eth frame length ETH_FRAME_LENGTH Length of the Ethernet frame.
Eth min frame

ETH_MIN_FRAME_LENGTH Minimum length for Ethernet frame.
length
Ethernet type ETH_TYPE Type field in Ethernet frame.
Event count EVENT_COUNT Event count in the defined time frame.
Event update EVENT_UPDATE Event ID for which this event is an update.
Short recording of the application level data stream of the

Excerpt data EXCERPT
attack.
Excerpt position EXCERPT_POS Position in the attached short recording.
Failed response
FAILED_RESP_CNT Number of failed response attempts.
cnt
Fields updatable FIELDS_UPDATABLE Map of updatable log fields.
FP situation FP_SITUATION Situation identifier of a matching fingerprint.
Frame dropped DROP_FRAME The frame was dropped by a Drop Response in the rule.
From address SIP_FROM SIP From address.
FTP account len FTP_ACCOUNT_LEN Length of the FTP account string.
FTP adat argument

FTP_ADAT_ARG_LEN Length of ADAT command argument.
len
FTP allocate size FTP_ALLOCATE_SIZE Size of FTP allocate.
FTP arg len FTP_ARG_LEN Length of the FTP command argument.
FTP auth arg len FTP_AUTH_ARG_LEN Length of the AUTH argument.
FTP client state

FTP_CLIENT_STATE_NAME The detected FTP client state.
name
FTP clnt arg len FTP_CLNT_ARG_LEN Length of the FTP CLNT argument.
FTP command FTP_COMMAND Name of the FTP command.


FTP conf arg len FTP_CONF_ARG_LEN Length of the CONF command argument.
FTP enc arg len FTP_ENC_ARG_LEN Length of the ENC command argument.
FTP eprt arg len FTP_EPRT_ARG_LEN Length of the EPRT command argument.
FTP estp arg len FTP_ESTP_ARG_LEN Length of the ESTP command argument.
FTP help arg len FTP_HELP_ARG_LEN Length of the HELP command argument.
FTP lang arg len FTP_LANG_ARG_LEN Length of the LANG command argument.
FTP lprt arg len FTP_LPRT_ARG_LEN Length of the LPRT command argument.
FTP marker len FTP_MARKER_LEN Length of the REST command argument.
FTP mic arg len FTP_MIC_ARG_LEN Length of the MIC command argument.
FTP opts arg len FTP_OPTS_ARG_LEN Length of the OPTS command argument.
FTP password len FTP_PASSWORD_LEN Length of the detected FTP password.
FTP pathname len FTP_PATHNAME_LEN Length of the detected FTP pathname.
FTP protection FTP_PROTECTION_BUFFER_

Size of the detected PBSZ protection buffer.
buffer size SIZE
FTP reply FTP_REPLY The detected FTP server reply.
FTP reply code FTP_REPLY_CODE The detected FTP server reply code.
FTP reply len FTP_REPLY_LEN Length of an FTP server reply that is too long.
FTP reply line len FTP_REPLY_LINE_LEN Length of an FTP server reply line that is too long.
FTP server action FTP_SERVER_ACTION FTP server action after a suspicious client command.
FTP server banner FTP_SERVER_BANNER The detected FTP server banner.
FTP server state

FTP_SERVER_STATE_NAME The detected FTP server state.
name
FTP site arg len FTP_SITE_ARG_LEN Length of the SITE command argument.
FTP state name FTP_STATE_NAME The detected FTP session state.
FTP username len FTP_USERNAME_LEN Length of the detected FTP username.
HTTP content
HTTP_CONTENT_LENGTH HTTP content length.
length
HTTP content type HTTP_CONTENT_TYPE HTTP content type.
HTTP header HTTP_HEADER The detected HTTP header field.


HTTP header
HTTP_HEADER_NAME The detected HTTP header field name.
name
The detected HTTP response could not be associated to any

HTTP no request HTTP_NO_REQUEST
request.
HTTP request host HTTP_REQUEST_HOST HTTP request host.
HTTP request line HTTP_REQUEST_LINE The detected HTTP request line.
HTTP request
HTTP_REQUEST_MESSAGE_
message field Length of the HTTP request header field name.
FIELD_NAME_LENGTH
name length
HTTP request
HTTP_REQUEST_MESSAGE_
message field Length of the HTTP request header field value.
FIELD_VALUE_LENGTH
value length
HTTP request
HTTP_REQUEST_METHOD The detected HTTP request method.
method
HTTP request URI HTTP_REQUEST_URI The detected HTTP request URI.
HTTP request
HTTP_REQUEST_VERSION The detected HTTP request version.
version
HTTP requests not HTTP_REQUESTS_NOT_ Number of requests not stored due to HTTP pipeline
stored STORED overflow.
HTTP response
HTTP_RESPONSE_CODE The detected HTTP response code.
code
HTTP response
HTTP_RESPONSE_MESSAGE_
message field Length of the HTTP response header field name.
FIELD_NAME_LENGTH
name length
HTTP response
HTTP_RESPONSE_MESSAGE_
message field Length of the HTTP response header field value.
FIELD_VALUE_LENGTH
value length
HTTP URI length HTTP_URI_LENGTH Length of HTTP request URI
ICMP code field. ICMP code provides further information

ICMP code ICMP_CODE about message type (for example, network unreachable).
For more information, refer to RFC 792 and RFC 950.
ICMP expected ICMP_EXPECTED_MESSAGE_

Expected length of the ICMP message.
message length LENGTH
ICMP field addr ICMP_FIELD_ADDR_ENTRY_SI

Value of the detected ICMP address entry size field.
entry size ZE
ICMP field ICMP_FIELD_ADDRESS_

Value of detected ICMP address mask field.
address mask MASK


ICMP field domain
ICMP_FIELD_DOMAIN_NAME Value of the detected ICMP domain name field.
name
ICMP field gateway ICMP_FIELD_GATEWAY_IP_

Value of the detected ICMP gateway address field.
IP addr ADDR
ICMP field lifetime ICMP_FIELD_LIFETIME Value of the ICMP lifetime field.
ICMP field num

ICMP_FIELD_NUM_ADDRS Value of the ICMP number of addresses field.
addrs
ICMP field
ICMP_FIELD_ORIGINATE_
originate Value of the ICMP originate timestamp field.
TIMESTAMP
timestamp
ICMP field
ICMP_FIELD_OUTBOUND_
outbound hop Value of the ICMP outbound hop count field.
HOP_COUNT
count
ICMP field output ICMP_FIELD_OUTPUT_LINK_

Value of the ICMP output link MTU field.
link mtu MTU
ICMP field output ICMP_FIELD_OUTPUT_LINK_

Value of the ICMP output link speed field.
link speed SPEED
The offset in the related datagram where the situation

ICMP field pointer ICMP_FIELD_POINTER
occurred.
ICMP field ICMP_FIELD_PREFERENCE_

Value of the ICMP preference level field.
preference level LEVEL
ICMP field receive ICMP_FIELD_RECEIVE_

Value of the ICMP receive timestamp field.
timestamp TIMESTAMP
ICMP field return ICMP_FIELD_RETURN_HOP_

Value of the ICMP return hop count field.
hop count COUNT
ICMP field router ICMP_FIELD_ROUTER_

Value of the ICMP router address field.
addr ADDRESS
ICMP field ICMP_FIELD_SEQUENCE_

Value of the ICMP sequence number field.
sequence num NUMBER
ICMP field
ICMP_FIELD_TRACEROUTE_ID Value of the ICMP traceroute ID field.
traceroute id
ICMP field
ICMP_FIELD_TRANSMIT_
transmit Value of the ICMP transmit timestamp field.
TIMESTAMP
timestamp


The ICMP identifier recorded by the engine when ICMP
packets pass through the firewall. The ICMP identifier may
be used by the echo sender to aid in matching the replies
ICMP ID ICMP_ID with the echo requests. For example, the identifier might be
used like a port in TCP or UDP to identify a session. For
more information on ICMP ID and the ICMP protocol, refer to
RFC 792 and RFC 950.
ICMP message
ICMP_MESSAGE_LENGTH Length of the ICMP message.
length
ICMP referenced
ICMP_REFERENCED_ Destination IP address of the datagram related to the ICMP
destination IP
DESTINATION_IP_ADDR message.
addr
ICMP referenced ICMP_REFERENCED_ Destination port of the datagram related to the ICMP
destination port DESTINATION_PORT message.
ICMP referenced ICMP_REFERENCED_IP_ IP Protocol field of the datagram related to the ICMP
IP proto PROTO message.
ICMP referenced ICMP_REFERENCED_SOURCE Source IP address of the datagram related to the ICMP
source IP addr _IP_ADDR message.
ICMP referenced ICMP_REFERENCED_SOURCE

Source port of IP datagram related to the ICMP message.
source port _PORT
The Internet Control Message Protocol is an extension to

the Internet Protocol (IP) that supports packets containing
error, control and informational messages. ICMP messages
ICMP Type ICMP_TYPE
are sent using the basic IP header. The first octet of the
data portion of the datagram is an ICMP type field. For more
information, refer to RFC 792 and RFC 950.
Imf encoded word IMF_ENCODED_WORD Encoded word token related to this event.
Contents (possibly partial) of the mail header field related

Imf header field IMF_HEADER_FIELD
to this event.
Imf header field

IMF_HEADER_FIELD_NAME Name of the mail header field related to this event.
name
Imf header field IMF_HEADER_FIELD_ Number of characters processed in this header field when
position POSITION this event was generated.
Imf token IMF_TOKEN Syntactical token in the mail body related to this event.
Length of the syntactical token in the mail body related to

Imf token length IMF_TOKEN_LENGTH
this event.
Information
message


Inspection check
MODPAR_VA List of agent parameters and the defined values.
parameter
IP checksum IP_CHECKSUM Value of the IP header checksum.
IP datagram length IP_DATAGRAM_LENGTH Length of the IP datagram.
IP datagram new
IP_DATAGRAM_NEW_LENGTH The new suggested length for the IP datagram.
length
Destination IP address in the packet header. Included only

IP destination IP_DEST for backwards compatibility for legacy IPS. For other cases,
use Dst Addr.
IP frag conflict IP_FRAG_CONFLICT_RANGE

Conflicting byte range in a fragment.
range AGMENT_OFFSET
IP fragment offset IP_FRAGMENT_OFFSET Fragment offset in the IP header.
IP header length IP_HEADER_LENGTH Length of the IP header.
IP identification IP_IDENTIFICATION Identification field in the IP header.
IP offset IP_OFFSET Start IP offset from the beginning of the Ethernet frame.
IP option length IP_OPTION_LENGTH Length of the IP option that triggered the response.
IP option number IP_OPTION_NUMBER IP option number that triggered the response.
IP protocol PROTOCOL IP protocol of the traffic that generated the log event.
Source IP address in the packet header. Included for

IP source IP_SOURCE backwards compatibility with legacy IPS. For other cases,
use Src Addr.
IP total length IP_TOTAL_LENGTH Total length of the IP datagram.
IP version IP_VERSION Version field value in the IP header.
Length of
SIP_CONTENT_LENGTH Length of the SIP message body.
message body
Logical interface IF_LOGICAL Logical interface for a packet.
MAC destination MAC_DEST Destination MAC address in the packet header.
MAC source MAC_SOURCE Source MAC address in the packet header.
Module SENDER_MODULE_ID Sender module identification.
Module mem
MODULE_MEMUSAGE Memory usage of each module.
usage
Node
NODE_CONFIGURATION Current configuration of the node that sent the log entry.
configuration


Dynamic update package level of the node that sent the log
Node dynup NODE_DYNUP
entry.
Node version NODE_VERSION Node version of the node that sent the log entry.
Not final value NOT_FINAL_VALUE Entry is not final.
The “View interface as one LAN” option was enabled on the

One LAN ONE_LAN
logical interface through which the packet was received.
Configuration identifier related to the Situation in the

Orig config id ORIG_CONFIG_ID
referred event.
Orig sender ORIG_SENDER_MODULE_

Module version in the referred event.
module version VERSION
The operating system version of the sender of the referred

Orig sender os ver ORIG_SENDER_OS_VER
event.
Original Alert Type ORIG_ALERT Type of alert in the referred event.
Original
NTP stamp of the beginning of the time frame in the referred
correlation begin ORIG_TIME_FRAME_BEGIN
event.
time
Original
NTP stamp of the end of the time frame in the referred
correlation end ORIG_TIME_FRAME_END
event.
time
Original event
ORIG_EVENT_COUNT Number of events in the time frame of the referred event.
count
Original module ORIG_SENDER_MODULE_ID Sender module identification in the referred event.
Original severity ORIG_ALERT_SEVERITY Severity of the referred event.
Original situation ORIG_SITUATION Identifier of the situation that triggered the referred event.
Original time ORIG_TIMESTAMP Creation time of the referred event.
Packet analysis Module could not continue analyzing packet or datagram

PACKET_ANALYSIS_END
end after this event.
Packet not seen PACKET_NOT_SEEN Flag indicating that the related packet was not seen.
Physical interface IF_PHYSICAL Physical interface for a packet.
Protocol Agent SRVHELPER_ID Protocol Agent numerical ID code.
Record ID RECORD_ID Identifier of the traffic recording.


Reference event
ID
Scan ICMP echo SCAN_ICMP_ECHO_NO_ Number of distinct ICMP Echo Request (ping) destinations
no reply cnt RESPONSE_COUNTER that did not reply to a request.
Scan ICMP echo SCAN_ICMP_ECHO_REQUEST

Number of ICMP Echo Request destinations detected.
request cnt _COUNTER
Scan ICMP echo

SCAN_ICMP_ECHO_TARGETS List of the detected ICMP Echo Request destinations.
targets
Scan ICMP mask SCAN_ICMP_NETMASK_NO_ Number of ICMP Netmask Request destinations with no
no reply cnt RESPONSE_COUNTER reply.
Scan ICMP mask SCAN_ICMP_NETMASK_ Number of distinct ICMP Netmask Request destinations
request cnt REQUEST_COUNTER detected.
Scan ICMP mask SCAN_ICMP_NETMASK_

List of the detected ICMP Netmask Request destinations.
targets TARGETS
Scan ICMP no SCAN_ICMP_NO_RESPONSE_ Number of ICMP Echo, Timestamp, and Netmask Request
reply cnt COUNTER destinations with no reply.
Scan ICMP SCAN_ICMP_REQUEST_ Number of ICMP Echo, Timestamp, and Netmask Request
request cnt COUNTER destinations.
Scan ICMP time SCAN_ICMP_TIMESTAMP_NO Number of ICMP Timestamp Request destinations with no
no reply cnt _RESPONSE_COUNTER reply.
Scan ICMP time SCAN_ICMP_TIMESTAMP_ Number of distinct ICMP Timestamp Request destinations
request cnt REQUEST_COUNTER detected.
Scan ICMP time SCAN_ICMP_TIMESTAMP_

List of detected ICMP Timestamp Request destinations.
targets TARGETS
Detected starting time of the port scanning activity that

Scan start time SCAN_START_TIME
triggered the log event.
Scan TCP negative SCAN_TCP_NEGATIVE_

Number of TCP destinations that replied with TCP Reset.
cnt COUNTER
Scan TCP no ack SCAN_TCP_NO_ACK_ Number of TCP destinations targeted for illegal TCP
cnt COUNTER segments.
Scan TCP no ack SCAN_TCP_NO_ACK_

List of TCP destinations targeted for illegal TCP segments.
targets TARGETS
Scan TCP no reply SCAN_TCP_NO_RESPONSE_ Number of TCP destinations with no reply to connection
cnt COUNTER attempts.


Scan TCP normal SCAN_TCP_NORMAL_ Number of TCP destinations with handshake and two-
cnt COUNTER directional data transfer.
Scan TCP positive SCAN_TCP_POSITIVE_ Number of TCP destinations with handshake but no data
cnt COUNTER sent by client.
List of detected TCP port scan destinations in the traffic

Scan TCP targets SCAN_TCP_TARGETS
that triggered the log event.
Scan UDP SCAN_UDP_NEGATIVE_ Number of destinations that replied with ICMP Port
negative cnt COUNTER Unreachable.
Scan UDP positive SCAN_UDP_POSITIVE_

Number of two-directional UDP conversations detected.
cnt COUNTER
Scan UDP probe SCAN_UDP_PROBE_

Number of destinations that did not reply using UDP.
cnt COUNTER
Scan UDP target SCAN_UDP_TARGET_

Total number of UDP destinations detected.
cnt COUNTER
Scan UDP targets SCAN_UDP_TARGETS List of detected UDP destinations.
Sender module
SENDER_MODULE_VERSION Version of the engine module that generated the event.
version
Special field for filtering logs using the defined services.

Service SERVICE
Does not appear in the log entry table.
Severity ALERT_SEVERITY Severity of the situation related to the alert event.
SIP call ID SIP_CALL_ID SIP call ID.
SIP contact
SIP_CONTACT SIP contact address.
address
SIP header field

SIP_HEADER SIP header field contents.
contents
SIP header field

SIP_HEADER_NAME SIP header field name.
name
SIP request
SIP_REQUEST_METHOD Method of the SIP request.
method
SIP request URI SIP_REQUEST_URI URI of the SIP request.
SIP request
SIP_REQUEST_VERSION Version of the SIP request.
version


SIP response SIP_RESPONSE_REASON_
SIP response reason-phrase.
reason-phrase PHRASE
SIP response SIP_RESPONSE_STATUS_

Status code of the SIP response.
status code CODE
SIP VIA address SIP_VIA SIP VIA address.
SMTP command SMTP_COMMAND Suspicious SMTP command sent by the client.
SMTP mail stats SMTP_MAIL_STATS Statistics on e-mail messages.
SMTP misplaced SMTP_MISPLACED_ Command given in the wrong place in the command
command COMMAND sequence.
SMTP recipient SMTP_RECIPIENT Recipient forward path in RCPT command parameter.
SMTP reply SMTP_REPLY Suspicious SMTP reply message sent by the server.
SMTP reverse
SMTP_REVERSE_PATH SMTP reverse path in MAIL FROM command parameter.
path
SMTP server Suspicious server action after a suspicious client

SMTP_SERVER_ACTION
action command.
SMTP server Banner sent by the SMTP server at the beginning of the
SMTP_SERVER_BANNER
banner connection.
SMTP transaction
SMTP_TRANSACTION_STATE Session state of the SMTP transaction.
state
Source file SOURCE_FILE Name of the source file.
Source file line SOURCE_FILE_LINE) Line number in the source file.
TCP or UDP source port in the packet header. Included for

Source port PORT_SOURCE backwards compatibility with legacy IPS. For other cases,
see Src Port.
Src Addr SRC Packet source IP address.
Src Port SPOR TCP or UDP source port in the packet header.
SSH calc client SSH_CALC_CLIENT_CRYPTO_

Calculated SSH client crypto bit ratio.
crypto bit ratio BIT_RATIO
SSH calc server SSH_CALC_SERVER_CRYPTO

Calculated SSH server crypto bit ratio.
crypto bit ratio _BIT_RATIO
SSH1 host key

SSH1_HOST_KEY_BITS Bit length of the SSHv1 host key.
bits


SSH1 server key
SSH1_SERVER_KEY_BITS Bit length of the SSHv1 server key.
bits
Syslog is a system service used in some operating

Syslog SYSLOG_TYPE systems, e.g., UNIX- and software packages. For more
information on syslog and syslog types, refer to RFC 3164.
Target IP IP_TARGET IPv4 address of the target host in a detected attack.
TCP connection TCP_CONNECTION_START_

Start time of the TCP connection.
start time TIME
TCP handshake
TCP_HANDSHAKE_SEEN Initial handshake of the TCP connection detected.
seen
TCP option kind TCP_OPTION_KIND Type of the TCP option.
TCP option length TCP_OPTION_LENGTH Length of the TCP option that caused the response.
To address SIP_TO SIP To address.
UDP datagram
UDP_DATAGRAM_SIZE Size of the UDP datagram.
size
Vulnerability VULNERABILITY_ References to known vulnerabilities in a vulnerability

References REFERENCES database. Generated from situation and original situation.
Whole session True if no data of this session has been missed up to this
WHOLE_SESSION_SEEN
seen point.
Exportable IPS Recording Log Entry Fields

Table G.7 IPS Recording Log Entry Fields

Packet data PACKET_DATA Recorded packet data.
Marker showing that this frame was received before the

Record frame
RECORD_FRAME_CACHED recording was started. The frame included in the recording
cached
was taken from a memory cache.
RECORD_ID (IPS and IPS

Record ID Identifier of the traffic recording.
recording only)

Exportable SSL VPN Log Entry Fields
Table G.8 SSL VPN Log Entry Fields

Application APPLICATION The SSL VPN service that generated the log.
The type of log sent by the SSL VPN. Possible values:

Application Detail APPLICATION_DETAIL
SYSTEM, AUDIT, HTTP, DEBUG, BILLING, RADIUS, EVENT.
Information
message
Username USERNAME Username of the user to which this log event is related.
Message Id MESSAGE_ID SSL VPN-internal identifier of the log entry.
Session Id SESSION_ID ID of the User Session.
The severity assigned to the log entry by the SSL VPN-

Log Severity LOG_SEVERITY internal logging system. Possible values: Debug, Fatal, Info,
Unknown, Warning.
Facility Field Values

The following table lists the possible values for the Facility field in the log table.
Table G.9 Facility Field Values
Value
Accounting
Authentication
Blacklisting
Cluster Daemon
Cluster Protocol
Connection Tracking
Data Synchronization
DHCP Client
DHCP Relay
Invalid
Facility Field Values 997

Table G.9 Facility Field Values (Continued)
Value
IPsec
License
Load balancing filter
Log Server
Logging System
Management
Monitoring
NetLink Incoming HA
Network Address Translation
Packet Filter
Protocol Agent
Server Pool
SNMP Monitoring
State Synchronization
Syslog
System
Tester
Undefined
User Defined

Type Field Values
The following table lists the possible values for the Type field in the log table.
Table G.10 Type Field Values
Value
Critical Error
Debug high
Debug low
Debug mid
Diagnostic
Emergency - System Unusable
Error
Informational
Internal max
Max
Notification
System Alert
Undefined
Warning
Type Field Values 999

Action Field Values
The following table show the most common log occurrences for the Action field.
Table G.11 Action Field Values
Action Description
A connection was allowed through the engine. This can be a new connection, a
related connection (for example, an FTP data connection), a related packet (for
Allow
example ICMP error messages related to an earlier TCP connection), or a new
connection through an existing VPN tunnel.
Discard A connection or packet was discarded by the engine.
A connection was allowed through according to the Inspection Rules on the

Permit
engine.
Refuse A connection was refused by the engine.
Terminate A connection was terminated by the engine.
Terminate (failed) An attempt to terminate a connection failed.
A connection matched a rule with the passive Terminate action, and a log entry
Terminate (passive)
indicating that the connection would have been terminated was produced.
A connection was terminated by the engine and TCP resets were sent to both
Terminate (reset)
communicating hosts.
Wait for A connection was waiting for successful user authentication before it could
Authentication continue.
Wait for Further

A connection was waiting for some other action before it could continue.
Actions
Wait for RPC Reply A connection was waiting for an RPC reply before it could continue.
Event Field Values

The following table show the most common log occurrences for the Event field.
Table G.12 Event Field Values
Event Description
Allowed a connection from blacklister A connection from a blacklister was allowed.
The application protocol version used in the traffic is

Application protocol version is not supported
not supported.
The application protocol version used in the traffic

Application protocol version not recognised
was not recognized.
Authentication error There was an error in the user authentication process.

Table G.12 Event Field Values (Continued)
Event Description
Authentication failed A user did not successfully authenticate.
Authentication Server does not respond There is no response from the Authentication Server.
Authentication succeeded A user successfully authenticated.
Automatic online transition An engine automatically went online.
Automatic standby transition An engine automatically went to standby.
The component that attempted to send a blacklist

Blacklister not allowed
request is not on the list of Allowed Blacklisters.
Blacklisting connection closed A connection from a blacklister was closed.
Blacklisting entries flushed All entries were removed from the engine’s blacklist.
Blacklisting entry deleted An entry was removed from the engine’s blacklist.
A blacklisting entry reached the end of its Duration

Blacklisting entry expired
time.
Can't connect to log server The engine is unable to connect to the Log Server.
Configuration changed The engine’s configuration changed.
The engine’s configuration at the time the connection

Configuration information for this connection
was logged.
Redirection to a Content Inspection Server failed

Connection cannot be redirected to CIS due to
because there was no NAT rule to redirect the
absence of source NAT rule
connection.
Connection closed A connection was closed.
Connection Discarded A connection was discarded by the engine.
Connection Queued A connection was queued according to the QoS rules.
Connection redirected to Content Inspection A connection was redirected to an external Content

Server Inspection Server.
Connection Refused A connection was refused by the engine.
Connection Terminated A connection was terminated by the engine.
Redirection to a Content Inspection Server failed

Data connection cannot be redirected to CIS
because there was no NAT rule to redirect the data
due to absence of source NAT rule
connection.
Data connection redirected to content A data connection was redirected to an external

inspection server Content Inspection Server.
DHCP message received A DHCP message was received.
Event Field Values 1001

Event Description
DHCP Relay address not configured, reply A DHCP reply was discarded because no DCHP
discarded address is configured for the engine.
DHCP Relay address spoofed, request A DHCP request was discarded because the DHCP
discarded relay address was considered spoofed.
DHCP reply received A DHCP reply was received.
DHCP reply sent A DHCP reply was sent.
DHCP request forwarded A DHCP request was forwarded.
DHCP request received A DHCP request was received.
DHCP request sent A DHCP request was sent.
Dropped AH packet An IPsec AH packet was dropped.
Dropped ESP packet An IPsec ESP packet was dropped.
There was an error when trying to transfer a new

Error in receiving a new configuration
configuration to the engine.
There was an error when attempting to redirect a

Error with Content Inspection Server
connection to an external Content Inspection Server.
The engine failed to open a related connection for a

Failed to allow a related connection to open
connection that had already been allowed.
The engine was forced offline as the result of an

Force offline by test failure
automated test failing.
An administrator commanded the engine to go to the

Going locked offline by command
locked offline state.
An administrator commanded the engine to go to the

Going locked online by command
locked online state.
Going offline by command An administrator commanded the engine to go offline.
The engine went offline as the result of an automated

Going offline by test failure
test failing.
Going online by command An administrator commanded the engine to go online.
An administrator commanded the engine to go to

Going standby by command
standby.
Hybrid authentication done Hybrid authentication successfully completed.
Hybrid authentication failed Hybrid authentication failed.
A connection for which the TCP handshake did not

Incomplete connection closed
complete was closed.

Event Description
Internal engine error An internal error occurred on the engine.
Internal error An internal error occurred.
Invalid license The engine has an invalid license.
Invalid options have been configured for a custom

Invalid properties of custom Protocol Agent
Protocol Agent.
IPsec authentication error An error occurred in IPsec authentication.
The configuration for an IPsec VPN Client has finished

IPsec client cfg download done
downloading.
An attempt to download the configuration for an IPsec

IPsec client cfg download failed
VPN Client failed.
The configuration for an IPsec VPN Client was

IPsec client cfg download from
downloaded by the client at the source address.
There was an error in the IKE negotiation for an IPsec

IPsec IKE error
VPN.
LDAP Server does not respond An LDAP Server is not responding.
License exceeded A throughput based license was exceeded.
The data in the engine’s log spool partition has

Log spool corrupted
become corrupted.
Log spool is becoming full The engine’s log spool partition is becoming full.
New blacklisting entry A new entry was added to the engine’s blacklist.
New configuration successfully installed A new configuration was installed on the engine.
New connection A new connection was allowed through the engine.
A new connection through an existing VPN tunnel was

New VPN connection
allowed.
No space left on device The engine’s hard drive is full.
No suitable NAT rule found No NAT rule matched a connection.
No suitable NAT rule found for related

No NAT rule matched a related connection.
connection
Node booted An engine node booted up.
Node down An engine node is down.
Node up An engine node is up.
Oversized DHCP message discarded An excessively large DHCP message was discarded.
Event Field Values 1003

Event Description
Packet Discarded A packet was discarded by the engine.
Packet too long A packet was too long.
Packet too short A packet was too short.
Receive ICMP echo An ICMP echo (ping) was received.
A related connection was allowed through the engine.

Related Connection
For example, an FTP data connection.
A related packet was allowed through the engine. For

Related Packet example, ICMP error messages related to an earlier
TCP connection.
Requested NAT cannot be done There was an error when applying NAT to the traffic.
Security Policy reload New security policy is loaded on the engine.
Send ICMP echo An ICMP echo (ping) was sent.
Sending DHCP reply failed The engine failed to send a DHCP reply.
Sending DHCP request failed The engine failed to send a DHCP request.
Sending sync messages The engine is sending synchronization messages.
Server pool member went offline A Server Pool member went offline.
Server pool member went online A Server Pool member went online.
SSL Handshake failed An SSL handshake failed.
Starting hybrid authentication Hybrid authentication started.
Starting IKE initiator negotiation IKE initiator negotiation started.
Starting IKE responder negotiation IKE responder negotiation started.
State synchronization communication between cluster

State sync communication failure
nodes failed.
The configuration of the synchronization

State sync configuration changed
communication between cluster nodes changed.
Unknown DCHP Relay error An unknown error occurred in DHCP relay.
Unrecognized protocol A protocol in the logged traffic was not recognized.
Went locked offline The engine went to the locked offline state.
Went locked online The engine went to the locked online state.
Went offline The engine went offline.
Went online The engine went online.

Event Description
Went standby The engine went to standby.
A successful engine login causes an event that is displayed in the Logs view with the following
type of message in the Info Message field: date time login[id]:USERNAME LOGIN on
‘device’. A failed login causes an info message of the following type: date time
login[id]:FAILED LOGIN (#) on ‘device’ FOR ‘UNKNOWN’.
IPsec VPN Log Messages

The tables in this section list the most common IPsec VPN log messages (Facility=IPsec). Some
messages can only be seen when the VPN diagnostics are enabled during the VPN negotiations.
The messages listed appear in the Information Message fields of logs as information or error
messages. The Situation field in some of the logs contains similar messages.
• VPN Notifications (page 1005)
• VPN Errors (page 1007)
• VPN Error Codes (page 1009)
VPN Notifications
The table below lists messages that are seen in the logs as part of normal IPsec VPN operation.
Table G.13 Common IPsec VPN Messages in Normal Operation
Information Message Description

This message is visible only when IPsec diagnostics are enabled.
SA traffic selectors local: [...] The first message generated when new VPN negotiations are
triggered. Negotiation of a new VPN tunnel follows.

IKE SA proposal [...] Shows the proposal that the initiator in the negotiations sent to the
responder (displayed in both roles).
The beginning of IKE negotiations (in main mode).

Starting IKE main mode
initiator negotiation Which message is displayed depends on whether the gateway is the
initiator or the responder in the negotiation.
Starting IKE main mode
responder negotiation Repeated negotiations for the same connection are normal in a Multi-
Link environment.
IKE Phase-1 negotiations were successfully completed, Phase-2

IKE Phase-1 initiator done [...]
negotiations will begin.
IKE Phase-1 responder done
Which message is displayed depends on whether the gateway is the
[...]
IPsec VPN Log Messages 1005

Table G.13 Common IPsec VPN Messages in Normal Operation (Continued)
Information Message Description

IKE Phase-2 negotiations were successfully completed. The VPN
IKE Phase-2 initiator done [...] tunnel is now established and ESP or AH message(s) should appear
IKE Phase-2 responder done shortly.
[...] Which message is displayed depends on whether the gateway is the
Hybrid authentication is started for a StoneGate IPsec VPN client

Starting Hybrid Authentication
user.
Hybrid authentication succeeded for a StoneGate IPsec VPN client

Hybrid Authentication Done
user.

IKE SA import succeeded
Synchronization of Phase 1 (IKE) and Phase 2 (IPsec) information
IPsec SA import succeeded
between clustered firewall engines was successful.
ESP [...] Encrypted traffic going through the VPN tunnel. When you enable
AH [...] IPsec diagnostics you may see more of these messages.

The other gateway identified an SA that does not exist on this node. If
this is a cluster, this message is normal when the SA has been
Unknown IKE cookie negotiated with a different node and the correct SA is then queried
from the other nodes, allowing the connection to continue.
This message can also appear if the SA has been deleted, for
example, because of a timeout or dead peer detection (DPD).

Sending delete notification [...] Messages between the gateways forming the tunnel informing the
Delete notification received other party that the gateway has removed the settings indicated in
[...] the message. As a result, the other gateway also clears the settings,
allowing for renegotiations if the tunnel is still needed.
Sending IKE SA delete sync This message is visible only when IPsec diagnostics are enabled.
Receiving IKE SA expire/delete Synchronization of SA deletion information between clustered firewall
sync engines.
The gateway at the other end of the tunnel has sent an Initial-Contact
message (indicating that it has no knowledge of previous
Initial contact notification negotiations). If there are old SAs with the gateway, they are deleted
received at this point (recently negotiated SAs are not, as may be indicated by
a further log message). If SAs exist, the notification may indicate that
the other end has been cleared, for example, in a reboot.

VPN Errors
The table below lists common errors that indicate problems in an IPsec VPN tunnel. The log
messages inform you about the stage of negotiations and then give the actual error message,
for example, “IKE Phase-2 error: No proposal chosen”. The table lists only the actual message
part without additional variable details such as IP addresses or identifiers.
Table G.14 Common IPsec VPN Errors
Error Message Description

Access group mismatch The connecting VPN client is not authorized.
One of the parties rejected the authentication credentials or

something went wrong during the authentication process. If the
Authentication failed problem is not apparent in the available logs, activate diagnostics to
generate more verbose logs that give you more information about the
next negotiations.
The authentication method used by the other gateway is not allowed

Authentication method
in the configuration of this gateway. Check the settings in the VPN
mismatch
Profile that is selected for this VPN.
Can not get policy [...] No

May indicate that the gateway has no valid VPN certificate.
matching connection
Indicates that there is a mismatch in granularity settings between the

negotiating gateways.
Can not get QM policy [...]
In StoneGate, granularity is controlled with the Security Association
Granularity setting on the IPsec Settings tab of the VPN Profile.
Could not allocate inbound SPI
Could not create outbound

IPsec rule
Could not register outbound

SPI
Indications that the gateway has run out of memory. The reasons for
Old outbound SPI entry not this may include inappropriate configuration settings (such as using
found the “SA per host” setting with a very large number of hosts) in
addition to other considerations (such as hardware specifications).
Out of memory
SA install failed
Session attaching failed
Transform creation failed
Dead peer detection checks the other gateway periodically when the
Dead peer detection failed VPN is established. If no response is received, the VPN tunnel is
IKE peer was found dead [...] closed. Indicates that the other gateway is down, unreachable, or
considers the VPN tunnel already closed.
Encapsulation modes (AH and/or ESP) did not match between

Encapsulation mode mismatch
gateways.

Table G.14 Common IPsec VPN Errors (Continued)

IKE error notify received: [...] The other gateway has sent the error notification that is shown in this
message.

IKE negotiation rate-limit There is an excessive number of new VPN connection attempts within
reached, discard connection a short period of time. This mechanism is meant to protect the
firewall from certain types of denial-of-service attacks.
Invalid argument Generic error. Check the other log messages for more useful
information. If the problem is not apparent in the available logs,
Invalid syntax activate diagnostics to generate more verbose logs that give you
more information about the next negotiations.

The VPN gateway at the other end of the tunnel sent a proposal that
IPsec SA proposal not
the StoneGate gateway could not accept. This message includes
accepted
information about the rejected proposal and a further log message
should contain information on StoneGate’s local proposal.

NAT-T is not allowed for this
NAT-T was requested by the other gateway but it is not allowed in the
peer
configuration of the gateway that sends this message.
IKE negotiations failed. If the problem is not apparent in the available

No proposal chosen logs, activate diagnostics to generate more verbose logs that give
you more information about the next negotiations.
Most likely due to a mismatch in preshared keys between the initiator

Payload malformed [...] and the responder. May also be due to corruption of packets in
transit.
The IP address of the other gateway uses is not configured as a VPN

Peer IP address mismatch
gateway end-point on this gateway.
There is a mismatch in the configurations of the two negotiating

Proposal did not match policy
parties.
A VPN client is trying to use an IP address that is out of the allowed

address range. Make sure all valid IP addresses are actually included
Remote address not allowed
in the range of allowed addresses in the Internal VPN Gateway
properties and check the DHCP server configuration.
Remote ID mismatch The IKE Phase 1 ID defined for the external security gateway in
StoneGate is different from the ID with which the gateway actually
Remote identity [...] used in identified itself. The ID and its type are set for each tunnel End-Point
IKE negotiation doesn’t match in the properties of the external Gateway. Note that if an IP address
to policy [...] is used as identity, the IP address used as the identity may be
different from the IP address used for communications.
Usually means that an SA is being deleted when some new traffic

SA unusable
arrives to use the tunnel.

Table G.14 Common IPsec VPN Errors (Continued)

Sending error notify: [...] Negotiations have failed and StoneGate is sending the error
notification that is shown in this message to the other gateway.
Most likely indicates that the Site definitions do not match the IP
SPD doesn’t allow connection addresses used. Check the addresses included under the Sites for
[...] both Gateways, and also that the translated addresses are included
under the Site, if NAT is used for communications inside the VPN.
Indicates connection problems or that the other end has deleted the
Timed out SA that StoneGate is using in the negotiation. Check the logs at the
other end to see if the connection makes it through.
There is a mismatch in the configurations of the two negotiating

Traffic selector mismatch parties. You must define a matching pair for all settings; double-
check all settings at both ends.

Tunnel policy mismatch [...] Usually indicates IKE negotiations failed because of a mismatch in
the configurations of the two negotiating parties.
An Access rule matched this connection, but the traffic could not be
sent across the VPN. Most likely, this is due to the (possibly NATed)
source or destination IP address not being included in the local or
Tunnel selection failed remote gateway’s Site as required. This message also appears if a
connection that is not intended for the VPN matches the VPN rule
(note that inbound cleartext traffic can be allowed from the same
addresses as tunneled traffic with the Apply action in the VPN rule).

Only gateway-to-gateway VPN or client-to-gateway VPN is configured,
Tunnel type mismatch [...] but the connecting device is of the other type. For example, a VPN
client tried to connect, but VPN client access is not configured
(correctly) on the gateway.
VPN Error Codes

Under some conditions, multiple IPsec VPN errors may be detected simultaneously and
combined in a single log message. The most significant error is shown as text, and the other
detected errors are indicated using a combined (with bitwise OR) hexadecimal error code.
Example IKE Phase-1 Initiator error: Proposal did not match policy (100002).
Here, the hexadecimal codes
00100000 for “Proposal did not match policy” and
00000002 for “Peer IP address mismatch”) produces the code
00100002 = 100002.

The table below lists codes that are valid for engine software versions 5.0 and above.
Table G.15 Hexadecimal Error Codes in VPN Log Messages
Hex Code Error Message

00000020 Access group mismatch
00008000 Authentication method mismatch
00020000 Encapsulation mode mismatch
00000002 Peer IP address mismatch
00100000 Proposal did not match policy
00400000 Remote address not allowed
00000040 Traffic selector mismatch (local)
00000080 Traffic selector mismatch (remote)
00200000 Tunnel type mismatch
00000200 Remote ID mismatch
00000100 Internal configuration-related

00000004 problems. See the other messages
00000001 to troubleshoot.
Audit Entry Types

The following table explains the audit entry types.
Table G.16 Audit Entry Types
Type Definition
audit.info Internal messages of the audit system.
audit.start Start of an audit.
audit.stop End of an audit.
stonegate.admin.changeIp.mgtserver Audited when management server IP address is changed.
Audited when log server management IP address is

stonegate.admin.changeMgtIp.logserver
changed.
stonegate.admin.comment.change Audited when a comment is changed.
stonegate.admin.create Creation of an administrator.
stonegate.admin.delete Deletion of an administrator.
Audited when the administrator logs in to the

stonegate.admin.login
management server.

Table G.16 Audit Entry Types (Continued)
Type Definition
Audited when the administrator logs out from the
stonegate.admin.logout
management server.
stonegate.admin.name.change Change of administrator name.
stonegate.admin.password.change Change of password for an administrator.
stonegate.admin.permission.change Change of permissions for an administrator.
stonegate.admin.session Audits administrator sessions.
stonegate.alert Audited when management system sends an alert.
stonegate.alert.policy.upload Uploading a policy to an alert server - success or failure.
stonegate.audit.archive.create Audited when audit data archive is created.
stonegate.audit.archive.delete Audited when audit data archive is deleted.
stonegate.audit.archive.restore Audited when audit data archive is restored.
stonegate.backup.create Audited when a backup is created in the origin server.
stonegate.backup.delete Audited when a backup is deleted in the origin server.
stonegate.backup.restore Audited when a backup is restored in the origin server.
stonegate.database.migrate Audited when the server database is migrated.
stonegate.database.password.change Audited when database password is changed.
stonegate.directarchive.start Audited when the direct archive option is set to ON.
stonegate.directarchive.stop Audited when the direct archive option is set to OFF.
stonegate.export.start Audited when an export operation is started.
stonegate.firewall.connections.terminate Audited when a connection is terminated.
stonegate.firewall.diagnostic Diagnostic mode selected for a firewall.
stonegate.firewall.disable.userdatabase Audited when user database is disabled.
stonegate.firewall.enable.userdatabase Audited when user database is enabled.
stonegate.firewall.initial.contact Firewall performed initial contact to management server.
stonegate.firewall.initial.generate Initial configuration generated for a firewall.
A firewall monitoring change by an administrator to

stonegate.firewall.monitor.off
deactivated.
A firewall monitoring change by an administrator to

stonegate.firewall.monitor.on
activated.
stonegate.firewall.policy.upload Uploading a policy to a single firewall - success or failure.
Audit Entry Types 1011

Type Definition
A firewall reboot by an administrator through the
stonegate.firewall.reboot
management system.
stonegate.firewall.reset.database Audited when the user database is reset.
A firewall state change by an administrator to locked

stonegate.firewall.state.lockoffline
offline.
A firewall state change by an administrator to locked

stonegate.firewall.state.lockonline
online.
stonegate.firewall.state.offline A firewall state change by an administrator to offline.
stonegate.firewall.state.online A firewall state change by an administrator to online.
stonegate.firewall.state.standby A firewall state change by an administrator to standby.
stonegate.firewall.time.adjust Firewall node time adjustment.
stonegate.firewall.upgrade.end Firewall node upgrade end through management system.
stonegate.firewall.upgrade.start Firewall node upgrade start through management system.
stonegate.import.start Audited when an import operation is started.
stonegate.ips.analyzer.diagnostic Diagnostic mode selected for an analyzer.
stonegate.ips.analyzer.monitor.off Monitoring mode offline for a sensor.
stonegate.ips.analyzer.monitor.on Monitoring mode online for a sensor.
Uploading a policy to an analyzer - single analyzer cluster

stonegate.ips.analyzer.policy.upload
success or failure.
stonegate.ips.analyzer.reboot Analyzer reboot through the management system.
stonegate.ips.analyzer.state.lockoffline Analyzer state changed to locked offline.
stonegate.ips.analyzer.state.lockonline Analyzer state changed to locked online.
stonegate.ips.analyzer.state.offline Analyzer state changed to offline.
stonegate.ips.analyzer.state.online Analyzer state changed to online.
stonegate.ips.analyzer.state.standby Sensor state changed to standby.
stonegate.ips.analyzer.time.adjust Analyzer node time adjusted.
Analyzer node upgrade through management system

stonegate.ips.analyzer.upgrade.end
ends.
Analyzer node upgrade through management system

stonegate.ips.analyzer.upgrade.start
begins.
stonegate.ips.sensor.diagnostic Diagnostic mode selected for a sensor.

Type Definition
stonegate.ips.sensor.monitor.off Monitoring mode offline for a sensor.
stonegate.ips.sensor.monitor.on Monitoring mode online for a sensor.
Uploading a policy to a sensor - single sensor success or

stonegate.ips.sensor.policy.upload
failure.
stonegate.ips.sensor.reboot Sensor rebooted through the management system.
stonegate.ips.sensor.state.lockoffline Sensor state changed to locked offline.
stonegate.ips.sensor.state.lockonline Sensor state changed to locked online.
stonegate.ips.sensor.state.offline Sensor state changed to offline.
stonegate.ips.sensor.state.online Sensor state change by an administrator to online.
stonegate.ips.sensor.state.standby Sensor state changed to standby.
stonegate.ips.sensor.time.adjust Sensor node time adjusted.
stonegate.ips.sensor.upgrade.end Sensor node upgrade through management system ends.
Sensor node upgrade through management system

stonegate.ips.sensor.upgrade.start
begins.
Audited when a license file or a license component is

stonegate.license.activate
activated.
stonegate.license.delete Audited when a license component is deleted.
stonegate.license.import Audited when a license file is imported.
stonegate.license.inactivate Audited when a license is deactivated.
Audited when a scheduled task is aborted in the log

stonegate.logdatamanager.abort
server.
Audited when a scheduled task is completed in the log

stonegate.logdatamanager.complete
server.
Audited when a scheduled task is created in the log

stonegate.logdatamanager.create
server.
Audited when a scheduled task is deleted in the log

stonegate.logdatamanager.delete
server.
Audited when a scheduled task is modified in the log

stonegate.logdatamanager.modify
server.
stonegate.logdatamanager.start Audited when the user manually starts a task.
stonegate.logpruningfilter.apply Audited when a pruning filter is applied to the log server.
Audited when a pruning filter is deleted from the log

stonegate.logpruningfilter.delete
server.
Audit Entry Types 1013

Type Definition
Audited when, following to a log server re-logging to the
stonegate.logpruningfilter.refresh management, all the pruning filters are retrieved at the
management and re-applied.
stonegate.logreception.start Log reception process begins.
stonegate.logreception.stop Log reception process ends.
stonegate.logserver.certify Audited when the log server is certified.
stonegate.mgtserver.certify Audited when the management server is certified.
stonegate.object.delete Audited when an object is deleted.
stonegate.object.insert Audited when a new object is added.
stonegate.object.update Audited when an object is updated.
stonegate.policy.display Generate a policy for display.
stonegate.policy.upload.end Uploading a policy ends.
stonegate.policy.upload.start Uploading a policy starts.
stonegate.server.diskfull Audited when the log server disk gets full.
stonegate.server.start Audited when the log server is started.
stonegate.server.stop Audited when the log server is stopped.
stonegate.vpn.certificate.download Audited when client downloaded a VPN certificate.
stonegate.vpn.certificate.request Audited when a VPN certificate is requested.
stonegate.vpn.certificate.sign Audited when a VPN certificate is signed.
stonegate.vpn.gateway.remove Audited when a VPN gateway is removed.
stonegate.vpn.site.remove Audited when a VPN site is removed.
stonegate.vpn.validity.check Audited when the VPN validity is checked.
Syslog Entries
The following table presents the categories for messages that appear in log entries sent to an
external syslog server.
Table G.17 Syslog Entries
Value
Clock daemon for BSD systems
Clock daemon for System V systems

Table G.17 Syslog Entries (Continued)
Value
File transfer protocol
Kernel messages
Line printer subsystem
Mail system
Messages generated internally by syslogd
Network news subsystem
Network time protocol
Random user-level messages
Security/authorization messages
Security/authorization messages (private)
System daemons
UUCP subsystem
Log Fields Controlled by the Additional Payload Option

The following table presents the log fields that may be logged when the Additional Payload
option is selected in an Inspection rule’s Logging options.
Table G.18 Additional Payload Log Fields
Value
DNS qname
FTP command
FTP reply
FTP server banner
HTTP header
HTTP header name
HTTP request URI
HTTP request method
HTTP request version
ICMP field datagram reference
Imf encoded word
Log Fields Controlled by the Additional Payload Option 1015

Table G.18 Additional Payload Log Fields (Continued)
Value
Imf header field
Imf token
SMTP command
SMTP misplaced command
SMTP recipient
SMTP reply
SMTP reverse path
SMTP server banner
Connection States
The following states are used both in the State column in the Connections view and (in part) in
the Logs view in conjunction with info messages or logs on the closing of connections. They
reflect the standard states regarding the initiation and termination of TCP connections as seen
by the firewall in the transmissions. Table G.19 lists the possible states.
Table G.19 Connection States
State Description
CP established StoneGate cluster protocol packet is recognized.
ICMP echo Ping reply is expected.
ICMP reply wait Other ICMP request/reply types.
Invalid The communication has violated the protocol.
IPsec established IPsec tunnel packet is recognized.
New New connection is being opened.
Related New connection related to an existing one is expected soon.
Remove Connection cannot be physically removed yet.
Expecting to still see some packets (multiple reset packet), so delaying

Remove soon the removal for a few seconds. Eliminates unnecessary packet filtering
and possible logging of dropped packets.
TCP close wait One end of the connection waits for the FIN packet (passive close).
Waiting for ACK for the FIN before going to close wait status (passive
TCP close wait ack
close).
TCP closing Closing packet (FIN) sent by one end of the connection (simultaneous).

Table G.19 Connection States (Continued)
State Description
TCP closing ack Waiting for ACK for the FIN before going to closing status (active close).
TCP established Normal status of TCP connections for data transfer.
One end of the connection waits for sending the FIN packet (active
TCP fin wait 1
close).
TCP fin wait 2 One end of the connection waits for receiving ACK packet.
TCP last ack One end of the connection sent a FIN packet (passive close).
TCP last ack wait Waiting for the FIN packet to be acknowledged.
Second phase of the TCP three-way handshake, the server has replied to
TCP syn ack seen
client sent SYN with SYN+ACK, next status will be established.
TCP syn fin seen T/TCP (Transactional TCP) connection, RFC 1644.
TCP syn return Received simultaneous SYN from the other end (simultaneous open).
TCP syn seen Very first packet sent by one end of the connection.
TCP time wait One end of the connection acknowledged closing packet (FIN).
Waiting for ACK for the FIN status before going to time wait status (active
TCP time wait ack
close).
UDP established UDP connection is recognized.
Unknown established Connection from other transport level protocol.
Connection States 1017

APPENDIX H
KEYBOARD SHORTCUTS
This chapter explains the shortcut keys that you can use in the StoneGate Management
Client. Most of these shortcuts are also shown in the menus of the Management Client next
to each menu item that has a shortcut.
General Shortcuts (page 1020)

Shortcuts for Browsing Logs and Alerts (page 1021)
Other View-Specific Shortcuts (page 1023)
1019
General Shortcuts
The following table lists general shortcuts that are available in most views in the Management
Client.
Table H.1 General Shortcuts
Action Shortcut
Bookmark all tabs Ctrl+Shift+D
Bookmark current view Ctrl+D
Cancel Escape
Close tab Ctrl+W
Close view Ctrl+Q
Close window ALT+F4
Copy Ctrl+C
Cut Ctrl+X
Delete, Remove Delete
Go up/down/left/right Up/down/left/right arrow key
Manage bookmarks Ctrl+B
Maximize/Restore Ctrl+M
Move to home level in element tree F12, Alt+Up arrow key
Move to parent folder in element tree Backspace
Open action in new tab Ctrl+left mouse click
Open action in new window Shift+left mouse click
Open a new tab Ctrl+T
Open a new window Ctrl+N
Open current view in new tab Ctrl+Shift+T
Open current view in new window Ctrl+Shift+N
Open help topics F1
Open Info panel Shift+F1
Open list of view-specific tools Alt+T
Open Logs view Ctrl+1
Open properties of the selected

Ctrl+R
element
1020 Appendix H Keyboard Shortcuts

Table H.1 General Shortcuts (Continued)
Action Shortcut
Open sidebar F4
Paste Ctrl+V
Print Ctrl+P
Refresh F5
Save Ctrl+S
Search Ctrl+F
Search references Ctrl+G
Select all Ctrl+A
Switch between open tabs Ctrl+Tab
Shortcuts for Browsing Logs and Alerts

The following table explains the shortcuts available for browsing different types of logs in the
Audit, Blacklist, Connections, and Logs views.
Table H.2 Keyboard Shortcuts in Log Browsing Views
Context Action Shortcut

Audit View, Logs View Abort query Escape
Audit View, Logs View Acknowledge selected alert Space
Audit View, Logs View Apply query Ctrl+Enter
Audit View, Logs View Cancel query Shift+Escape
Audit View, Logs View Select columns Ctrl+L
Audit View, Logs View Current Events mode on/off F11
Audit View, Logs View Decrease text size Ctrl+Shift+Minus
Audit View, Logs View Enforce time range F9
Audit View, Logs View Go to the first log record Ctrl+Home
Audit View, Logs View Go to last log record Ctrl+End
Audit View, Logs View Increase text size Ctrl+Shift+Plus
Audit View, Logs View Jump backward in the timeline Ctrl+ Page Up
Audit View, Logs View Jump forward in the timeline Ctrl+ Page Down
Audit View, Logs View Refresh statistics F6
Shortcuts for Browsing Logs and Alerts 1021

Table H.2 Keyboard Shortcuts in Log Browsing Views (Continued)

Audit View, Logs View Scroll horizontally Left/Right arrow key
Audit View, Logs View Scroll one page up/down Page Up/Page Down
Audit View, Logs View Scroll Up and Down Up/Down arrow key
Audit View, Logs View Normal Text Size Ctrl+Shift+Zero
Audit View, Logs View Zoom in in timeline Ctrl+Plus
Audit View, Logs View Zoom out in timeline Ctrl+Minus
Audit View, Blacklist View,

Increase/decrease text size Ctrl+mouse wheel
Connections View, Logs View
Blacklist View, Connections View Pause F7
Blacklist View, Connections View Play F11
Blacklist View Remove entry Delete
Connections View Terminate connection Delete
Query Panel Apply query Ctrl+Enter
Query Panel Cancel query Shift+Escape

Other View-Specific Shortcuts
The table below lists other useful shortcuts that are available in different views in the
Management Client.
Table H.3 Other Keyboard Shortcuts

Diagram Editor Zoom In Ctrl+Plus
Diagram Editor Zoom Out Ctrl+Minus
Diagram Editor, Security Policy

Redo Ctrl+Y
Editor

Undo Ctrl+Z
Editor

Close editor Shitf+Escape
Editor, VPN Editor

Start editing Ctrl+E
Editor, VPN Editor
Info Panel Examine Ctrl+Space
Overviews View, Reports View Revert to last saved version Shitf+Escape
Security Policy Editor Add rule after Ctrl+Insert
Security Policy Editor Clear cell Delete
Collapse Comment Rule section/

Security Policy Editor Left arrow key
sub-policy section
Security Policy Editor Delete rule Ctrl+Delete
Security Policy Editor Edit cell F2
Expand Comment Rule section/

Security Policy Editor Right arrow key
sub-policy section
Alt+Down arrow
Security Policy Editor Move rule down
key
Security Policy Editor Move rule up Alt+Up arrow key
Security Policy Editor Search for next matching rule F3
Search for previous matching

Security Policy Editor Shift+F3
rule
Other View-Specific Shortcuts 1023

G LO S S AR Y
A
Access Control List
A list of Elements that can be used to define the Elements that an administrators with
restricted permissions can access. See also Administrator Role and Granted Element.
Access Rule
A row in a Firewall or IPS policy that defines how one type of IPv4 connection is handled by
providing matching criteria based on the source, destination, and protocol information. Confer
to IPv6 Access Rule (page 1038).
Action
What the firewall engine should do with a packet that matches the criteria for a particular rule
in the security policy.
Action Option
Additional action-specific selections that affect how the traffic is handled set in the Action cell
in rules.
Active Management Server
See Primary Management Server (page 1044).
Address Range
A Network Element that defines a range of IP addresses. Use to avoid having to repeatedly
type in the same IP addresses when defining address ranges that do not correspond to whole
networks.
Address Resolution Protocol (ARP)
An Internet standard (RFC 826) protocol used to associate IP addresses with the media
hardware address of a network interface card on a local area network (LAN).
Administrator
An Element that defines the details of a single person that is allowed to log on to the SMC
using the Management Client. If used as a general term, Web Portal Users are also
considered as administrators.
Administrator Role
An Element that defines which actions an Administrator with restricted permissions is allowed
to take. See also Granted Element and Permission Level.
1025
Aggressive Mode
The authentication of two IPsec end-points with only three messages, as opposed to Main
Mode’s six. Aggressive mode also does not provide PFS support, and SA negotiation is limited.
See Main Mode (page 1040). See also Security Association (SA) (page 1047).
AH (Authentication Header)
See Authentication Header (AH) (page 1028).
Alert Chain
A list of rules defining which Alert Channels are used, and in which order, when an alert entry is
directed to the Alert Chain from an Alert Policy to be escalated out from the Management
Center. See also Alert Escalation.
Alert Channel
A method of sending alerts out from the Log Server. You can send alerts via SMTP (e-mail),
SNMP, SMS text messages, or some other action you define in a custom script. Alert Channels
are defined in the Log Server’s properties, after which they can be used in Alert Chains.
Alert Element
An Element that gives the name and description to an Alert Event. The Alert element can be
used as a matching criteria in the rules of an Alert Policy.
Alert Entry
A log message with an alert status that has been raised based on some Situation (which you
can see in the Logs View). Alert entries trigger Alert Escalation.
Alert Escalation
Sending alerts out from the Management Center to administrators through Alert Channels (such
as e-mail) according to a predefined Alert Chain until the original Alert Entry is acknowledged by
some administrator in the Logs View.
Alert Event
A pattern in traffic or a problem in the system’s operation that matches to some Situation used
in a policy or internally in the system, and thus triggers an Alert Entry.
Alert Policy
A list of rules defining if an Alert Entry is escalated and which Alert Chain is used for escalating
which type of alert entries. See also Alert Escalation.
Alert Server
A StoneGate Management Center component that handles receiving and handling of Alerts. The
Alert Server cannot be installed separately, it is integrated in the Log Server installation.
Alias
An Element that can be used to represent other network elements in configurations. It differs
from a group element in that it does not represent all the elements at once: the value it takes in
a configuration can be different on each engine where it is used.
1026 Glossary
Allow Action
An Access Rule parameter that allows a connection matching that rule to pass through the
firewall to its destination.
Analyzer
1) A device in the StoneGate IPS system that analyzes the log information from Sensors
according to its policy to find patterns, so that separate log entries can be combined together.
2) The Network Element that represents an Analyzer device in the Management Center.
Antispoofing
Technique used to protect against malicious packages whose IP header information has been
altered. See also IP Spoofing (page 1038).
Application
A category of Tags for Situations. Meant for grouping Situations that detect known vulnerabilities
in a particular software application.
Application Layer Gateway; Application Level Firewall
A firewall system, or gateway, in which packets are examined based on the application protocol
being used (e.g., telnet, FTP, SMTP). Proxies for each application-level service are installed on
the gateway, and are often configured to relay a conversation between two systems. That is, a
packet’s destination is the gateway, which then establishes a separate connection to the other
system to complete the connection.
Apply VPN Action
A Firewall Access Rule parameter that directs traffic from protected local networks into the
Virtual Private Network (VPN) tunnel and allows traffic that arrives through a VPN, but does not
match non-VPN traffic from outside networks into the protected networks. See also Enforce VPN
Action (page 1034).
ARP (Address Resolution Protocol)
See Address Resolution Protocol (ARP) (page 1025).
Asymmetric Encryption
A cryptographic technology that uses a pair of keys. The message is encrypted with the public
half of a pair and can then be decrypted only with the matching private half of the key pair. Public
key technology can be used to create digital signatures and deal with key management issues.
Also referred to as public key encryption. See also Symmetric Encryption (page 1050) and
Public-key Cryptography (page 1045).
Auditing
A Management Center feature that logs administrators’ actions and allows administrators with
unrestricted permissions to view and manage these logs to keep track of system changes.
Authentication
The process of proving that someone or something is who or what they claim to be. For example,
typing a simple username-password combination is a form of authentication.
Glossary 1027
Authentication Header (AH)
A security protocol supported by the IPsec protocol to enhance traffic security. It enables the
authentication and integrity of data against packet corruption or tampering. AH protocol can use
SHA-1 or MD5 to generate a hash signature based on a secret component from the SA, the
packet payload and some parts of the packet header. See also Security Association (SA)
(page 1047).
Authentication Token/Authenticator
A portable device for authenticating a user. Authentication tokens typically operate by challenge/
response, time-based code sequences, or other techniques. One of the most commonly used
tokens is the RSA SecurID card.
Authorization
The process of giving someone/something permission to do or have something. Usually related
to authentication; once a user has authenticated (proved who they are), they are authorized
(given permission) to perform certain actions.
B
Balancing Mode
A StoneGate cluster mode that attempts to divide the traffic as equally as possible between the
online engines participating in the cluster. Confer to Standby Mode (page 1049).
Bandwidth Management
The process of determining and enforcing bandwidth limits and guarantees for different types of
traffic either together with Traffic Prioritization or on its own. Also see QoS Class (page 1045)
and QoS Policy (page 1045).
Blacklisting
1) The process of blocking unwanted network traffic either manually or automatically.
2) Persistently blocking access to certain URLs manually.
Bookmark
A stored link to a view or layout in the Management Client.
Bookmark Folder
A folder in the toolbar of the Management Client for storing and sharing Bookmarks.
Boot Recovery
A StoneGate setting that brings the engines automatically back online after boot-up.
Border Routing
Routing of connections between different autonomous systems.
BrightCloud
A Web Filtering categorization service that provides categories for malicious sites as well as
several categories for different types of non-malicious content that may be considered
objectionable.
1028 Glossary
Buffer Overflow
When a program’s data in the memory of a computer exceeds the space reserved for it (the
buffer), data may in some circumstances be written on other parts of the memory area.
Attackers may use buffer overflows to execute harmful program code on a remote system.
Bugtraq
A mailing list for discussing network security related issues, such as vulnerabilities.
Bulk Encryption Algorithm
Describes symmetric encryption algorithms which operate on fixed-size blocks of plaintext and
generates a block of ciphertext for each.
C
CA
See Certificate Authority (CA) (page 1029).
CAN
A candidate for a CVE entry.
Capture Interface
A Sensor interface that can listen to traffic passing in the network, but which is not used for
routing traffic through the Sensor. See also Inline Interface.
Category
A way of organizing elements and policies to display a specific subset at a time when configuring
a large StoneGate system in the Management Client to make it easier to find the relevant
elements when configuring the system. For example, a Managed Service Provider (MSP) who
manages networks of several different customers can add a customer-specific category to each
element and policy to be able to view one customer’s elements and policies at a time.
Certificate
Electronic identification of a user or device. Certificates prove the user or device is who/what
they claim to be. This is done through using public/private key pairs and digital signatures.
Certificates are used in StoneGate for authenticating communications between the system
components and for Virtual Private Network (VPN) authentication. Digital certificates are granted
and verified by a Certificate Authority (CA), such as the internal CA included in the Management
Server.
Certificate Authority (CA)
A trusted third-party organization or company that issues digital certificates, used to create
digital signatures and public-private key pairs. The role of the CA in this process is to guarantee
that the individual granted the unique certificate is, in fact, who he or she claims to be.
Challenge/Response
An authentication technique whereby a server sends an unpredictable challenge to the user,
who computes a response using some form of authentication token, which can be an
authenticator, or pre-shared keys used to encrypt random data.
Glossary 1029
Checksum
A one-way function applied to a file to produce a unique “fingerprint” of the file for later
reference. File tampering can then be discovered by verifying the checksum value in the future.
CIS
See Content Inspection Server (CIS) (page 1031).
Client
In a client-server architecture, a client is usually an application running on a computer or a
workstation that uses services provided by a Server.
Client Protection Certificate Authority
Contains the credentials that the engine uses to sign replacement server-side certificates the
engine creates and presents to clients when inspecting the clients’ HTTPS connections with
external servers. Also see Server Protection Credentials (page 1048).
Client-to-Gateway VPN
A Virtual Private Network (VPN) between a software client and a Security Gateway (SGW). Allows
connecting mobile and home office workers safely to corporate resources using a secure
(authenticated and encrypted) connection through insecure networks.
Cluster
A group of devices, or nodes, that share a given work load. In StoneGate, you can cluster
Firewalls and Sensors to share the load and provide redundancy, allowing, for example,
scheduled maintenance that takes one node out of service without interrupting services to the
users.
Cluster Mode
Determines if all members of a cluster participate to traffic processing at all times (Balancing
Mode) or if other members remain inactive until a traffic-processing member stops processing
traffic (Standby Mode).
Cluster Virtual IP Address (CVI)
An IP and MAC address shared by all nodes in a cluster, which are used by every node in a
cluster for communication. These interfaces give the cluster a single identity on the network,
reducing the complexity of routing and network design. CVIs handle the traffic directed to the
firewall for inspection in firewall clusters.
Combined Sensor-Analyzer
1) StoneGate IPS device that has both Sensor and Analyzer engines running simultaneously on
the same hardware.
2) The Network Element that represents a Combined Sensor-Analyzer device in the Management
Center.
Connection Tracking
The set of data maintained for a connection. Used for relating incoming packets to existing
connections. Connection tracking information also includes information to necessary for NAT
(Network Address Translation), Load Balanced Routing and Protocol Agents. May also contain
accounting information.
1030 Glossary
Contact Address
The IP address that is needed to contact a device performing a function in the StoneGate
Management Center when there is NAT (Network Address Translation) being performed in
between the two devices and thus the actual IP address assigned to the network interface
cannot be used directly.
Content Inspection Server (CIS)
A server that performs detailed examination of a connection’s data and assists in the
determination to allow or discard packets. Common examples include virus scanning or filtering
of Web URLs. Also known as content screening.
Continue Action
A policy parameter that sets default values to those used in the rule. The defaults are used in
all subsequent rules except where specifically overridden until some other rule with the
Continue action changes the values or the policy ends.
Context
An Element that is added to a Situation to define what the Situation should match. Provides a
framework for defining parameters, which are most entered as a regular expression, or through
a set of fields and options that the administrators adjust.
Correlation Situation
A Situation that defines the patterns that the Analyzer looks for when it examines event data
produced by Sensors.
CRL Server
A server that maintains a Certificate Revocation List (CRL), which can be used in Authentication
to check if the certificate has been cancelled.
Custom Alert
An Alert Element that is defined by a StoneGate administrator, as opposed to a ready-made
Default Element created by Stonesoft.
CVE
A dictionary that provides common names for publicly known information security vulnerabilities
and exposures and thus a standardized description for each vulnerability that links the
vulnerability information of different tools and databases.
CVI
See Cluster Virtual IP Address (CVI) (page 1030).
D
Default Element
An Element that is present in the system at installation, or is added to the system during an
upgrade or from a Dynamic Update (Package). Default elements cannot be modified or deleted
by administrators, but they may be modified or deleted by dynamic update packages or
upgrades.
Glossary 1031
Defragmentation
The process by which a large block of data is broken up into smaller pieces (datagrams), so that
it can be packaged and transmitted by the underlying network technology (Fragmentation). Once
the smaller pieces arrive at their destination, the datagrams are reassembled into the larger
block of data (defragmentation).
DHCP (Dynamic Host Configuration Protocol)
A protocol for dynamically assigning IP addresses and other network information to an interface,
based on BOOTP. A device on a network with no network information can broadcast a request for
an IP address, subnet mask, default gateway and other information from a DHCP server on that
same network. DHCP is defined in RFC 2131.
Diagram
An Element that contains one or more network diagrams created using the Diagram Editor.
Digital Certificate
See Certificate (page 1029).
Discard Action
An Access Rule parameter that stops all connections matching to the rule without sending any
notification to the connecting host. Confer to Refuse Action (page 1045).
Dispatch Clustering
See Packet Dispatch (page 1043).
DMZ Network
A DMZ (DeMilitarized Zone Network) is a network separate from both internal and external
networks, and connected through a gateway. Often used for isolating bastion hosts or publicly
available machines, e.g., mail and HTTP servers are typically located on a DMZ network.
Sometimes also referred to as a screened subnetwork.
DNS Spoofing
An attack method whereby the DNS name of a system is assumed by a malicious system, either
by corrupting the name service cache of a victim, or by compromising a domain name server for
a valid domain. The victim system is then directed to the malicious system instead of the
original server.
Domain
Domains are administrative boundaries that allow you to separate the configuration details and
other information in the system for the purpose of limiting administrator access.
DoS Attack (Denial of Service)
An attack with the objective of causing enough disruption in a computer system that its usability
to legitimate users suffers. For example, and attacker may target a website so that it becomes
overloaded, and slows down so much that it becomes unusable for people wishing to view it.
DSCP (DiffServ Code Point)
The Differentiated Services (DiffServ) Type of Service (ToS Flag) field added to packets in the
network.
1032 Glossary
DSCP Mark
A field in QoS Policy rules that writes a particular DSCP (DiffServ Code Point) marker to the
packets, if the QoS Policy is applied on the interface the packets use to exit the firewall.
DSCP Match
A field in QoS Policy rules that assigns the QoS Class specified in the rule to incoming packets
that have a specific DSCP (DiffServ Code Point) marker set, if the QoS Policy is applied on the
interface the packets use to enter of the firewall.
Dynamic IP address
An IP address that is assigned by using the DHCP (Dynamic Host Configuration Protocol).
Dynamic NAT
A way to translate network addresses, where for each original address, a translated address
and possibly a port are selected dynamically from a predefined pool.
Dynamic Update (Package)
A file supplied by Stonesoft that provides updates to Default Elements and policies, most
importantly to the Situation and Vulnerability information that is used for traffic inspection in
Inspection Rules.
E
Element
A StoneGate object representing the equipment in your physical networks or some area or
concept of configuration. Elements may, for example, represent a single device such as a
server, a range of IP addresses, or some configuration aid in the Management Center, such as a
Category. Also see Network Element (page 1042).
Encryption
Used for data security, encryption translates any data into a secret code. Public-key encryption
and symmetric encryption are the main types of encryption. Decrypting ciphertext (encrypted
data) into plaintext requires access to a secret key.
Encryption Domain
Networks that are defined to be behind a certain VPN gateway in a Virtual Private Network (VPN)
configuration.
Encryption Key
The data that is used to convert plaintext to ciphertext. In symmetric algorithms, the same key
is the decryption key as well. In public key algorithms, a different, but related key is used to
convert the ciphertext back into plaintext.
Encryption Policy
Settings that define which encryption and authentication methods are used to establish a
Virtual Private Network (VPN).
Glossary 1033
Enforce VPN Action
A firewall Access Rule parameter that directs traffic from protected local networks into the
Virtual Private Network (VPN) tunnel and allows traffic that arrives through a VPN, and drops any
non-VPN traffic from external networks to the local network that matches the rule. See also
Apply VPN Action (page 1027).
Engine
The device that runs firewall, sensor, or analyzer software; a standard server or a StoneGate
appliance. Represented by a Node in the Management Client.
Ethernet Rules
A set of rules in the IPS Policy that define which Ethernet traffic is allowed or discarded by a
Sensor in Transparent Access Control Mode.
Expression
An Element that can be used to accurately define a whole complex set of elements by including
and excluding elements using logical expressions.
External Gateway
Any Security Gateway (SGW) that is managed by a different Management Server than the one on
which the Virtual Private Network (VPN) is being configured.
F
Filter
A description of log fields and their values combined together using operators for the purpose of
sorting in or out log, alert, and audit entries. Used, for example, to filter out logs from the
display in the Logs View so that those entries that are interesting at the moment can be found
more easily.
Firewall
1) A Network Element that represents the firewall device in the Management Center. Either a
Single Firewall or a Firewall Cluster.
2) The device running the StoneGate firewall software.
Firewall Cluster
A Group of two or more Firewall Engines that work together as if they were a single unit.
Firewall Engine
The device that runs firewall software; a standard server or a StoneGate appliance Represented
by the Firewall Node in the Management Client.
Firewall Node
An individual Firewall Engine in the Management Client, representing a device that runs firewall
software as part of a Firewall Cluster or a Single Firewall.
Forward Action
A firewall Access Rule parameter that directs traffic from protected local networks or from a
Virtual Private Network (VPN) tunnel into another VPN tunnel.
1034 Glossary
Fragmentation
The process by which a large block of data is broken up into smaller pieces (datagrams), so that
it can be packaged and transmitted by the underlying network technology (fragmentation). Once
the smaller pieces arrive at their destination, the datagrams are reassembled into the larger
block of data (Defragmentation).
G
Gateway
A device that provides VPN access for other devices.
Gateway Certificate
A Certificate used for authenticating a Gateway to other Gateways and VPN Clients in a VPN.
Gateway Profile
An element that defines a set of VPN-related capabilities that a VPN Gateway supports.
Gateway Settings
An element that contains general settings for StoneGate firewall/VPN engines related to VPN
performance.
Gateway-to-Gateway VPN
In StoneGate, a Virtual Private Network (VPN) element which is set up so that the VPN is
established between two gateway devices providing connectivity to networks behind the
gateways.
Geolocation
Elements that define a geographical location of an IP address. Used for illustrating networks
and network traffic on a map and other informative purposes in the Management Client.
Granted Element
An Element or Security Policy that an administrator has been given permission to edit and install
when their Administrator Role would otherwise prevent them from doing so.
Group
A Network Element that includes other elements and represents them all at once in policies and
other parts of the configuration. For example, you can define a Group of several WWW-servers,
and then use the Group element in policies when you need to make a rule that concerns all of
the WWW-servers.
H
Hardware
in applications that run on a particular hardware platform.
Glossary 1035
Hash Signature
A cryptography-related concept that refers to a digital fingerprint associated with a given
message and computed with one-way algorithms. Hash signatures are used to secure the
integrity of encrypted data, ensuring that no tampering has taken place during transmission.
See also Client-to-Gateway VPN (page 1030), and SHA-1 (page 1048).
Heartbeat
A protocol that the nodes of a Firewall Cluster or Sensor Cluster use to monitor each other and
for other tasks that are needed for collaboration between each Node.
High Availability
The implementation of clustering technology, hot standby technology, or general redundancy in a
system to increase the availability of an application, service, or network beyond what a single
system is capable of providing. Increased availability is achieved by eliminating all single points
of failure, with clustering technology providing the highest level of availability.
Host
1) A Network Element that represents any single device that has an IP address.
2) Any device connected to a TCP/IP network, including the Internet, with one or more IP
addresses. Hosts are distinguishable from gateways or routers, in that they do not forward, or
route, packets to other networks.
Hot Standby
A solution where one node handles the work load with the support of a back-up node, which
takes over connections in case of failure in the first node.
Hybrid Authentication
A system using both Asymmetric Encryption and Symmetric Encryption. Asymmetric techniques
are used for key management and digital signatures. The symmetric algorithms are used to
encrypt the bulk of data with reduced strain on resources.
I
IKE Proposal
The suggested encryption algorithms, authentication methods, hash algorithms, and Diffie-
Hellman information in the Security Association (SA) component of an IPsec VPN. The initiator of
an IPsec tunnel can make multiple proposals, but the responder only sends one proposal in
return. See also Internet Key Exchange (IKE) (page 1037) and Security Association (SA)
(page 1047).
Incident Case
An Element that administrators can use to gather together all the data, actions, system
configuration information, and files related to a specific incident of suspicious activity.
Incident History
A collection of all the logs and audit entries that track actions performed in a particular Incident
Case window.
1036 Glossary
Info Panel
A tab in Management Client windows that shows information on the selected element or other
object. The Info view shows, for example, the nodes belonging to a selected cluster.
Inherited Rule
A rule either hidden or shown on a grey background in a Security Policy or Template Policy which
has been added in a template higher up in the policy hierarchy so that it has been passed down
to the security policy or template policy. Inherited rules are enforced just as any other rules, but
they can be edited only in the template where the rule was originally added.
Inline Interface
A Sensor interface that combines together two physical interfaces, enabling the traffic to be
routed through as if the Sensor was an extension of the network cable, but allowing the Sensor
to actively monitor packets and connections and stop them according to its Access Rules and
Inspection Rules.
Insert Point
The place in a Security Policy or Template Policy where new rules can be inserted when no rules
have been inserted in that place yet (shown as a green row) or the place in a template policy
where rules can be inserted in inheriting policies and template policies (shown as an orange
row).
Inspection Rule
The definitions on the Inspection tab in a Firewall or IPS policy that defines options for deeper
inspection and reactions to traffic accepted in Access Rules. The matching in Inspection rules is
done based on matching information provided by Situation elements. Confer to Access Rule
(page 1025).
Internal Gateway
A StoneGate Firewall/VPN engine that are managed by the same Management Server on which
the Virtual Private Network (VPN) is being configured.
Internal Network
The networks and network resources that StoneGate is protecting. In StoneGate, there is no
concept of internal and external networks in the system.
Internet Key Exchange (IKE)
A protocol defined by the IPsec (IP Security) standard for securely exchanging key-related
information between connecting hosts when establishing a Virtual Private Network (VPN).
Internet Service Provider (ISP)
A company that provides Internet connectivity to subscribers.
Intrusion Detection System (IDS)
A system that monitors network traffic for determining, and making administrators aware of data
security exploits or attempts by providing logs or other network information. Confer to Intrusion
Prevention System (IPS).
Glossary 1037
Intrusion Prevention System (IPS)
A system that monitors network traffic (like an Intrusion Detection System (IDS)) and has the
capability of actively stopping traffic if it is deemed malicious or otherwise unwanted.
IP Address Bound License
A License file for the engines that includes the information on the IP address of the component
it licenses. If you need to change the IP address of the component, you must request an IP
address change at the Stonesoft Licensing website. On engines, an alternative to a
Management Bound License (page 1040).
IPComp (IP Payload Compression Protocol)
A protocol used to reduce the size of IP datagrams. Increases the overall communication
performance between a pair of communicating gateways by compressing the datagrams,
provided the nodes have sufficient computation power, and the communication is over slow or
congested links. IPComp is defined in RFC 2393.
IP Splicing (or Hijacking)
An attack performed by intercepting and using an active, established session. Often occurs after
the authentication phase of the connection is complete, giving the attacker the permissions of
the original, authenticated user. Encryption at the session or network layer is typically the best
defense from such an attack.
IP Spoofing
A technique used to obtain unauthorized access to computers by sending connection requests
with tampered headers, simulating a trusted source.
IPsec (IP Security)
A set of protocols supporting secure exchange of packets. Used for the implementation of
Virtual Private Network (VPN) solutions when high performance and/or support for a wide variety
of protocols are needed. IPsec provides transport and tunnel encryption modes. IPsec is
defined in RFC 2401.
IPsec Proposal
Suggested encryption algorithms, hash algorithms, authentication methods, etc. to be used for
an IPsec (IP Security) tunnel. See also IKE Proposal (page 1036).
IPS Policy
The Security Policy for IPS Sensors and Analyzers containing the Access Rule and Inspection
Rule definitions that determine how traffic is inspected and how the system reacts when a
match is found.
IPv6 Access Rule
A row in an IPS policy that defines how one type of IPv6 connection is handled by providing
matching criteria based on the source, destination, and protocol information. Confer to Access
Rule (page 1025).
ISAKMP (Internet Security Association Key Management Protocol)
An open-ended encoding protocol necessary for IKE negotiation when establishing Security
Associations. See also Security Association (SA) (page 1047).
1038 Glossary
ISP (Internet Service Provider)
See Internet Service Provider (ISP) (page 1037).
J
Journal
A tool in the Incident Case window that allows administrators to create a permanent record of
their actions while investigating an incident.
Jump Action
A Security Policy parameter that directs the inspection to a Sub-Policy, against which
connections matching the rule with the Jump action are checked. Can be used to speed up
traffic processing, as connections that do not match the Jump rules are not checked against
rules in the sub-policies.
L
License
Files you import to the system to tell the Management Server that the components you have
installed have been legally purchased. You generate the Licenses at the Stonesoft Licensing
website and import them to the Management Server using the Management Client.
Lifetime
The interval at which the IPsec participants should begin to negotiate a replacement Security
Association (SA) (soft lifetime) or the interval at which the current SA for an IPsec tunnel is no
longer valid (hard lifetime) in a Virtual Private Network (VPN).
Load Balancing
A process for distributing work evenly across multiple, available devices to avoid overwhelming
any single system.
Load Balancing Filter
A software component that determines which network connections should be handled by a
particular node in a cluster, based on address information, current load, performance of
individual machines, and other factors.
Load Balanced Routing
A method for choosing routes to destinations based on determining the fastest response time
through multiple gateways. The application of Multi-Link technology to determine which network
link provides the best round trip time.
Load Sharing
The distribution of work between multiple devices. Similar to Load Balancing, but not as
effective, since the techniques used do not ensure an equal distribution of the work load. Load
sharing is typically a static method of distributing a load, whereas load balancing is often a
dynamic method.
Glossary 1039
Location
An Element that groups together system components that are on the same side of a device
doing NAT (Network Address Translation). Used to define Contact Addresses for components
that communicate within the StoneGate Management Center.
Logging Options
A selection available in all rules in policies that determines if and how a record is created when
the rule matches.
Logging Profile
Defines how the Log Server converts Syslog data received from a particular type of third-party
component into StoneGate log entries.
Log Server
A component of the Management Center responsible for storing and managing log (and alert)
data.
Log Spool
A temporary storage area in a firewall node for log data before it is sent to a Log Server.
Logical Interface
An IPS Element used in the IPS policies to represent one or more physical network interfaces as
defined in the Sensor properties.
Logs View
A tool that allows browsing logs, alerts, audit data, and connections each in an adapted version
of the same user interface.
M
Main Mode
An IKE negotiation mode, which exchanges six messages between the end-points of an IPsec
tunnel to complete the negotiation of authentication and keys for a Virtual Private Network
(VPN). Optionally, Perfect Forward Secrecy (PFS) can be applied to protect further negotiations.
See also Aggressive Mode (page 1026) and Perfect Forward Secrecy (PFS) (page 1043).
Malware
Malicious software designed to infiltrate or damage a computer system.
Management Bound License
A License file for StoneGate engines that is based on information on the Management Server’s
Proof of License (POL) code. An alternative to an IP Address Bound License (page 1038).
Management Center
The system consisting of a Management Server, one or more Log Servers and none to several
Web Portal Servers that is used to manage the Firewall Engines, and to store and manage traffic
and system related data.
1040 Glossary
Management Client
A graphical user interface component that provides the tools for configuring, managing, and
monitoring the firewalls, sensors, analyzers, and other components in the StoneGate system.
The Management Client connects to the Management Server to provide these services based
on the Administrator information that you use when launching the Management Client software.
Management Network
The network used for communication between firewalls, Management Servers, Log Servers and
the Management Client.
Management Server
A system component that stores all information about the configurations of all firewalls,
sensors, analyzers, and other StoneGate components in the system, monitors their state, and
provides access for Management Clients when administrators want to change the configurations
or command the engines. The most important component in the system.
Maximum Transmission Unit (MTU)
The largest physical size of a datagram that can be transmitted over a network without
fragmentation. Often expressed in bytes, it can apply to frames, packets, cells or other media,
depending on the underlying topology.
Modem Interface
A firewall interface that defines the settings of a 3G modem that provides a wireless outbound
link for a Single Firewall.
Monitored Element
A StoneGate server or engine component that is actively polled by the Management Server, so
that administrators can keep track of whether it is working or not. All StoneGate system
components are monitored by default.
Monitoring Agent
A software component that can be installed on servers in a Server Pool to monitor the server’s
operation for the purposes of Traffic Management.
Multicast
A technique by which a set of packets are sent to a group of machines sharing a common
address. Unlike broadcast, it does not include all machines, and unlike unicast, it usually has
more than one member of the group.
Multi-Layer Inspection
A hybrid firewall technology that incorporates the best elements of application level and network
level firewalls, with additional technology to enable the secure handling of many connection
types.
Multi-Link
Patented Stonesoft technology to connect one site to another, or to the Internet, using more
than one network link. Applications of Multi-Link technology include inbound and outbound
traffic management for unencrypted as well as VPN traffic. See also Outbound Multi-link
(page 1042).
Glossary 1041
N
NAT (Network Address Translation)
A mechanism for assigning local networks a set of IP addresses for internal traffic and another
for external traffic. It increases security by hiding internal IP addresses and enables hosts with
"invalid" (non-routable) addresses to communicate on the Internet.
NDI
See Node Dedicated IP Address (NDI) (page 1042).
NetLink
An Element used for implementing routing of StoneGate’s Multi-Link features. NetLinks can
represent any IP-based network links (such as ISP routers, xDSL, leased lines, dial-up modems).
NetLinks are combined together into an Outbound Multi-link.
Network Element
1) All Elements that represent one or more components that have an IP address, that is, a
general category (‘Network Elements’) for those elements that represent physical devices and
networks in StoneGate.
2) The Network Element called ‘Network’ that represents a (sub)network of computers. Used for
rules and configurations that are common for all hosts in a specific (sub)network.
Network Scan
A stage of an attack in which the attacker scans the target to enumerate or map the directly-
connected network(s).
Node
The representation of an individual firewall, sensor or analyzer Engine in the Management Client.
Node Dedicated IP Address (NDI)
A unique IP address for each machine. The only interface type for single firewalls. Not used for
operative traffic in firewall clusters and sensors. Firewall clusters use a second type of
interface, Cluster Virtual IP Address (CVI), for operative traffic. Sensors have two types of
interfaces for traffic inspection, the Capture Interface and the Inline Interface.
O
Operating System
in a particular operating system or applications that run on that operating system.
Outbound Multi-link
An Element used for combining NetLinks for load balancing outbound traffic. The NetLinks
included in a Outbound Multi-link element are frequently tested to determine which is the
fastest NetLink for new outbound connections.
1042 Glossary
P
Packet
A segment of data sent across a network that includes a header with information necessary for
the transmission, such as the source and destination IP addresses.
Packet Dispatch
A Cluster Virtual IP Address (CVI) mode in which only one node in the cluster receives packets.
This dispatcher node then forwards the packets to the correct node according to Load
Balancing, as well as handles traffic as a normal node. The recommended cluster mode for new
installations.
Packet Filtering
A method of controlling access to a network, or set of networks, by examining packets for
source and destination address information, and permitting those packets to pass, or halting
them based on defined rules.
Packet Sniffer
See Sniffer (page 1048).
Perfect Forward Secrecy (PFS)
A property of IKE transactions that enhances the secrecy of keys, but requires additional
processing overhead. PFS ensures that the distribution of key-related information remains
independent from previously existing key material. See also Internet Key Exchange (IKE)
(page 1037).
Permission Level
The general level of rights that an Administrator has. Permissions are customized with
Administrator Roles and Granted Elements.
Permit Action
An Inspection Rule action that stops the inspection of all traffic that matches to the rule that
uses the Permit action and lets the traffic continue to its destination.
Phishing
A Social Engineering attack in which a malicious e-mail or web page attempts to solicit sensitive
information such as usernames, passwords, and credit card details by masquerading as coming
from a trustworthy entity.
Player
Any element or IP address that was involved in an incident that is being investigated using the
Incident Case element.
Policy
A container for the Access rules, Inspection rules, and NAT rules.
Policy Routing
User-defined routing based on information that is not normally used in routing, such as the
source IP address, port information, or service type.
Glossary 1043
Policy Snapshot
A record of policy configuration that shows the configuration in the form that it was installed or
refreshed, including the rules of the policy, the elements included and their properties, as well
as the time when the policy was uploaded, and which administrator performed the upload. Helps
in keeping track of configuration changes.
Port Address Translation (PAT)
A process, similar to NAT (Network Address Translation), where the source or destination port is
changed to a different port. PAT is often used to disguise, or masquerade a service in place of
another. See also NAT (Network Address Translation) (page 1042).
Pre-shared Key
A string of characters that is stored on two (or more) systems and that is used for
authenticating or encrypting communications between the systems.
Primary Management Server
The Management Server that is actively used for configuring the system in a system that has at
least one Secondary Management Server.
Probing Profile
Settings that define how a Log Server monitors third-party components.
Proof of License (POL)
A code used for verifying the legitimate purchase of StoneGate software products. Used for
generating License files at the Stonesoft website.
Proof of Serial Number (POS)
Identification code attached to StoneGate appliances.
Protocol
An element that is used inside Service elements to specific a Protocol Agent for the Firewall
Access Rules and the protocol of the traffic for the Inspection Rules.
Protocol Agent
A process on the firewalls that assists the engine in handling a particular Protocol. Protocol
Agents ensure that related connections for a service are properly grouped and evaluated by the
firewall engine, as well as assisting the engine with content filtering or network address
translation tasks. See also Connection Tracking (page 1030).
Protocol Tag
A type for Protocol elements that are only used to define the protocol of traffic for inspection
against the inspection rules. Confer to Protocol Agent.
Proxy ARP
Proxy ARP option on a device that does routing means that the device relays broadcast
messages between two hosts that are in separate physical networks, but still have IP addresses
from the same network. This proxy is needed for the ARP requests, as broadcast messages are
not normally relayed from one network to another. See also Address Resolution Protocol (ARP)
(page 1025).
1044 Glossary
Pruning
Deleting log entries according to Filters either as the logs arrive on the Log Server or before they
are stored (after displaying them in the current view in the Logs view).
Public-key Cryptography
A cryptographic system that uses a pair of keys: a public key, used to encrypt a message, and a
private (secret) key that can decrypt the message. This is also called asymmetric encryption.
Q
QoS Class
An Element that works as a link between a rule in a QoS Policy and one or more firewall Access
Rules. The traffic allowed in the access rule is assigned the QoS Class defined for the rule, and
the QoS class is used as the matching criteria for applying QoS Policy rules.
QoS Policy
A set of rules for Bandwidth Management and Traffic Prioritization for traffic that has a particular
QoS Class, or rules for assigning QoS Classes based on a DSCP Match found in the traffic.
R
Refragmentation
A technique to fragment outbound packets from the firewall in the same manner in which they
were fragmented when the firewall received them. See also Virtual Defragmentation
(page 1053).
Refuse Action
An Access Rule parameter that blocks the packet that matches the rule and sends an error
message to the originator of the packet. Confer to Discard Action (page 1032).
Regular Expression
A string that describes a set of strings. Used in many text editors and utilities to search for text
patterns and, for example, replace them with some other string. In StoneGate, regular
expressions are used, for example, for defining patterns in traffic that you want a certain
Situation to match when you give the Situation a Context that calls for a Regular Expression.
Related Connection
A connection that has a relationship to another connection defined by a Service. For example,
the FTP protocol defines a relationship between a control connection, and one or more data
connections at the application level. The firewall may be required to allow a connection that
would otherwise be discarded, if it is related to an already allowed connection.
Request for Comments (RFC)
A document that outlines a proposed standard for a protocol. RFCs define how the protocol
should function, and are developed by working groups of the Internet Engineering Task Force
(IETF), and reviewed and approved by the Internet Engineering Steering Group (IESG). See
http://www.rfc-editor.org/.
Glossary 1045
Retained License
A Management Bound License that has been used to install a policy on an engine and has then
been unbound without relicensing or deleting the engine the license was bound to. Retained
licenses cannot be bound to any engine before the engine the license was previously bound to
is deleted or has a new policy refresh with a valid license.
RFC
See Request for Comments (RFC).
Rootkit
A set of tools that intruders to computer systems use for hiding their presence and the traces of
their actions.
Route
The set of routers or gateways a packet travels through in order to reach its destination. In TCP/
IP networks, individual packets for a connection may travel through different routes to reach the
destination host.
Router
A Network Element representing a physical router in your network. Most often used to indicate
next-hop routers in the Routing view and in Network Diagrams.
Routing Table
A database maintained on every router and gateway with information on paths to different
networks. In StoneGate, the routing table is represented graphically in the Routing view.
Rule
An expression used to define the eventual outcome of packets arriving at the firewall, which
match certain conditions (e.g., source and destination address, protocol, user).
Rules Tree
The main configuration tool for adjusting Inspection Rule definitions.
S
SA (Security Association)
See Security Association (SA) (page 1047).
Scan
See Network Scan (page 1042).
Secondary IP address
An IP address used for identifying an element with multiple addresses as a source or
destination of traffic, defined in addition to a primary IP address.
Secondary Log Server
A Log Server defined as a backup channel for components that primarily send their logs to some
other Log Server.
1046 Glossary
Secondary Management Server
A redundant Management Server that replicates the configuration data from the Primary
Management Server under normal conditions so that the services offered by the Management
Server can be used without interruption if components fail or are otherwise unavailable.
Secret Key Cryptography
See Symmetric Encryption (page 1050).
Security Association (SA)
A unidirectional, logical connection established for securing Virtual Private Network (VPN)
communications between two sites. A security association records the information required by
one site to support one direction of the IPsec connection whether inbound or outbound. It uses
transport mode for communications between two hosts and tunnel mode for communication
between security gateways. See also Authentication Header (AH) (page 1028).
Security Gateway (SGW)
A device, typically a firewall, that performs encryption/decryption on Virtual Private Network
(VPN) packets sent between Sites through untrusted networks.
Security Parameter Index (SPI)
A value used by AH and ESP protocols to help the firewall cluster select the security association
that will process an incoming packet. See also Authentication Header (AH) (page 1028).
Security Policy
The set of templates, policies, and sub-policies together or individually that define what traffic is
acceptable and what traffic is unwanted. Policies are defined using the Management Client,
stored on the Management Server and installed on firewalls, sensors, and analyzers, which then
use their installed version of the policies to determine the appropriate action to take regarding
packets in the network.
Sensor
A StoneGate IPS component that captures all the traffic from a physical network link, inspects it
according to its policy, and if installed inline, selects which connections are allowed to continue.
Provides data for the Analyzer (see Analyzer (page 1027)).
Sensor Cluster
Group of two or more IPS Sensor nodes that work together as if they were a single Sensor.
Server
1) A Network Element representing a physical server in your network. Generally, server elements
are only defined to configure a specific server for use with the Management Center (such as a
RADIUS server used for authenticating administrators), but generic Servers can be used in
Network Diagrams instead of Host elements to better illustrate the network layout.
2) In a client-server architecture, a computer that is dedicated for running services used by
Client computers. The services may include, for example, file storage, e-mail, or web pages.
Server Pool
A Network Element representing a group of Servers. Used for inbound traffic management.
Glossary 1047
Server Protection Credentials
An element that stores the private key and certificate of an internal HTTPS server. The private
key and certificate allow the engine to present itself as the server to clients so that the engine
can decrypt and inspect incoming HTTPS traffic. Also see Client Protection Certificate Authority
(page 1030).
Service
An Element that is used for matching traffic to an application level protocol, for example, FTP,
HTTP or SMTP. The TCP and UDP Services also determine the port number. Service elements are
used in policies to make the rule match only a particular protocol, to enable Protocol Agents,
and select traffic to be matched against Inspection Rules.
Session Stealing
See IP Splicing (or Hijacking) (page 1038).
SHA-1
A cryptographic algorithm used for hash functions. It generates a 160-bit signature from an
input of any length. See also Hash Signature (page 1036).
Single Firewall
A firewall that has only one Firewall Engine.
Single Point of Failure
The point at which the failure of a single device or component of a system will lead to either the
failure of the entire system, or the inability to use services normally provided by that system.
Redundant systems, using high availability technologies, eliminate single points of failure.
Site
A set of resources protected by StoneGate.
Situation
1) An Element that identifies and describes detected events in the traffic or in the operation of
the system. Situations contain the Context information, i.e., a pattern that the system is to look
for in the inspected traffic.
2) An Inspection Rule cell where Situation elements are inserted.
Situation Type
A category of Tags for Situations. Meant for indicating what kind of events the associated
Situations detect (for example, Attacks, Suspicious Traffic).
Sniffer
A device or program that captures data traveling over a network. Sniffers are often used for
troubleshooting network problems, as they can show the packet flow taking place. They can also
be used maliciously to steal data off a network.
SNMP Agent
A software component that sends SNMP traps when specific events are encountered.
1048 Glossary
Social Engineering
An attack involving trickery or deception for the purpose of manipulating people into performing
actions or divulging confidential information.
SOHO Firewall
A Small Office/Home Office Firewall appliance with WLAN (Wireless Local Area Network)
features and an integrated ADSL modem to provide small remote site or home office users
access to the main company network through a wired or wireless connection.
SPI (Security Parameter Index)
See Security Parameter Index (SPI) (page 1047).
SSH (Secure Shell)
A program to log into another computer over a network, to execute commands in a remote
machine, and to move files from one machine to another. It provides strong authentication and
secure communications over insecure channels. Often used as a replacement for insecure
programs such as telnet or rsh. In StoneGate, SSH can be used for remotely accessing the
engine command line.
SSL VPN
A VPN technology that utilizes SSL encryption to secure users’ remote access to specific
applications. Allow authenticated users to establish secure connections to a limited number of
specific internal services through a standard web browser (“clientless” access) or through a
client application that allows a wider range of services.
Standby Management Server
See Secondary Management Server (page 1047).
Standby Mode
An operating state of a StoneGate cluster that keeps one node online and the rest in standby,
so that State Synchronization is done, but node does not process the traffic. If the online node
is taken offline or fails, one of the standby nodes takes over the existing connections.
State Synchronization
The communication of connection tracking information between several firewall nodes in a
cluster. Can be either a full synchronization, where all connection tracking information is
transferred to the other nodes of a cluster, or an incremental synchronization, where only the
information on connections changed after the last synchronization are transferred. See also
Connection Tracking (page 1030).
Static IP address
IP address that is typed in by a user or an administrator, and which does not change without
their action.
Static NAT
NAT (Network Address Translation) where for each original address, there is a single, predefined
translated address.
Glossary 1049
Static Routing
A form of routing that has permanent routes between networks programmed into every Routing
Table.
Sub-Policy
A set of rules that are separated from the main policy, based on some common category, such
as the service or the destination IP address. In this way, related rules can be grouped together
to make the entire policy easier to understand. Because subrules are only processed if the
general rule in the main policy matches, the overall processing time is improved.
Subtunnel
The actual tunnels that are combined logically within a multi-route VPN tunnel in a StoneGate
Multi-Link environment. They represent all possible routes that connect the end-points of the
security gateways between which a Virtual Private Network (VPN) is formed. The individual
subtunnels may connect the two gateways through different network links.
Symmetric Encryption
An Encryption mechanism that uses the same shared secret key for encrypting and decrypting
messages. It is often referred to as symmetric bulk encryption since it processes large amounts
of data rather quickly. Also known as conventional or secret key cryptography. There are two
main types of symmetric encryption algorithms, bulk and stream encryption (also known as
block ciphers and stream ciphers). Common symmetric algorithms are DES and 3DES. See also
Asymmetric Encryption (page 1027).
Syslog
A standard protocol for exchanging logs between network components. Defined in RFC 5424.
System Summary
A panel in the System Status view that provides a general summary view of the current status of
the monitored elements according to the component type.
T
Tag
An Element for organizing Situations. Tags can also be used in Inspection Rules, in the Situation
cell, to represent all Situations marked with that Tag.
Takeover Period
The time interval during which the active nodes in a firewall or sensor cluster collaborate to
redistribute the work load of a failed node.
Task
An Element that allows you to schedule commands to run automatically at a convenient time.
Template Policy
A combination of rules and Insert Points, which is used as a basis when creating policies or
other template policies. Policies and template policies created from a particular template policy
then inherit all the rules from that template policy and any of the template policies higher up in
1050 Glossary
the inheritance hierarchy. The Inherited Rules cannot be edited within the inheriting policy. Used,
for example, by high-privilege Administrators to restrict changes administrators with a lower
Administrator Role can make to rules.
Temporary Filter
A log filter that is created from details of entries in the Logs View or the Connections view, and
which is only available until the view is closed.
Terminate Action
An Inspection Rule parameter that stops or attempts to stop the connection matching to the
rule according to the Action Option selected and the whether the Engine where the rule matching
occurs is capable of stopping the connection.
Tester
A tool that can automatically run tests on StoneGate engines to check system or network
operation and take action based on the results of those tests.
Timeline
A tool in the Logs View that allows you to select and change the time range for the logs that are
displayed.
ToS Flag
A data field in IP packet headers that provides a number representing the type of the service the
packet is a part of. The ToS flag is used for Traffic Prioritization and is also know as DSCP
(DiffServ Code Point).
Traffic Handler
The set of Network Elements used for inbound and outbound traffic management. Includes
NetLinks, Outbound Multi-links, and Server Pools.
Traffic Management
The control, definition, and management of how packets or connections should flow through
firewalls, routers, network links, VPNs or other gateway objects, based on load balancing,
clusters, availability of links and more.
Traffic Prioritization
The process of assigning traffic a priority value, which is used to determine the order in which
queued packets are sent forward, overriding the standard first-come-first-served operation of
network devices. Used for assuring Quality of Service (QoS) for time-critical connections. Can be
used together with Bandwidth Management or on its own. See also DSCP (DiffServ Code Point)
(page 1032), QoS Class (page 1045) and QoS Policy (page 1045).
Transparent Access Control Mode
A Sensor configuration in which the Sensor examines Ethernet traffic according to the Ethernet
Rules.
Transparent Proxy
A technique whereby a connection is routed to a proxy server, which then establishes a second
connection to the original destination host, but the entire transaction takes place without
notifying the user, or requiring the user to perform any additional actions.
Glossary 1051
Transport Protocol
Any protocol that communicates and functions on the transport layer of the TCP/IP protocol
stack. These protocols function above the network layer, and are usually responsible for error
correction, quality of service, and other characteristics not handled by the network layer. TCP,
UDP, and IPsec are common examples of transport protocols.
Tunneling
A technology that enables one network to send its data through another, perhaps dissimilar,
network. Tunneling works by encapsulating, or packaging, a network protocol within packets
carried by the second network.
U
Use IPsec VPN Action
A firewall Access Rule parameter that directs traffic matching to the rule to a VPN. Can be either
an Apply VPN Action or an Enforce VPN Action.
UDP Tracking
Information maintained by the firewall engines to group together UDP requests and replies,
handling them as a single virtual connection. See also Virtual Connection Tracking (page 1052).
User
An Element that defines an end-user in your network. Used for defining Authentication with or
without Client-to-Gateway VPN access. Confer to Administrator (page 1025).
User Response
Defines additional notification actions for rule matches, such as redirecting access to a
forbidden URL to a page on an internal web server instead.
UTM (Unified Threat Management)
A device that combines different types of traffic filtering in one physical appliance. The features
offered in a UTM device vary greatly from vendor to vendor. The StoneGate UTM comprises a
firewall, deep packet inspection (IDS), and antivirus.
V
Virtual Adapter
A component of the StoneGate VPN Client, or a third-party VPN client, that allows using a
second, Virtual IP address for Virtual Private Network (VPN) traffic. Shown as a network adapter
in the operating system.
Virtual Connection Tracking
A superset of UDP tracking, ICMP tracking, etc. A technology that is used by the firewall engines
for connectionless network protocols like UDP and ICMP. The firewall engines keep track of
virtual connections by grouping together packets that are related, based on information in the
packet headers. See also Related Connection (page 1045).
1052 Glossary
Virtual Defragmentation
A procedure in which incoming packet fragments are collected. The packet is defragmented for
processing by the firewall engine, and refragmented before it is transmitted again. See also
Fragmentation (page 1035).
Virtual IP address
A second IP address that is given to a VPN Client that has a Virtual Adapter enabled, and that is
connecting to a security gateway using Client-to-Gateway VPN. A virtual IP address enables the
use of certain services that require the client to have an IP address belonging to a specific
address range, while enabling it to retain its primary IP address for maintaining other
connections. The Virtual IP address for StoneGate VPN Clients is always assigned by DHCP
(Dynamic Host Configuration Protocol).
Virtual Local Area Network (VLAN)
A local area network which is defined through software in a switch or other networking device,
rather than by the more traditional hardware division.
Virtual Private Network (VPN)
Refers to a confidential connection that is established through unsecured networks by the
means of authentication, encryption, and integrity checking. The two major VPN technologies
are IPsec (IP Security), which is better suited when a wide variety of network services and large
traffic volumes are involved, and SSL VPN, which is used to provide access to a limited number
of services to individual users without client-side device configuration.
VPN Client
Software that can be used to establish a Virtual Private Network (VPN) with a VPN gateway
device to securely access remote resources over insecure networks.
VPN Profile
An element that defines the IPsec (IP Security)-related settings for one or more VPNs.
Vulnerability
An IPS element that contains information on a publicly known flaw that affects security of some
system. Vulnerabilities are attached to Situations to provide you more information on what has
happened when the Situation matches.
W
Web Filtering
A feature that compares the URLs that users attempt to open to a list of URLs to prevent users
from intentionally or accidentally accessing most web sites that are objectionable or potentially
harmful.
Web Portal
Browser-based service that allows users to view logs, Policy Snapshots, and reports.
Whitelisting
The process of exempting specific traffic from being blocked by Blacklisting or Web Filtering.
Glossary 1053
1054 Glossary
I NDEX
Numerics with granted elements, 220
3DES , 738 ADSL interfaces
changing ISP settings for, 363
defining for SOHO firewalls, 367
A advanced settings , 416, 418
access control lists analyzers, 416
creating, 217 cluster mode, 419, 429
in engine properties, 408 default termination option for sensors, 428
predefined, 221 firewalls, 416
access rules heartbeat traffic, 419
blacklisting, 522 modifying, 416
creating and modifying, 518 node state synchronization, 420
creating from logs, 143 sensor-analyzers, 416
deep inspection, 527 sensors, 416
firewall traffic handling options, 523 agents , 579
for CIS redirection, 674 for server pool monitoring, 471
for HTTPS inspection, 668 for SNMP, 432
hits, 515 aggressive mode , 737
logging options, 528 AH , 738
response options, 527, 528 alert browser, see logs view
validity time, 555 alert channels , 233, 242
acknowledging alerts , 240 alert entry fields , 980
action field , 1000 alert server , 278
active directory servers , 627 alert trace entry fields , 980
authentication settings, 629 alerts
LDAP settings, 628 acknowledging, 240
active VPN tunnels , 747 channels, 236
address range element , 563 custom, 231
administrative domains, see domains default alert, 231
administrator accounts event traces, 129
access control lists, 217 on engine status, 193
administrator element, 218 policies, 238
creating, 218 redirecting chains, 237
deleting, 227 system, 231
domains, 221 test, 231
getting started, 214 testing, 244
granted elements, 220 threshold to block, 236
log colors, 222 aliases , 943
password policy, 223 DHCP, 363
password strength, 225 network element, 564
passwords, changing, 226 system aliases, 944
permission levels, 220 translation values, 412
RADIUS authentication, 226 user aliases, system-defined, 944
troubleshooting, 853 allow SA to any network , 739, 741
administrator messaging , 52 analyzers
administrator permissions command line tools, 201
descriptions, 216 creating element for, 318
in engine properties, 408 editing properties of, 336
administrator roles network interfaces, 377
creating, 215 timeout for failover to backup analyzer, 427
in engine properties, 408 troubleshooting, 875
predefined, 221 announcements , 266
using, 220 anti-clogging settings , 778
Index 1055
anti-replay window , 739 browser-based access , 256
antispoofing
disabling, 455 C
for routable IP addresses, 456
CA (certificate authority) for HTTPS inspection , 662
modifying, 454
CA (certificate authority) for VPNs , 726, 742, 756, 757
anti-virus , 417, 424
capture interfaces , 381
application portal , 322
category filters , 72
apply NAT rules option , 743
activating, 73
archiving log data , 802
combining, 74
ARP (address resolution protocol) , 387
creating, 72
audit entry fields , 981
category-based web filtering , 652
audit entry types , 1010
central gateways, in VPNs , 745
auditing , 105, 157, 812
certificate cache settings , 778
authentication
certificates , 870
groups, defining, 638
automated node certificate renewal, 417, 427, 428
LDAP, 626
checking expiration for VPN, 108, 766
RADIUS, 226
expiration, 868
servers, 635
for VPN authentication, 756
users, 623, 640
renewing engine certificates, 871
authentication services , 637
renewing log server certificates, 870
auto recovery , 399
renewing management server certificates, 870
automated node certificate renewal , 417, 427, 428 troubleshooting, 867
automatic blacklisting , 681, 682
VPN certificate expiry, 765
automatic reboot , 417
VPN certificate renewing, 763
certifying log server , 278
B changing administrator passwords , 226
background templates for PDFs , 51 changing IP addresses of SMC components , 304
backups , 793 changing platform , 304
automating, 817 channels for alerts , 233, 236
creating, 795 CHAP , 629
deleting, 795 charts , 38, 92
files, 794 checking file integrity , 835, 841
restoring, 796 checking status using tests , 398
restoring across management servers, 299 checking version
types of, 795 engines, 840
balancing cluster mode , 419, 429 management center, 834
base DN , 628 CIS (content inspection server)
basic routing , 441 access rules for, 674
between operation , 163 element, defining, 671
blacklist snapshots , 99 inspected services, 671
comparing, 101 NAT rules for CIS redirection, 675
exporting, 100 redirecting traffic to, 669, 670
opening, 100 services for, 672, 673
blacklisting , 677 classes for traffic , 617, 618
automatic, 681, 682 client protect certificate authorities , 659
firewall rules, 680 exporting certificates, 662
getting started with, 678 generating certificates, 661
in access rules, 522 importing certificates, 660
in inspection rules, 682 client security checks , 741
manually, 198 client-to-gateway VPNs , 701, 716, 718, 727
monitoring, 97 authentication settings for, 740
snapshots of, 99 creating certificates for, 761
blacklisting URLs , 653 hub configuration, 772
bookmarks , 41 NAT in, 786
boot recovery , 399 relaying DHCP requests in, 788
1056 Index
virtual IP addresses, 787 corporate interfaces , 364, 370
closing connections manually , 198 correlations , 597, 602
cluster virtual IP addresses , 356 event compress, 603
clusters event count, 604
cluster virtual IP addresses, 356 event group, 604
disabling nodes, 195 event match, 605
node dedicated IP addresses, 356 event sequence, 606
re-enabling nodes, 196 counting rule hits , 515
setting mode for, 429 create multiple SOHO firewalls , 316
setting operating mode for, 419 CRLs (certificate revocation lists)
CN , 628 for HTTPS inspection, 664
CN authentication , 741 for VPN certificates, 757
code for ICMP , 575 current events mode , 137
color selection for logs , 141 custom
column selection in logs , 139 alerts, 231
combined sensor-analyzer situations, 597
creating element for, 321 customer service , 24
combined sensor-analyzers CVI (cluster virtual IP address) , 356
editing properties of, 339
command line D
accessing on engines, 202
data collection tab , 180
command line tools , 917
data filters , 160
commanding engines , 190
creating, 162
commands
examples of, 161
engine, 926
organizing, 164
log server, 918
using, 165
management server, 918
database password , 303
comments in rules , 513
date field resolvers , 118
communications between components , 59
DDNS (dynamic domain name service)
configuration data, encryption of , 417
defining DNS server element, 491
conflicting element resolving at import , 76
defining DNS update information, 492
connecting engines to SMC , 392
defining dynamic DNS rule, 493
connection states , 1016
for inbound load balancing, 490
connection timeouts , 419
security, 490
connections
DDoS (distributed denial of service) , 525
blacklisting manually, 198
deactivating tests , 405
monitoring, 97
decreasing log text size , 139
snapshots of, 99
deep inspection
terminating manually, 198
in IPS access rules, 527
connections snapshots , 99
default
comparing, 101
alert, 231
exporting, 100
basic routes, 441
opening, 100
connection timeouts, 419
connectivity diagrams , 168
firewall policy template, 499
contact addresses , 60
policy template, 499, 560
defining, 62
termination option for sensors, 428
firewall clusters, 356
defining
contact node timeout , 416
backup tasks, 817
contact policy , 423
custom situations, 597
context options
domain logos, 248
for correlation situations, 602
domains, 247
for situations, 599
dynamic IP for firewall, 362
controlling engines
ethernet rules, 516
on command line, 201
ethernet services, 577
rebooting, 191
filters, 160
state changes, 189, 201
Index 1057
MAC address elements, 518 disabling
policy refresh tasks, 818 anti-replay window in VPNs, 739
policy upload tasks, 818 sites in VPNs, 746
remote upgrade tasks, 819, 820 distinguished name , 628
routing, 453 distributing web start clients from web server , 272
server pools, 469 DNS (domain name service) , 367
services, 574 DNS addresses
tasks, 815 searching, 48
tests, 398 DNS resolving in logs , 140
deflate compression, for VPNs , 739 documentation available , 23
defragmentation, virtual , 418 domain logos , 248
deleting domains
administrator accounts, 227 announcement tab, 266
bookmarks, 41 creating, 247
domains, 250 deleting, 250
elements, 79 domain overview, 252
log data, 802, 805 getting started, 246
report tasks, 155 logging in to, 249
DES , 738 logging out of, 250
destination cache , 464 logos for, 248
destination IP address , 562 moving elements between, 250
details arrangement in logs , 131 shared domain, 246
DHCP , 388 DoS (denial of service) , 525
aliases, 363 DSAP , 577
element, 446 DSCP , 616
index, 363 duplicating engine elements , 323
relay, 447, 788 dynamic firewall IP addresses , 362
server for SOHO firewalls, 317 dynamic update packages , 209, 210, 845
DHCP relay dynamic updates , 209, 210, 845
sub-policies, 447
diagnostics logging , 193 E
diagrams , 167
elements
arranging selected elements, 172
address ranges, 563
background images, 169
administrators, 218
changing detail level, 175
aliases, 564
changing the background color, 169
categories, 72
collapsing clusters or groups of elements, 175
certificate authority, 757
connectivity, 168
domains
creating
expressions, 565
automatically from configured elements, 172
filtering out from view, 72
connecting elements, 173
firewall (single), 361
from new elements, 170
links between diagrams, 174
gateway profiles, 718
manually, 171
gateway settings, 774
turning points, 173
groups, 567
exporting, 176
hosts, 568
getting started with, 168
importing and exporting, 75
IP, 168
incident case, 177
modifying layout, 172
locations, 61
printing, 176
locking, 79
specifying parent diagrams for, 174
networks, 569
VPN, 168
outbound multi-link, 461
zooming, 176
routers, 570
diffie-hellman , 739
sites, 729
diffserv code point , 616
SNMP agent, 432
1058 Index
tasks, 813 upgrading, 210
unlocking, 79 equal to operation , 163
user groups, 637 error messages , 857
users, 637 ESP , 738
VPN, 742 ethernet rules
VPN profiles, 734 defining, 516
web portal users, 260 ethernet services , 573, 577
encapsulating VPN traffic , 725 event compress , 603
encryption key length , 776 event count , 604
encryption of configuration data , 417 event field , 1000
end-points event group , 604
contact addresses for external end-points, 68 event match , 605
external, 724 event sequence , 606
internal, 722 event traces, alert , 129
endpoint-to-endpoint tunnels , 746 event visualization panel in logs , 129
engine certificates, renewing , 871 exceptions in inspection rules , 535
engines excluding log server from reporting , 906
activating SNMP agent on, 435 expired certificates , 868
alias translations for, 411 exporting
anti-virus, 417, 424 diagrams, 176
automatic reboot, 417 elements, 75
changing control IP address, 331 filters, 284
to different network, 332 log data, 141, 809
within same network, 331 to syslog, 282
changing passwords, 194 logs, 141
command line tools, 201 reports as PDF, 156
commands, 190 reports as text, 156
contact addresses for, 62 to syslog, 282
creating elements for, 313 users, 645
duplicating elements for, 323 expression element , 565
editing configurations, 196 external
FIPS mode, 417 authentication servers, 634
firewall contact policy, 419 LDAP servers, 626
getting started with, 312 SOHO firewall interface, 364
granted policies, 409 SOHO firewall interfaces, 366
locations, 62 test type, 400
log compression, 426 VPN endpoints, 724
log spooling, 426 external LDAP
modifying, 323 schema files, 974
operating state changes, 189, 201 external security gateways, in VPNs , 692
permissions, 408
policy handshake, 417 F
policy routing, 418
facility field , 997
rebooting, 191
false by comparison/filter , 162
reconfiguring basic settings, 203
field resolvers , 113, 117
refreshing current policy, 192
fields panel in logs , 129, 133
restoring previous configuration, 205
file system space test , 400
rollback timeout, 417
filter types , 164
scripts for, 204
filtering web pages , 652
standby, 191
filters
SYN flood protection, 425
applying, 165
tests, 400
category filters, 72
time synchronization, 340
creating, 162
troubleshooting, 875
defining, 160
turning offline, 191
examples of, 161
turning online, 190
Index 1059
for elements in view, 72 forgotten passwords , 854
getting started with, 160 forwarding settings, for VPNs , 745, 746
in query panel, 134 fragmented packets , 418
load balancing, 421 free swap space test , 400
organizing, 164 FTP protocol agent , 580
specifying filter types, 165 full sync , 420
finding
DNS addresses, 48 G
IP addresses, 47
gateway profiles, for VPNs , 718
users, 46, 49
gateway settings , 774
fingerprint of certificates , 924
anti-clogging, 778
fingerprint syntax , 947
assigning to engines, 779
FIPS , 417
certificate cache, 778
firewall clusters
general, 776
adding nodes to, 330
negotiation retry, 777
contact addresses, 356
gateway-to-gateway tunnels , 746
creating element for, 314
gateway-to-gateway VPNs , 688, 692, 716, 718
disabling nodes, 195
generating licenses , 824
editing properties of, 334
geolocation , 103
IP addresses, 356
go offline command , 191
re-enabling nodes, 196
go online command , 190
firewall interfaces
granted elements , 220
advanced properties, 349
granularity of SAs , 739, 741
configuring, 343
GRE , 575, 582, 901
firewall log fields , 982
group element , 567
firewalls
grouping services , 578
adding nodes to cluster, 330
GroupObjectClass , 632
ADSL interfaces, 348
guarantees for traffic , 616
blacklisting rules, 680
guest interfaces , 364, 372
clusters, 361
clustering options, 419
command line tools, 201 H
contact policy, 419, 423 H.323 protocol agent , 582
creating element for clustered, 314 hairpin NAT , 546
creating element for single, 313 hardware requirements , 24
default policy template, 499 heartbeat traffic , 419
DHCP, 388 hex panel in logs , 129
editing configurations, 196 history of log data management , 812
editing properties of clustered, 334 hits in access rules , 515
editing properties of single, 333 host element , 568
getting started with, 56 HTML tags in announcements , 266
HTTPS inspection, 665 HTTP protocol agent , 583
interface options, 361 HTTPS for Web Portal , 258
load charts, 38, 92 HTTPS inspection
modem interfaces, 358 access rules, 668
network interfaces, 343 client protect certificate authority, 659
offline mode, 191 client protection, 656, 659, 660, 661, 662
online mode, 190 HTTPS inspection exceptions, 666
physical interfaces, 344 in engine properties, 665
policies, 497 limitations, 656
rebooting, 191 security considerations, 656
single, 361 server protection, 656, 658
standby mode, 191 services for, 667
troubleshooting, 875 trusted certificate authorities, 663
VLAN interfaces, 346 trusted certificate authority, 662, 663, 664
font size in logs , 139 HTTPS protocol agent , 583
1060 Index
hub configuration for VPNs , 772 interfaces
hub configuration, for VPNs , 709 ADSL, 348
hybrid authentication , 741 analyzers, 377
capture, 381
I firewall clusters, 356
inline, 383
IAS , 629
link speed setting, 621
ICMP , 575
logical, 380
ICMP service groups , 578
QoS policy setting, 621
icon display in logs , 140
reset, 381
ID in rules , 513
sensor-analyzers, 377
ID value, in VPN end-points , 724
sensors, 377
IGMP-based multicast forwarding , 447
single firewalls, 351
IKE (internet key exchange) settings , 735
SOHO firewalls, 364
importing
speed, 621
elements, 75
VLAN, 346, 384
licenses, 824
internal security gateways, in VPNs , 688
resolving conflicting elements, 76
internal VPN endpoints , 722
users, 644
IP addresses
in operation , 163
defining, 562
inbound load balancing
dynamic firewall addresses, 362
creating rules for, 489
using DDNS updates, 490
resolving in logs, 140
inbound traffic management
searching, 47
single firewalls, 351
incident cases , 177
virtual, 787
attaching information to, 180
IP diagrams , 168
changing priority, 184
IP protocols , 575
changing state, 185
IP-proto service groups , 578
creating, 179
IPS
editing, 184
blacklisting, 681
incident history, 185
incident history, checking , 185
policies, 497
incr sync , 420
system communications interfaces, 378
increasing log text size , 139
system template, 499
initial configuration , 392, 393, 395, 396
inline interfaces , 383
IPS log fields , 984
inline pair link speed test , 400
IPS recording logs fields , 996
insert points in template policies , 498
IPsec (internet protocol security) , 716
inspecting tunneled traffic , 429
IPsec settings (phase 2) , 737
inspection rules
iptables , 124
blacklisting, 682
IPv4 encapsulation protocol agent , 584
creating from logs, 143
IPv6 access rules
editing, 531
creating from logs, 143
exceptions, 535
IPv6 encapsulation protocol agent , 585
logging in exceptions, 543
IPX , 577
logging in rules tree, 533
is defined operation , 163
protocol, 536
rules tree, 511, 531
severity, 536 J
installation directory , 837 java web start , 269, 270
installation files
creating CD-ROMs, 836 K
installing
kay-value pairs , 116
policies, 501
keep IPsec tunnels alive, on SOHO firewalls , 372
key-value pairs , 113
Index 1061
L disabling, 808
LDAP immediate discard filters, 807
configuring schema files, 627 log server
external, 626 certifying, 278
GroupObjectClass, 632 changing IP address of, 304
server elements, 629 log server certificates, renewing , 870
user services, 628, 631 log spooling , 418, 426
UserObjectClass, 632 log storage selection in logs view , 136
LDAP (Lightweight Directory Access Protocol) logging options in inspection exceptions , 543
schema updates, 974 logging options in inspection rules tree , 533
length of encryption key , 776 logging profiles , 113, 114
licenses , 824 logical interfaces
automatic upgrades, 210 in engine properties, 380
generating, 824, 826 logos for domains , 248
importing, 824 logs
maintenance contract information, 107, 211 action field values, 1000
retained type, 829, 830 additional payload, 1015
support level information, 107, 211 alert entry fields, 980
troubleshooting, 879 alert trace entry fields, 980
upgrading, 824 attaching to incident cases, 143
limits for traffic , 616 audit entry fields, 981
link speed , 621 connection states, 1016
link status test , 400 creating rules from, 143
LLC , 577 event field values, 1000
load balancing exporting, 141
filter, 421 filtering in the logs view, 134
inbound firewall log fields, 982
creating NAT rules for, 489 for VPNs, 753
creating rules for, 489 IPS log fields, 984
using DDNS updates, 490 IPS recording log fields, 996
outbound, 459 log field values, 976
creating NAT rules for, 465 non-exportable log fields, 976
getting started with, 460 SSL VPN log fields, 997
load charts , 38, 92 syslog entries, 1014
local management server , 302 troubleshooting, 883
local security checks , 741 VPN log messages, 1005
locations logs view
creating, 61 colors, 141
getting started with, 60 column selection, 139
selecting for management clients, 69 create rule action, 143
lock offline command , 191 current events mode, 137
lock online command , 190 details, 131
log colors, customizing , 222 filtering logs in, 134
log compression , 349, 418, 426 opening, 128
log data , 127, 799 query, 134
analyzing, 282 records arrangement, 128
archiving, 802 resolving details, 140
attaching to incident cases, 180 retrieving traffic recordings from, 142
clean-up operations, 800 senders, 136
deleting, 802, 805 sorting entries, 138
exporting, 141, 809 statistics, 132
to syslog, 282 storage, 136
filtering, 160 text size, 139
managing, 800, 802, 805, 807, 809, 812 time zone, 139
pruning, 807 timeline, 137
log pruning , 807
1062 Index
M hairpin, 546
MAC address elements , 518 pool for VPN clients, 786
MAC addresses , 387 troubleshooting, 894
MAC type , 577 with VPNs, 743
main mode , 737 NDI (node dedicated IP address) , 356
maintenance contract information , 107, 211 negotiation mode , 737
managed units , 825 negotiation retry , 777
management center NetBIOS protocol agent , 586
changing platform, 304 NetLinks
reconfiguring, 301 adding probe IP addresses, 443
management clients adding to outbound Multi-Link elements, 463
locations, 69 changing the state of, 195
troubleshooting, 887 creating, 443
web start, 269, 273 destination cache settings, 464
management databases status icons, 90
changing password, 303 system communications, 70
synchronizing, 298 network elements , 562
management server certificates, renewing , 870 address ranges, 563
management servers , 302 aliases, 564
announcement tab, 266 categories, 72
changing active, 297 deleting, 79
changing IP address of, 304 expressions, 565
database synchronization, 298 filtering out from view, 72
manual blacklisting , 198 firewall (single), 361
manual CRL server , 758 firewall clusters, 361
max packet size for DHCP requests , 788 groups, 567
messages to administrators , 52 hosts, 568
MIBs , 120, 432 networks, 569
mirrored SSL VPN appliances , 322 outbound multi-link, 461
mobile VPN , 781 references, searching, 46
modem interfaces , 358 removing, 79
changing PIN code, 360 routers, 570
monitoring , 83 network interface configuration , 341
connections or blacklisting, 97 network interfaces , 377
status of external devices, 119 ADSL, 348
third-party devices, 111 analyzers, 377
user authentication, 649 capture, 381
VPNs, 753 configuring, 341
moving elements between domains , 250 firewall clusters, 356
MSRPC protocol agent , 585 firewalls, 343
MTU for VPNs , 740 inline, 383
multi-link , 459, 746 logical, 380
monitoring, 90 reset, 381
NAT, 70 sensor-analyzers, 377
routing, 442 sensors, 377
system communications, 70 single firewalls, 351
VPN tunnels, 747 VLAN, 346, 384
multiping test , 400 network models, see diagrams
multi-valued field resolvers , 118 network protocols , 573
network security policies , 497
NIC index changed logs , 903
N node dedicated IP addresses , 356
NAS , 629 nodes
NAT (network address translation) , 465, 489 adding to firewall cluster, 330
contact addresses for system components, 60 adding to sensor cluster, 330
for VPNs, 752 automated certificate renewal, 417, 427, 428
Index 1063
automatic reboot, 417 for firewalls, 344
converting single node to cluster, 325 sensor-analyzers, 377
synchronization of connections, 420 sensors, 377
non-decrypted domains , 666 play button in logs , 137
non-exportable log fields , 976 player list tab , 183
NPS , 629 policies , 510
NTP (Network Time Protocol) , 340 alert, 238
server for SOHO firewalls, 315, 317 creating, 499
null algorithm , 738 default template, 499, 560
number of IKE SAs , 776 deleting, 507
editing, 511
O finding unused rules, 515
firewall, 497
OCSP , 758
installing and updating, 501
OIDs , 120
IPS, 497
one-time password , 393, 395, 396
QoS, 616, 617, 618
operating states , 189, 201
refreshing, 192, 818
operations in filters , 163
searching for rules, 514
oracle protocol agent , 587
switching templates, 506
ordered fields , 113, 115
template policies, 498, 499
OU , 628
uploading, 818
outbound multi-link elements , 461
validating, 556
outbound traffic management , 459
policy editing view , 511
policy handshake , 417
monitoring, 466
policy routing , 418, 451
testing, 466
policy snapshots, attaching to incident cases, 181
overall topology of VPNs , 744
policy validation , 556
overrides , 535
excluding issues for rules, 559
overrides in inspection , 532
excluding rules, 559
overviews
issues, 558
domain overview, 252
selecting issues for rules, 557
statistical, 38, 92
port resolving in logs , 140
port scan detection , 600
P ports , 573, 575
PAP , 629 PPPoE , 354, 367
parent diagrams , 174 PPTP , 901
password pre-defined aliases , 944
changing, 226 pre-shared keys in VPNs , 747, 773
for management database, 303 printing diagrams , 176
password policy , 223 priorities for traffic , 616
enabling, 224 probing , 119
enforcing, 224 probing NetLinks , 443
password strength, 225 probing profiles , 121
passwords product sales , 25
forgotten, 854 profiles for VPNs , 734
troubleshooting, 853 program number , 575
path MTU discovery , 740 protocol agents
PCAP , 142 for CIS redirection, 670
PDF style templates , 51 FTP, 580
perfect forward secrecy , 739 GRE, 582
permission levels , 220 H.323, 582
phase 1 settings , 735 HTTP, 583
phase 2 settings , 737 HTTPS, 583
physical interfaces IPv4 encapsulation, 584
analyzers, 377 IPv6 encapsulation, 585
for firewall clusters, 356 MSRPC, 585
1064 Index
NetBIOS, 586 e-mailing, 156, 157
oracle, 587 excluding log servers, 906
shell, 588 exporting, 156
SIP, 589 exporting as PDF, 156
SMTP, 590 exporting as text, 156
SSH, 590 generating, 152
SunRPC, 591 getting started, 146
TCP proxy, 592 tasks, 153, 155
TFTP, 593 troubleshooting, 906
protocols , 573, 574 viewing, 155
agents, 579 requirements for running stonegate , 24
tags, 579 reset interfaces , 381
proxy identity , 746 resolving log details , 140
pruning log data , 807 restrict virtual address ranges , 788
restricting network traffic , 497
Q retained licenses , 829, 830
retry settings for gateways , 777
QoS (quality of service) , 615
rollback timeout , 417
classes, 617, 618
router element , 570
getting started, 616
routing
policies, 617, 618
checking routes, 456
policy setting, 621
configuration, 440
query panel , 129
creating NetLinks, 443
filters, 134
default route
overview, 134
with multi-link, 442
senders, 136
with single link, 441
storage, 136
DHCP messages, 445
for IPS components, 453
R getting started, 440
RADIUS authentication IGMP-based multicast forwarding, 447
for administrator accounts, 226 multi-link, 442
for end-users, 635 policy routing, 451
reactivating tests , 405 removing routes, 454
rebooting engines , 191 static IP multicast, 447
reconfiguring management center , 301 view, 440
record response recordings, retrieving , 142 RPC program number , 575
records arrangement , 128 RSH protocol agent , 588
recovery , 399 rule counters , 515
redirecting alert chains , 237 rule ID and tag , 513
referenced elements , 46 rule searches , 514
references panel in the logs view , 131 rules tree in inspection rules , 511, 531
refreshing policies , 501, 818 running tasks, aborting , 822
regular expression syntax , 947
relaying DHCP requests of VPN clients , 788
S
remote engine upgrades , 210
SA per host/net , 739, 741
remote shell protocol agent , 588
sales information , 25
remote upgrades , 819, 820, 833, 841
satellite gateways, in VPNs , 745
removing
saving the initial configuration , 393, 395, 396
elements, 79
scan started event , 600
tests, 405
scheduled tasks , 820
renewing engine certificates , 871
removing from schedule, 821
renewing log server certificates , 870
starting, 821
renewing management server certificates , 870
suspending, 821
reports , 145
data sources, 154
designs, 148
Index 1065
scripts management server, 302
for automatic tester, 400 web portal server, 257
for engines, 204 server pool monitoring agents , 471
searching configuring, 474
for DNS addresses, 48 DNS setup, 488
for IP addresses, 47 enabling, 488
for users, 46, 49 installing, 472
secondary log servers internal tests, 483
installing, 293 monitoring, 493
selecting, 277 sgagent.conf, 475
secondary management server installation , 288 sgagent.local.conf, 474
security considerations for HTTPS inspection , 656 testing, 493
security policies , 497 uninstalling, 473
senders in the logs view , 136 server pools
sensor clusters adding members, 471
adding nodes to, 330 defining, 469
creating element for, 320 external addresses, 470
disabling nodes, 195 servers
re-enabling nodes, 196 contact addresses, 67
sensor-analyzers , 377 locations, 67
creating element for, 321 services , 573, 574
editing properties of, 339 custom services, 575
sensors ethernet-level, 577
adding nodes to cluster, 330 for CIS, 672, 673
bypass traffic on overload, 428 for HTTPS inspection, 667
capture interfaces, 381 groups of, 578
command line tools, 201 IP-based, 575
creating element for, 319 severity , 239, 536, 598
default termination option, 428 sgagent.conf , 475
defining VLAN ID, 385 sgagent.local.conf , 474
editing configurations, 196 shared bookmarks , 41
editing properties of clustered, 338 shared domain , 246
editing properties of single, 337 shell protocol agent , 588
HTTPS inspection, 665 show records , 133
inline interfaces, 383 show summary column , 139
limit for rematching tunneled traffic, 429 signing external certificate requests , 761
logical interfaces, 380 single firewalls
network interfaces, 377 creating element for, 313
offline mode, 191 editing properties of, 333
online mode, 190 IP addresses, 351
rebooting, 191 SIP protocol agent , 589
reset interfaces, 381 sites in , 729
silent drop for duplicate log events, 428 situation types , 534
standby mode, 191 situations , 595, 597
traffic inspection interfaces, 379 context options, 599, 602
troubleshooting, 875 getting started with, 596
server contact addresses , 67 website access control, 600, 653
server elements SMTP protocol agent , 590
active directory servers, 627 SNAP , 577
alert server, 278 snapshots
authentication servers, 635 of connections or blacklists, 99
CIS, 671 SNMP , 400, 432
DDNS, defining, 491 SNMP port , 124
DHCP, 446 SNMP reception , 119
external authentication servers, 634 SNOOP , 142
LDAP servers, 629 SOHO firewalls
1066 Index
ADSL or PPPoE interface, 367 SunRPC protocol agent , 591
ADSL settings, 368 support level information , 107, 211
corporate interfaces, 370 support services , 24
creating multiple, 316 SYN flood protection , 349, 417, 425
creating one at a time, 315 synchronization of connection state , 420
DNS, 367 syslog , 322, 1014
editing properties of, 335 receiving, 113
ethernet external interfaces, 366 syslog port , 124
external interfaces, 366 syslog servers , 282
guest interfaces, 372 system alert , 231
interfaces, 364 system aliases , 944
RADIUS authentication, 635 system communications , 59
reopen delay, 430 contact addresses, 60
saving initial configuration, 395 IPS interfaces for, 378
wireless access settings, 373 locations, 60
source IP address , 562 multi-link, 70
spokes in VPNs , 709 NAT, 60
SQL*Net , 587 NetLinks, 70
SSAP , 577 system report , 157
SSH access to engines , 194 system requirements , 24
SSH protocol agent , 590 system-defined user aliases , 944
SSL VPN , 322
application portal, 322 T
connecting gateway to SMC, 396
tag in rules , 513
saving initial configuration for, 396
tags , 579, 595, 596
SSL VPN log fields , 997
task elements , 813
standby
archive log task, 802, 815
cluster mode, 419, 429
backup task, 815, 817
engine command, 191
defining, 815
VPN tunnels, 747
delete log tasks, 805
starting scheduled tasks , 821
delete logs task, 815
state synchronization , 420
export log task, 815
static IP multicast routing, defining , 447 export log tasks, 809
statistics , 38, 92
policy refresh task, 815, 818
statistics in the logs view , 132
policy upload task, 815, 818
status monitoring , 83, 192
remote upgrade task, 815, 819, 820
status surveillance , 125, 193
running tasks, 822
stonegate VPN client , 727, 781
scheduled tasks, 820, 821
authentication settings for, 740
sgInfo task, 815
creating certificates for, 761
task status panel in logs , 129
relaying DHCP requests of, 788
tasks
storage selection in logs view , 136
create snapshot of all system elements task, 815
strength of passwords , 225
delete old executed tasks, 815
strict connection tracking , 418
delete old snapshots task, 815
style templates
disable unused administrator accounts task, 816
adding, 51
refresh certificate revocation lists task, 816
deleting, 52
renew gateway certificates task, 816
sub-policies , 498, 521
renew internal certificate authorities task, 816
creating, 500
renew internal certificates task, 816
deleting, 507
synchronize management server databases task, 816
DHCP
upload gateway and certificate authority certificates task,
sub-policy, 447
816
summary column in logs , 139
TCP connection timeouts , 419
summary panel in logs , 129
TCP ports , 575
sun RPC , 575
TCP proxy protocol agent , 592
sun RPC service groups , 578
Index 1067
TCP service groups , 578 logging, 883
technical support , 24 management client, 887
template policies , 498, 499 management connections with engines, 307
creating, 499 NAT, 894
deleting, 507 passwords, 853
insert points, 498 reporting, 906
switching, 506 rules, 900
temporary log entries , 137 upgrades, 909
terminating connections manually , 198 VPNs, 911
test alert , 231 web start, 891
tester , 398 true by filter , 162
testing trusted CA , 726, 742
alerts, 244 trusted certificate authorities
user authentication, 649 certificates, 663
tests CRL (certificate revocation lists), 664
deactivating, 405 for HTTPS inspection, 662
reactivating, 405 tuning
removing, 405 heartbeat traffic, 419
text size in logs , 139 load balancing, 421
TFTP protocol agent , 593 tunnel recovery , 776
third-party device monitoring , 111 tunneled traffic , 429
threshold to block , 236 tunnels for VPNs , 746
time zone in logs view , 139 tunnels in VPNs , 744
timeline , 137 type field , 999
timeout type for ICMP , 575
connections, 419 type for SNAP , 577
contact between management and node, 416 Type-Ahead Search , 49
TNS , 587
tools profile , 53 U
topology of VPNs , 744
UDP connection timeouts , 419
ToS fields , 616
UDP encapsulation , 725
traffic charts , 38, 92
UDP ports , 575
traffic classification , 617, 618
UDP service groups , 578
traffic handling configuration , 510
UID , 628
traffic inspection interfaces for sensors , 379
undefined value policy , 162
traffic management
unit in licensing , 825
inbound
unknown engine status alerts , 193
creating NAT rules for, 489
update packages , 209, 845
outbound, 459
activating, 847
creating NAT rules for, 465
importing, 846
upgrades
traffic recordings
engine upgrades, 210
retrieving, 142
remote engine upgrades, 210, 841
transient logs , 137
remote upgrades, 841
traps, SNMP , 432
troubleshooting
upgrading , 841
accounts, 853
engine upgrades, 833
alerts, 857
licenses, 824
certificates, 867
management system, 836
engine operation, 875
remote engine upgrades, 841
error messages, 857
remote upgrades, 833, 841
firewall policy installation, 898
remotely, 819, 820
general troubleshooting tips, 851
uploading policies , 818
IPS policy installation, 900
URL filtering , 652
licenses, 879
use PFS , 739
log messages, 857
1068 Index
user aliases, system-defined , 944 client address management, 787
user authentication , 623 client settings, 727
access rules, defining, 642 client-to-gateway, 701, 716, 727, 740
dialog, customizing, 648 configuring, 718
getting started, 624 defining pre-shared keys for, 747
groups, defining, 638 deflate compression for, 739
monitoring, 649 diffie-hellman, 739
testing, 649 element for, 742
users, defining, 640 enabling NAT for, 743
user database replication , 646 error codes, 1009
user groups , 637 error messages, 1007
user responses , 611 excluding sites from, 746
creating, 612 external end-points in, 724
in access rules, 527, 528 external security gateways in, 692
user response entries, 613 forwarding settings for, 745, 746
user services , 628, 631 gateway profiles for, 718
UserObjectClass , 632 gateway settings, 774
users , 637 gateway-to-gateway, 688, 692, 716
adding, 644 generating pre-shared keys for, 773
authentication, 647 granting access to new hosts in, 771
authentication settings, clearing, 646 granularity of SAs in, 739, 741
exporting, 645 hub configuration, 772
importing, 644 hub configuration for, 709
passwords, 646 ID value in end-points, 724
removing, 644 IKE (phase 1) settings for, 735
searching, 46, 49 internal end-points for, 722
UTM , 417, 424 internal security gateways in, 688
IPsec (phase 2) settings for, 737
V keepalive for SOHO tunnels, 372
local security checks for, 741
validating policies , 556
log messages, 1005
validity for VPNs , 747
logs for, 753
vendor for SNAP , 577
monitoring, 753
verbose logging , 193
multi-link for, 746, 747
version of RPC , 575
NAT for clients in, 786
virtual adapter , 727, 728, 787
NAT rules for, 752
virtual defragmentation , 418
negotiation mode in, 737
virtual IP addresses , 787
negotiation retry, 777
virus scanning , 424
notification messages, 1005
VLAN ID, defining for sensors , 385
null encryption in, 738
VLANs, defining for firewalls , 346
overview, 756
VPN clients , 781
path MTU discovery for, 740
PFS in, 739
IP addresses, 785
profiles for, 734
settings in management client, 783
proxy identities for, 746
VPN diagrams , 168
reconfiguring, 767
VPNs , 715, 729
removing tunnels, 768
adding tunnels, 768
satellite gateways in, 745
anti-clogging, 778
signing external certificate requests, 761
anti-replay window in, 739
topology of, 744
basic configuration of, 687
central gateways in, 745
trusted CA for, 726, 742
certificate cache, 778
tunnels for, 746
certificate expiry checking, 765
tunnels in, 744
certificate renewal in, 763
UDP encapsulation for, 725
certificates for, 756
user aliases, 944
Index 1069
validity for, 747
virtual adapter for VPN clients, 727
VRRP , 353
vulnerabilities , 595, 596, 597
W
watchlist , 133
web filtering , 652
web portal , 256
announcements, 266
encrypting communications, 258
server, 257
users, 260
web start , 269, 270
distribution from stonegate servers, 271
distribution from web server, 272
website access control , 600, 653
white engine status , 192
whitelisting URLs , 653
wireless LAN , 373
1070 Index
StoneGate Guides
Administrator’s Guides - step-by-step instructions for configuring and managing the system.
Installation Guides - step-by-step instructions for installing and upgrading the system.
Reference Guides - system and feature descriptions with overviews to configuration tasks.
User's Guides - step-by-step instructions for end-users.
For more documentation, visit

www.stonesoft.com/support/
Stonesoft Corporation Stonesoft Inc.

Itälahdenkatu 22 A 1050 Crown Pointe Parkway
FI-00210 Helsinki Suite 900
Finland Atlanta, GA 30338
USA
Tel. +358 9 476 711 Tel. +1 770 668 1125
Fax +358 9 4767 1349 Fax +1 770 668 1131
Copyright 2010 Stonesoft Corporation. All rights reserved. All specifications are subject to change.

StoneGate Administrators Guide v5-2

Uploaded by

Document Informationclick to expand document information

Copyright:

Available Formats

StoneGate Administrators Guide v5-2

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

StoneGate Administrators Guide v5-2

Uploaded by

Copyright:

Available Formats

STONEGATE 5.

Third Party Licenses

U.S. Government Acquisitions

Product Export Restrictions

General Terms and Conditions of Support and Maintenance Services

Trademarks and Patents

G ETTING S TARTED Other Changes in Firewall/VPN 5.2 . . . . . . . . . 31

Using the Management Client - 35

Setting up the System - 55

Configuring System Communications - 59

USING STONEGATE DOCUMENTATION

The following sections are included:

Objectives and Audience (page 22)

Table 1.1 Typographical Conventions

Formatting Informative Uses

Interface elements (buttons, menus, etc.) and any other

Cross-references and first use of acronyms and terms are

File names, directories, and text displayed on the screen

User input User input on screen is monospaced bold-face.

Command parameter names are in monospaced

We use the following ways to indicate important or additional information:

22 Chapter 1 Using StoneGate Documentation

Table 1.2 Product Documentation

Instructions for planning, installing, and upgrading a StoneGate

Describes how to configure and manage the system step-by-step.

Describes how to configure and manage the system step-by-step.

Instructions for end-users. Available for the StoneGate IPsec VPN

24 Chapter 1 Using StoneGate Documentation

The following sections are included:

Important Changes (page 28)

VPNs: End of Support for Legacy UDP Encapsulation

SMC: End of Support for Legacy VPN Clients

Other Changes in SMC 5.2.2

Automatic Update Proxy Server Authentication

Disable Connection Synchronization

28 Chapter 2 What’s New?

Color Selection for Comment Rules

Connections and Blacklist Snapshots

Custom Backup Import for Demo Mode Installations

Editing Logic Changes in the Policy Editor

Element Import Enhancements

Inspection Rule Configuration Reworked

Integrated MIB Browsing Tool

Other Changes in SMC 5.2 29

New Search Tools

Save and Browse Logs as Zip Archives

Simpler Alert Severity Scale

Third-Party Device Monitoring Improvements

VPN Troubleshooting Shortcuts

30 Chapter 2 What’s New?

64-Bit Software Version

Aggregated Network Links

Concurrent Connection Rate Limits

IPv6 Support on Single Firewalls

IGMP Policy Routing

Integrated DHCP Server on Clusters

Rule Hit Counters for NAT Rules

Other Changes in Firewall/VPN 5.2 31

64-Bit Software Version