Manuals / Kerio Tech / Computer Equipment / Network Router

Kerio Tech Firewall6 manual File Logging, 276

Models: Firewall6

1 398

Download 398 pages 11.9 Kb

Page 276

Chapter 20 Logs

Figure 20.1 Log settings

File Logging

Use the File Loggingtab to deﬁne ﬁle name and rotation parameters.

Enable logging to ﬁle

Use this option to enable/disable logging to ﬁle according to the File name entry (the .log extension will be appended automatically).

If this option is disabled, none of the following parameters and settings will be available.

Rotate regularly

Set intervals in which the log will be rotated regularly. The ﬁle will be stored and a new log ﬁle will be started in selected intervals.

Rotate when ﬁle exceeds size

Set a maximal size for each ﬁle. Whenever the threshold is reached, the ﬁle will be rotated. Maximal size is speciﬁed in megabytes (MB).

Note: If both Rotate regularly and the Rotate when ﬁle exceeds size are enabled, the particular ﬁle will be rotated whenever one of these conditions is met.

Keep at most ... log ﬁle(s)

Maximal count of log ﬁles that will be stored. Whenever the threshold is reached, the oldest ﬁle will be deleted.

276

Image 276

Kerio Tech Firewall6 manual File Logging, 276

Contents

Administrator’s Guide Kerio TechnologiesPage Contents 113 Remote Administration and Update Checks 209 Kerio Clientless SSL-VPN 355 393 Quick Checklist Page Basic Features IntroductionKerio WinRoute Firewall Additional Features Kerio WinRoute FirewallAntivirus control Transparent support for Active DirectoryEmail alerts User quotasConﬂicting software Clientless SSL-VPNCollision of low-level drivers Port collisionAntivirus applications Installation InstallationSteps to be taken before the installation System requirementsInstallation and Basic Conﬁguration Guide Custom installation selecting optional components Protection of the installed product Conﬂicting Applications and System Services WinRoute Components WinRoute Firewall EngineWinRoute Engine Monitor Kerio Administration Console WinRoute Engine MonitorWinRoute Engine Monitor Upgrade and Uninstallation Upgrade and Uninstallation UninstallationTypically the path C\Program Files\Kerio\WinRoute Firewall Upgrade from WinRoute Pro Update CheckerSetting of administration username and password Conﬁguration WizardRemote Access Enable remote accessRemote IP address Initial conﬁguration Allowing remote administration WinRoute Administration Administration WindowWinRoute Administration Administration Window Main menuFile Help menuAdministration Window Status barDetection of WinRoute Firewall Engine connection drop-out View Settings Column customization in InterfacesView Settings Product Registration and Licensing License types and number of usersLicense types optional components License types and number of users Deciding on a number of users licensesLicense information ProductCopyright HomepageLicense ID Subscription expiration dateProduct expiration date Number of usersRegistration of the product in the Administration Console Registration of the trial versionRegistration of the product in the Administration Console Trial version registration security codeTrial version registration other information Registration of the purchased product Trial version registration Trial IDProduct Registration and Licensing Registration of the product in the Administration Console 10 Product registration user information Update of registration information 12 Product registration summarySubscription / Update Expiration Product registration at the websiteSubscription / Update Expiration Bubble alertsUser counter 15 The notice that the subscription has already expiredUser counter Start WinRouteLicense counter License release Settings for Interfaces and Network Services Network interfacesInterface IP Address and MaskDial or Hang Up /Enebale, Disable Adapter infoAdd ModifyRefresh Special interfacesDial-In VPN serverBind this interface Interface type selectionUse login data from the RAS entry Use the following login dataInterface name RAS EntryConnection Dial-up demand dialHangup if idle AdvancedConnection Failover Edit Interface parametersConnection Failover Setup Enable automatic connection failoverConnection Failover Current connectionConﬁguration of primary and secondary Internet connection Primary connection Secondary connectionDial-up Use DNS Forwarder DNS Forwarder conﬁgurationEnable DNS forwarding DNS ForwarderDNS forwarding Enable cache for faster response of repeated queries Enable DNS forwardingClear cache Use custom forwarding10 Speciﬁc settings of DNS forwarding Simple DNS resolution 11 DNS forwarding a new ruleBefore forwarding a query Combine the name ... with DNS domainDhcp server Dhcp server Dhcp Server ConﬁgurationDeﬁnition of Scopes and Reservations Lease time DNS serverWins server DomainDescription 15 Dhcp server IP scopes deﬁnitionFirst address, Last address Subnet maskExclusions Parameters Lease Reservations 00bca5f21e50Bc-a5-f2-1e-50 Leases20 Dhcp server list of leased and reserved IP addresses Dhcp server advanced options Windows RASProxy server Declined optionsEnable non-transparent proxy server Proxy serverProxy Server Conﬁguration Enable connection to any TCP port 22 Http proxy server settingsForward to parent proxy server Http//192.168.1.13128/pac/proxy.pacEnable cache on transparent proxy Enable cache on proxy serverHttp cache Http protocol TTLHttp cache Cache sizeMemory cache size Max Http object sizeCache Options URL Speciﬁc Settings URLCache status and administration TTL26 Http cache administration dialog Traﬃc Policy Network Rules WizardNetwork Rules Wizard InformationSelection of Internet connection type Network adapter or dial-up selection Network Policy Wizard selection of a connected adapterInternet access limitations Allow access to all servicesAllow access to the following services only Enabling Kerio VPN traﬃcService is running on ServiceNAT Generating the rulesRules Created by the Wizard Icmp traﬃcLocal Traﬃc Firewall Traﬃc How traﬃc rules work Deﬁnition of Custom Traﬃc RulesName Source, Destination 12 Traﬃc rule name, color and rule descriptionIP range e.g Deﬁnition of Custom Traﬃc Rules Service 100Action 101Log 102Translation 103104 20 Traﬃc rule destination address translationValid on Protocol inspector105 Basic Traﬃc Rule Types IP Translation NATSource DestinationTranslation Placing the rulePort mapping 107108 Limiting Internet Access Multihoming109 110 Exclusions 111112 How the bandwidth limiter works and how to use it Speed limits for big data volumes transmissionsBandwidth Limiter Speed limits for users with their quota exceededSetting limit values Bandwidth Limiter conﬁgurationBandwidth Limiter 114Services Advanced Options115 IP Addresses and Time Interval 116Bandwidth Limiter selection of network services 117Detection of connections with large data volume transferred 118Detection of connections with large data volume transferred Examples119 120 User Authentication Firewall User Authentication121 User Authentication User authentication advanced options122 Firewall User Authentication Redirection to the authenticationEnable non-transparent proxy server authentication Automatic authentication NtlmAutomatically logout users when they are inactive 124Enable Kerio SSL-VPN server Enable Web Interface HttpWeb Interface Web Interface Parameters ConﬁgurationEnable secured Web Interface Https Allow access only from these IP addressesWeb Interface WinRoute server nameConﬁguration of ports of the Web Interface 127SSL Certiﬁcate for the Web Interface Generate or Import Certiﬁcate128 129 SSL certiﬁcate of WinRoute’s Web interfaceLogin/logout Web Interface Language PreferencesUsers logged 130Login/logout Drdolittle@usoffice.company.com131 User password authentication Log out132 Status information and user statistics Status information and user statistics133 User preferences 134Save settings User preferences135 10 Editing user password 136Http protocol FTP protocol137 Conditions for Http and FTP ﬁltering URL Rules138 URL Rules 139URL Rules Deﬁnition 140If user accessing the URL is URL matches criteria141 Allow access to the Web site 142Valid at time interval Valid for IP address groupValid if Mime type is Denial optionsWWW content scanning options Scan content for viruses according to scanning rulesDeny Web pages containing 144Http Inspection Advanced Options 145Global rules for Web elements Allow Html ActiveX objectsAllow Script Html tags 146Content Rating System ISS OrangeWeb Filter Allow Html JavaScript pop-up windowsAllow applet Html tags Allow cross-domain referrerISS OrangeWeb Filter conﬁguration 148Enable ISS OrangeWeb Filter Categorize each page regardless of Http rulesServer ISS OrangeWeb Filter Deployment150 ISS OrangeWeb Filter ruleWeb content ﬁltering by word occurrence 151Deﬁnition of rules ﬁltering by word occurrence 152Word groups 153Deﬁnition of forbidden words 154Weight FTP PolicyGroup KeywordIf user accessing the FTP server is FTP Rules DeﬁnitionFTP server is 15615 FTP Rule basic parameters Content 158159 Antivirus control Conditions and limitations of antivirus scan160 Conditions and limitations of antivirus scan 161How to choose and setup antiviruses Antivirus controlIntegrated McAfee 162Check for update every ... hours Last update check performed ... agoUpdate now Current virus database isAntivirus settings External antivirus164 165 An example of a traﬃc rule for outgoing Smtp traﬃc checkHttp and FTP scanning Http and FTP scanning 167Http and FTP scanning rules Condition168 Mime type 169Email scanning 170Email scanning 171172 IP Address Groups Creating and Editing IP Address Groups173 Time Intervals DeﬁnitionsName TypeTime range types AbsoluteWeekly DailyTime Interval Type From, ToValid at days 176Services Services177 Protocol Protocol inspector178 Source Port and Destination Port Protocol Inspectors179 URL Groups 180URL Groups 181Deﬁnitions Group 182User Accounts and Groups Internal user databaseImport of user accounts from Active Directory 183Viewing and deﬁnitions of user accounts User Accounts and Groups184 Local user accounts Local user accounts Accounts mapped from the Active Directory domainEdit User 186Local user accounts Creating a local user accountBasic information Full NameAuthentication Account is disabledEmail Address Domain templateNT domain / Kerberos Groups189 Access rights 190No access to administration Read only access to administrationFull access to administration User can override WWW content rulesData transmission quota Transfer quota192 Content rules Quota exceed action193 User’s IP addresses 194Editing User Account 195Active Directory NT domain196 Automatic import of user accounts from Active Directory 197Manual import of user accounts 198Active Directory domains mapping Active Directory domains mappingDomain mapping requirements 199Domain Access Single domain mappingActive Directory mapping 200201 13 Active Directory domain mappingNT authentication support Multiple domains mapping202 203 16 Conversion of user accountsUser groups User groups Deﬁnitions204 User groups Creating a new local user groupName and description of the group 205Group access rights Read only accessGroup members 206Users can override WWW content rules Users can connect using VPN207 Users are allowed to use P2P networks Users are allowed to view statistics208 Remote Administration and Update Checks Setting Remote AdministrationHow to allow remote administration from the Internet 209Update Checking Remote Administration and Update Checks210 Update Checking Check for new versionsCheck also for beta versions Check now212 Advanced security features 15.1 P2P EliminatorP2P Eliminator Conﬁguration 213Advanced security features 21415.1 P2P Eliminator Parameters for detection of P2P networks215 Special Security Settings 216Special Security Settings Anti-SpooﬁngConnections Count Limit 217VPN using IPSec Protocol EnableEnable pass-through only for hosts IPSec preferencesVPN using IPSec Protocol WinRoute’s IPSec conﬁgurationIPSec client in local network 219220 Traﬃc rule for one IPSec client in the local networkIPSec server in local network 221Other settings Routing tableRouting table Route TypesStatic routes 223Deﬁnitions of Dynamic and Static Rules Network, Network MaskGateway MetricDemand Dial Demand DialRemoving routes from the Routing Table How demand dial works226 Technical Peculiarities and Limitations 227Setting Rules for Demand Dial 228Dial of local DNS names 229Enable UPnP Port mapping timeoutUniversal Plug-and-Play UPnP Conﬁguration of the UPnP supportRelay Smtp server Relay Smtp serverLog packets Log connectionsSmtp requires authentication Specify sender email address in From headerTest 232233 Status Information Active hosts and connected users234 Login time Login durationHostname UserActive Hosts dialog options Detailed information on a selected host and user Traﬃc information 238Activity Description Connections239 Source, Destination 240Histogram 241Show connections related to the selected process 242Show connections related to the selected process 243Options of the Connections Dialog Kill connection244 Color Settings Font ColorBackground Color 245Alerts Settings Alerts246 Alerts Alert247 Alert Templates 248\Program Files\Kerio\WinRoute Firewall\templates by default Alerts overview in Administration Console249 250 13 Details of a selected eventBasic statistics Interface statistics251 Reset interface statistics Basic statisticsInterface Statistics menu 252Interface statistics Remove interface statisticsGraphical view of interface load 253User Statistics data volumes and quotas 254User Statistics data volumes and quotas User Statistics dialog options255 Reset user statistics Remove user statisticsView host 256Kerio StaR statistics and reporting Monitoring and storage of statistic data257 Settings for statistics and quota Kerio StaR statistics and reportingRequirements of the statistics 258Settings for statistics and quota Enable/disable gathering of statistic dataAdvanced settings for statistics 259Statistics and quota restrictions 260Accessing the statistics from the WinRoute host Remote access to the statisticsConnection to StaR and viewing statistics Statistics and quota accounting periodsStaR page in the web interface 262Accounting period 263264 Custom accounting periodOverall View Overall View265 Top Requested Web Categories Top 5 users266 Used Protocol 267268 User statistics User statistics269 Users by Traﬃc 13 The Users by Traﬃc tableTop Visited Websites Top Visited WebsitesTop Requested Web Categories 272273 16 Top visited websites sorted by categories274 Log settings LogsFilename.log 275File Logging 276Log settings Syslog Logging277 Logs Context Menu Logs Context Menu FindHighlighting Select fontLogs Encoding Log debugClear log Log highlightingLog highlighting settings Debug log advanced settings 282Alert Log Alert Log20.4 Conﬁg Log Logs284 Connection Log Connection Log285 Debug Log Dial Log286 Page 15/Mar/2004 155912 Line Connection disconnected 288Error Log Error Log289 ’McAfee update’ rule name Filter Log290 Http log Http log291 1058444114.733 0 192.168.64.64 TCPMISS/304 292Security Log Security Log293 Authentication service Client IP address reason 294Sslvpn Log Sslvpn Log17/Dec/2004 121133 Engine Startup 17/Dec/2004 122243 Engine ShutdownWeb Log 24/Apr/2003 102951 192.168.44.128 jamesWeb Log 297 Kerio VPN 298VPN Server Conﬁguration 299Enable VPN server Kerio VPNGeneral IP address assignmentSSL certiﬁcate 301Advanced Listen on port302 Custom Routes 30321.2 Conﬁguration of VPN clients Basic conﬁguration of traﬃc rules for VPN clients304 Setting up VPN servers Deﬁnition of a tunnel to a remote serverName of the tunnel 305Conﬁguration 306Conﬁguration of a remote end of the tunnel 307DNS Settings Routing settings308 Connection establishment 309Traﬃc Policy Settings for VPN 310Exchange of routing information Exchange of routing informationRouting conﬁguration options 311Update of routing tables Routes provided automatically312 Example of Kerio VPN conﬁguration company with a ﬁlial oﬃce Speciﬁcation313 Common method 314315 Headquarters conﬁguration 31614 Headquarter creating default traﬃc rules for Kerio VPN 317318 16 Headquarter DNS forwarder conﬁguration319 320 19 Headquarters VPN server conﬁgurationLAN 321Conﬁguration of a ﬁlial oﬃce 32224 Filial oﬃce default traﬃc rules for Kerio VPN 323324 25 Filial oﬃce DNS forwarder conﬁguration325 326 28 Filial oﬃce VPN server conﬁguration327 29 Filial oﬃce deﬁnition of VPN tunnel for the headquartersExample of a more complex Kerio VPN conﬁguration VPN test328 Common method 329330 331 33 Headquarter creating default traﬃc rules for Kerio VPN 332333 35 Headquarter DNS forwarder conﬁgurationKerio VPN 335 38 Headquarters VPN server conﬁguration336 39 Headquarter deﬁnition of VPN tunnel for the London ﬁlial337 338 339 43 Headquarter ﬁnal traﬃc rulesConﬁguration of the London ﬁlial 34046 The London ﬁlial oﬃce default traﬃc rules for Kerio VPN 34148 The London ﬁlial oﬃce DNS forwarding settings 342343 344 345 346 54 The London ﬁlial oﬃce ﬁnal traﬃc rulesConﬁguration of the Paris ﬁlial 347348 57 The Paris ﬁlial oﬃce DNS forwarder conﬁguration349 59 The Paris ﬁlial oﬃce VPN server conﬁguration350 351 352 353 64 The Paris ﬁlial oﬃce ﬁnal traﬃc rules354 Kerio Clientless SSL-VPN 22.1 Conﬁguration of WinRoute’s SSL-VPNSSL-VPN conﬁguration 355Allowing access from the Internet Kerio Clientless SSL-VPN356 Usage of the SSL-VPN interface Usage of the SSL-VPN interfaceHttps//server Https//server12345Sidneywashington@usoffice.company.com Handling ﬁles and folders358 \\server\folder\subfolder Antivirus controlBookmarks 359Troubleshooting Detection of incorrect conﬁguration of the default gateway360 23.2 Conﬁguration Backup and Transfer Sslcert LicenseCache.CFS Dnscache.cfgHandling conﬁguration ﬁles Conﬁguration backup recovery Star363 List name=Interfaces Automatic user authentication using Ntlm General conditions365 WinRoute Conﬁguration 366Automatic user authentication using Ntlm Ntlm authentication processWeb browsers Microsoft Internet ExplorerFirefox/Netscape/Mozilla/SeaMonkey Firefox/Netscape/Mozilla/SeaMonkey conﬁguration368 Partial Retirement of Protocol Inspector Partial Retirement of Protocol Inspector369 How to enable certain users to access the Internet User accounts and groups in traﬃc rules370 Enabling automatic authentication 371FTP on WinRoute’s proxy server Example of a client conﬁguration web browser372 Example of a client conﬁguration Total Commander FTP on WinRoute’s proxy server373 12 Setting proxy server for FTP in Total Commander 374Network Load Balancing Basic Information and System RequirementsNetwork Conﬁguration 375Network Load Balancing 37624.3 Conﬁguration of the servers in the cluster NLB conﬁguration for Server1377 378 Server 1 cluster parametersNLB conﬁguration for Server2 379Technical support Essential InformationDescription 380Error Log Files Tested in Beta versionInformational File License type and license numberContacts United KingdomCzech Republic Legal Presumption Used open-source libraries LibiconvOpenSSL 384Prototype Copyright 2005 Sam StephensonZlib 385Default gateway Glossary of termsActiveX ClusterFirewall Greylisting387 Glossary of terms IP address IPSecKerberos 388Network adapter P2P networkPacket PortGlossary of terms Proxy serverRouting table ScriptSpooﬁng 391TCP/IP 392Index 393Index 394Ntlm 395VPN 396133 397