Security Log, 293 | Kerio Tech Firewall6 specs

20.11 Security Log

•192.168.64.64 — IP address of the client (i.e. of the host from which the client is connected to the website)

•TCP_MISS — the TCP protocol was used and the particular object was not found in the cache (“missed”). WinRoute always uses this value for this ﬁeld.

•304 — return code of the HTTP protocol

•0 — transferred data amount in bytes (HTTP object size)

•GET http://www.squid-cache.org/— the HTTP request (HTTP method and URL of the object)

•DIRECT — the WWW server access method (WinRoute always uses DIRECT access)

•206.168.0.9 — IP address of the WWW server

20.11 Security Log

A log for security-related messages. Records of the following types may appear in the log:

1.Anti-spooﬁng log records

Messages about packets that where captured by the Anti-spooﬁngmodule (packets with invalid source IP address — see section 15.2 for details)

Example:

[17/Jul/2003 11:46:38] Anti-Spoofing: Packet from LAN, proto:TCP, len:48, ip/port:61.173.81.166:1864 -> 195.39.55.10:445,

flags: SYN , seq:3819654104 ack:0, win:16384, tcplen:0

•packet from — packet direction (either from, i.e. sent via the interface, or to, i.e. received via the interface)

•LAN — interface name (see chapter 5.1 for details)

•proto: — transport protocol (TCP, UDP, etc.)

•len: — packet size in bytes (including the headers) in bytes

•ip/port: — source IP address, source port, destination IP address and destina- tion port

293

Image 293

Kerio Tech Firewall6 manual Security Log, 293

Contents

Kerio Technologies Administrator’s GuidePage Contents 113 Remote Administration and Update Checks 209 Kerio Clientless SSL-VPN 355 393 Quick Checklist Page Kerio WinRoute Firewall Basic FeaturesIntroduction Kerio WinRoute Firewall Additional Features Transparent support for Active Directory Antivirus controlEmail alerts User quotas Clientless SSL-VPN Conﬂicting softwareCollision of low-level drivers Port collision Antivirus applications Installation InstallationSteps to be taken before the installation System requirements Installation and Basic Conﬁguration Guide Custom installation selecting optional components Protection of the installed product Conﬂicting Applications and System Services WinRoute Engine Monitor WinRoute ComponentsWinRoute Firewall Engine WinRoute Engine Monitor Kerio Administration ConsoleWinRoute Engine Monitor Upgrade and Uninstallation Typically the path C\Program Files\Kerio\WinRoute Firewall Upgrade and UninstallationUninstallation Update Checker Upgrade from WinRoute ProSetting of administration username and password Conﬁguration Wizard Remote IP address Remote AccessEnable remote access Initial conﬁguration Allowing remote administration Administration Window WinRoute Administration Administration Window Main menu WinRoute AdministrationFile Help menu Detection of WinRoute Firewall Engine connection drop-out Administration WindowStatus bar Column customization in Interfaces View Settings View Settings License types optional components Product Registration and LicensingLicense types and number of users Deciding on a number of users licenses License types and number of users Product License informationCopyright Homepage Subscription expiration date License IDProduct expiration date Number of users Registration of the trial version Registration of the product in the Administration Console Trial version registration security code Registration of the product in the Administration Console Trial version registration other information Trial version registration Trial ID Registration of the purchased product Product Registration and Licensing Registration of the product in the Administration Console 10 Product registration user information 12 Product registration summary Update of registration information Product registration at the website Subscription / Update Expiration Bubble alerts Subscription / Update Expiration 15 The notice that the subscription has already expired User counter License counter User counterStart WinRoute License release Network interfaces Settings for Interfaces and Network ServicesInterface IP Address and Mask Adapter info Dial or Hang Up /Enebale, DisableAdd Modify Special interfaces RefreshDial-In VPN server Interface type selection Bind this interface Use the following login data Use login data from the RAS entryInterface name RAS Entry Dial-up demand dial Connection Advanced Hangup if idle Edit Interface parameters Connection Failover Enable automatic connection failover Connection Failover SetupConnection Failover Current connection Conﬁguration of primary and secondary Internet connection Dial-up Use Primary connectionSecondary connection DNS Forwarder conﬁguration DNS Forwarder DNS forwarding Enable DNS forwardingDNS Forwarder Enable DNS forwarding Enable cache for faster response of repeated queriesClear cache Use custom forwarding 10 Speciﬁc settings of DNS forwarding 11 DNS forwarding a new rule Simple DNS resolution Combine the name ... with DNS domain Before forwarding a query Dhcp server Deﬁnition of Scopes and Reservations Dhcp serverDhcp Server Conﬁguration DNS server Lease timeWins server Domain 15 Dhcp server IP scopes deﬁnition Description Exclusions First address, Last addressSubnet mask Parameters 00bca5f21e50 Lease Reservations Leases Bc-a5-f2-1e-50 20 Dhcp server list of leased and reserved IP addresses Windows RAS Dhcp server advanced options Declined options Proxy server Proxy Server Conﬁguration Enable non-transparent proxy serverProxy server 22 Http proxy server settings Enable connection to any TCP port Http//192.168.1.13128/pac/proxy.pac Forward to parent proxy server Enable cache on proxy server Enable cache on transparent proxyHttp cache Http protocol TTL Cache size Http cache Cache Options Memory cache sizeMax Http object size URL URL Speciﬁc Settings TTL Cache status and administration 26 Http cache administration dialog Network Rules Wizard Traﬃc Policy Selection of Internet connection type Network Rules WizardInformation Network Policy Wizard selection of a connected adapter Network adapter or dial-up selection Allow access to all services Internet access limitations Enabling Kerio VPN traﬃc Allow access to the following services only Service Service is running on Generating the rules NAT Icmp traﬃc Rules Created by the Wizard Local Traﬃc Firewall Traﬃc Name How traﬃc rules workDeﬁnition of Custom Traﬃc Rules 12 Traﬃc rule name, color and rule description Source, Destination IP range e.g Deﬁnition of Custom Traﬃc Rules 100 Service 101 Action 102 Log 103 Translation 20 Traﬃc rule destination address translation 104 105 Valid onProtocol inspector IP Translation NAT Basic Traﬃc Rule TypesSource Destination Placing the rule TranslationPort mapping 107 108 109 Limiting Internet AccessMultihoming 110 111 Exclusions 112 Speed limits for big data volumes transmissions How the bandwidth limiter works and how to use itBandwidth Limiter Speed limits for users with their quota exceeded Bandwidth Limiter conﬁguration Setting limit valuesBandwidth Limiter 114 115 ServicesAdvanced Options 116 IP Addresses and Time Interval 117 Bandwidth Limiter selection of network services 118 Detection of connections with large data volume transferred 119 Detection of connections with large data volume transferredExamples 120 121 User AuthenticationFirewall User Authentication 122 User AuthenticationUser authentication advanced options Redirection to the authentication Firewall User AuthenticationEnable non-transparent proxy server authentication Automatic authentication Ntlm 124 Automatically logout users when they are inactive Enable Web Interface Http Enable Kerio SSL-VPN serverWeb Interface Web Interface Parameters Conﬁguration Allow access only from these IP addresses Enable secured Web Interface HttpsWeb Interface WinRoute server name 127 Conﬁguration of ports of the Web Interface 128 SSL Certiﬁcate for the Web InterfaceGenerate or Import Certiﬁcate SSL certiﬁcate of WinRoute’s Web interface 129 Web Interface Language Preferences Login/logoutUsers logged 130 131 Login/logoutDrdolittle@usoffice.company.com 132 User password authenticationLog out 133 Status information and user statisticsStatus information and user statistics 134 User preferences 135 Save settingsUser preferences 136 10 Editing user password 137 Http protocolFTP protocol 138 Conditions for Http and FTP ﬁlteringURL Rules 139 URL Rules 140 URL Rules Deﬁnition 141 If user accessing the URL isURL matches criteria 142 Allow access to the Web site Valid for IP address group Valid at time intervalValid if Mime type is Denial options Scan content for viruses according to scanning rules WWW content scanning optionsDeny Web pages containing 144 145 Http Inspection Advanced Options Allow Html ActiveX objects Global rules for Web elementsAllow Script Html tags 146 Allow Html JavaScript pop-up windows Content Rating System ISS OrangeWeb FilterAllow applet Html tags Allow cross-domain referrer 148 ISS OrangeWeb Filter conﬁguration Categorize each page regardless of Http rules Enable ISS OrangeWeb FilterServer ISS OrangeWeb Filter Deployment ISS OrangeWeb Filter rule 150 151 Web content ﬁltering by word occurrence 152 Deﬁnition of rules ﬁltering by word occurrence 153 Word groups 154 Deﬁnition of forbidden words FTP Policy WeightGroup Keyword FTP Rules Deﬁnition If user accessing the FTP server isFTP server is 156 15 FTP Rule basic parameters 158 Content 159 160 Antivirus controlConditions and limitations of antivirus scan 161 Conditions and limitations of antivirus scan Antivirus control How to choose and setup antivirusesIntegrated McAfee 162 Last update check performed ... ago Check for update every ... hoursUpdate now Current virus database is 164 Antivirus settingsExternal antivirus An example of a traﬃc rule for outgoing Smtp traﬃc check 165 Http and FTP scanning 167 Http and FTP scanning 168 Http and FTP scanning rulesCondition 169 Mime type 170 Email scanning 171 Email scanning 172 173 IP Address GroupsCreating and Editing IP Address Groups Deﬁnitions Time IntervalsName Type Absolute Time range typesWeekly Daily From, To Time Interval TypeValid at days 176 177 ServicesServices 178 ProtocolProtocol inspector 179 Source Port and Destination PortProtocol Inspectors 180 URL Groups 181 URL Groups 182 Deﬁnitions Group Internal user database User Accounts and GroupsImport of user accounts from Active Directory 183 184 Viewing and deﬁnitions of user accountsUser Accounts and Groups Local user accounts Accounts mapped from the Active Directory domain Local user accountsEdit User 186 Creating a local user account Local user accountsBasic information Full Name Account is disabled AuthenticationEmail Address Domain template 189 NT domain / KerberosGroups 190 Access rights Read only access to administration No access to administrationFull access to administration User can override WWW content rules 192 Data transmission quotaTransfer quota 193 Content rulesQuota exceed action 194 User’s IP addresses 195 Editing User Account 196 Active DirectoryNT domain 197 Automatic import of user accounts from Active Directory 198 Manual import of user accounts Active Directory domains mapping Active Directory domains mappingDomain mapping requirements 199 Single domain mapping Domain AccessActive Directory mapping 200 13 Active Directory domain mapping 201 202 NT authentication supportMultiple domains mapping 16 Conversion of user accounts 203 204 User groupsUser groups Deﬁnitions Creating a new local user group User groupsName and description of the group 205 Read only access Group access rightsGroup members 206 207 Users can override WWW content rulesUsers can connect using VPN 208 Users are allowed to use P2P networksUsers are allowed to view statistics Setting Remote Administration Remote Administration and Update ChecksHow to allow remote administration from the Internet 209 210 Update CheckingRemote Administration and Update Checks Check for new versions Update CheckingCheck also for beta versions Check now 212 15.1 P2P Eliminator Advanced security featuresP2P Eliminator Conﬁguration 213 214 Advanced security features 215 15.1 P2P EliminatorParameters for detection of P2P networks 216 Special Security Settings Anti-Spooﬁng Special Security SettingsConnections Count Limit 217 Enable VPN using IPSec ProtocolEnable pass-through only for hosts IPSec preferences WinRoute’s IPSec conﬁguration VPN using IPSec ProtocolIPSec client in local network 219 Traﬃc rule for one IPSec client in the local network 220 221 IPSec server in local network Routing table Other settings Route Types Routing tableStatic routes 223 Network, Network Mask Deﬁnitions of Dynamic and Static RulesGateway Metric Demand Dial Demand DialRemoving routes from the Routing Table How demand dial works 226 227 Technical Peculiarities and Limitations 228 Setting Rules for Demand Dial 229 Dial of local DNS names Port mapping timeout Enable UPnPUniversal Plug-and-Play UPnP Conﬁguration of the UPnP support Relay Smtp server Relay Smtp serverLog packets Log connections Specify sender email address in From header Smtp requires authenticationTest 232 233 234 Status InformationActive hosts and connected users Login duration Login timeHostname User Active Hosts dialog options Detailed information on a selected host and user 238 Traﬃc information 239 Activity DescriptionConnections 240 Source, Destination 241 Histogram 242 Show connections related to the selected process 243 Show connections related to the selected process 244 Options of the Connections DialogKill connection Font Color Color SettingsBackground Color 245 246 Alerts SettingsAlerts 247 AlertsAlert 248 Alert Templates 249 \Program Files\Kerio\WinRoute Firewall\templates by defaultAlerts overview in Administration Console 13 Details of a selected event 250 251 Basic statisticsInterface statistics Basic statistics Reset interface statisticsInterface Statistics menu 252 Remove interface statistics Interface statisticsGraphical view of interface load 253 254 User Statistics data volumes and quotas 255 User Statistics data volumes and quotasUser Statistics dialog options Remove user statistics Reset user statisticsView host 256 257 Kerio StaR statistics and reportingMonitoring and storage of statistic data Kerio StaR statistics and reporting Settings for statistics and quotaRequirements of the statistics 258 Enable/disable gathering of statistic data Settings for statistics and quotaAdvanced settings for statistics 259 260 Statistics and quota restrictions Remote access to the statistics Accessing the statistics from the WinRoute hostConnection to StaR and viewing statistics Statistics and quota accounting periods 262 StaR page in the web interface 263 Accounting period Custom accounting period 264 265 Overall ViewOverall View 266 Top Requested Web CategoriesTop 5 users 267 Used Protocol 268 269 User statisticsUser statistics 13 The Users by Traﬃc table Users by Traﬃc Top Visited Websites Top Visited Websites 272 Top Requested Web Categories 16 Top visited websites sorted by categories 273 274 Logs Log settingsFilename.log 275 276 File Logging 277 Log settingsSyslog Logging Logs Context Menu Find Logs Context MenuHighlighting Select font Log debug Logs EncodingClear log Log highlighting Log highlighting settings 282 Debug log advanced settings Alert Log Alert Log 284 20.4 Conﬁg LogLogs 285 Connection LogConnection Log 286 Debug LogDial Log Page 288 15/Mar/2004 155912 Line Connection disconnected 289 Error LogError Log 290 ’McAfee update’ rule nameFilter Log 291 Http logHttp log 292 1058444114.733 0 192.168.64.64 TCPMISS/304 293 Security LogSecurity Log 294 Authentication service Client IP address reason Sslvpn Log Sslvpn Log17/Dec/2004 121133 Engine Startup 17/Dec/2004 122243 Engine Shutdown 24/Apr/2003 102951 192.168.44.128 james Web Log Web Log 297 298 Kerio VPN 299 VPN Server Conﬁguration Kerio VPN Enable VPN serverGeneral IP address assignment 301 SSL certiﬁcate 302 AdvancedListen on port 303 Custom Routes 304 21.2 Conﬁguration of VPN clientsBasic conﬁguration of traﬃc rules for VPN clients Deﬁnition of a tunnel to a remote server Setting up VPN serversName of the tunnel 305 306 Conﬁguration 307 Conﬁguration of a remote end of the tunnel 308 DNS SettingsRouting settings 309 Connection establishment 310 Traﬃc Policy Settings for VPN Exchange of routing information Exchange of routing informationRouting conﬁguration options 311 312 Update of routing tablesRoutes provided automatically 313 Example of Kerio VPN conﬁguration company with a ﬁlial oﬃceSpeciﬁcation 314 Common method 315 316 Headquarters conﬁguration 317 14 Headquarter creating default traﬃc rules for Kerio VPN 16 Headquarter DNS forwarder conﬁguration 318 319 19 Headquarters VPN server conﬁguration 320 321 LAN 322 Conﬁguration of a ﬁlial oﬃce 323 24 Filial oﬃce default traﬃc rules for Kerio VPN 25 Filial oﬃce DNS forwarder conﬁguration 324 325 28 Filial oﬃce VPN server conﬁguration 326 29 Filial oﬃce deﬁnition of VPN tunnel for the headquarters 327 328 Example of a more complex Kerio VPN conﬁgurationVPN test 329 Common method 330 331 332 33 Headquarter creating default traﬃc rules for Kerio VPN 35 Headquarter DNS forwarder conﬁguration 333 Kerio VPN 38 Headquarters VPN server conﬁguration 335 39 Headquarter deﬁnition of VPN tunnel for the London ﬁlial 336 337 338 43 Headquarter ﬁnal traﬃc rules 339 340 Conﬁguration of the London ﬁlial 341 46 The London ﬁlial oﬃce default traﬃc rules for Kerio VPN 342 48 The London ﬁlial oﬃce DNS forwarding settings 343 344 345 54 The London ﬁlial oﬃce ﬁnal traﬃc rules 346 347 Conﬁguration of the Paris ﬁlial 57 The Paris ﬁlial oﬃce DNS forwarder conﬁguration 348 59 The Paris ﬁlial oﬃce VPN server conﬁguration 349 350 351 352 64 The Paris ﬁlial oﬃce ﬁnal traﬃc rules 353 354 22.1 Conﬁguration of WinRoute’s SSL-VPN Kerio Clientless SSL-VPNSSL-VPN conﬁguration 355 356 Allowing access from the InternetKerio Clientless SSL-VPN Usage of the SSL-VPN interface Usage of the SSL-VPN interfaceHttps//server Https//server12345 358 Sidneywashington@usoffice.company.comHandling ﬁles and folders Antivirus control \\server\folder\subfolderBookmarks 359 360 TroubleshootingDetection of incorrect conﬁguration of the default gateway 23.2 Conﬁguration Backup and Transfer License SslcertCache.CFS Dnscache.cfg 363 Handling conﬁguration ﬁles Conﬁguration backup recoveryStar List name=Interfaces 365 Automatic user authentication using NtlmGeneral conditions 366 WinRoute Conﬁguration Ntlm authentication process Automatic user authentication using NtlmWeb browsers Microsoft Internet Explorer 368 Firefox/Netscape/Mozilla/SeaMonkeyFirefox/Netscape/Mozilla/SeaMonkey conﬁguration 369 Partial Retirement of Protocol InspectorPartial Retirement of Protocol Inspector 370 How to enable certain users to access the InternetUser accounts and groups in traﬃc rules 371 Enabling automatic authentication 372 FTP on WinRoute’s proxy serverExample of a client conﬁguration web browser 373 Example of a client conﬁguration Total CommanderFTP on WinRoute’s proxy server 374 12 Setting proxy server for FTP in Total Commander Basic Information and System Requirements Network Load BalancingNetwork Conﬁguration 375 376 Network Load Balancing 377 24.3 Conﬁguration of the servers in the clusterNLB conﬁguration for Server1 Server 1 cluster parameters 378 379 NLB conﬁguration for Server2 Essential Information Technical supportDescription 380 Tested in Beta version Error Log FilesInformational File License type and license number Czech Republic ContactsUnited Kingdom Legal Presumption Libiconv Used open-source librariesOpenSSL 384 Copyright 2005 Sam Stephenson PrototypeZlib 385 Glossary of terms Default gatewayActiveX Cluster 387 FirewallGreylisting IPSec Glossary of terms IP addressKerberos 388 P2P network Network adapterPacket Port Proxy server Glossary of termsRouting table Script 391 Spooﬁng 392 TCP/IP 393 Index 394 Index 395 Ntlm 396 VPN 397 133