V1.0, January | NETGEAR UTM5-100NAS, UTM50-100NAS manual

ProSecure Unified Threat Management (UTM) Appliance Reference Manual

.

Figure 5-31

Firewall Protection

5-51

v1.0, January 2010

Image 165

NETGEAR UTM5-100NAS, UTM50-100NAS manual V1.0, January

Contents

NETGEAR, Inc Statement of Conditions TrademarksEU Regulatory Compliance Statement Bestätigung des Herstellers/Importeurs Additional Copyrights Voluntary Control Council for Interference Vcci StatementAES Terms MD5 Model Number Product and Publication DetailsPublication Date January Product Family Product Name V1.0, January Contents Dual-WAN Port Models Only Chapter Manually Configuring Internet and WAN Settings Chapter LAN Configuration Chapter Content Filtering and Optimizing Scans Chapter Virtual Private Networking Using SSL Connections Features That Increase Traffic Features That Reduce TrafficUsing QoS and Bandwidth Assignment to Shift the Traffic Mix Changing Passwords and Administrator Settings Configuring Logging, Alerts, and Event Notifications Configuring Date and Time ServiceConfiguring the E-mail Notification Server Configuring and Activating System, E-mail, and Syslog Logs Troubleshooting a TCP/IP Network Using a Ping Utility Troubleshooting the ISP ConnectionTesting the LAN Path to Your UTM Testing the Path from Your PC to a Remote Device Appendix D Two Factor Authentication Xvi Conventions, Formats, and Scope About This Manual How to Print This Manual Revision HistoryPart Number Version Date Description Chapter Introduction Key Features and Capabilities Advanced VPN Support for Both IPsec and SSL Stream Scanning for Content Filtering Powerful, True Firewall Autosensing Ethernet Connections with Auto Uplink Security Features Extensive Protocol Support Easy Installation and Management Maintenance and Support Model ComparisonDifferences Between the UTM Models Deployment Service Registration Card with License Keys Package Contents Front Panel Hardware Features Object Activity Description LED DescriptionsLAN Ports DMZ LED Rear Panel Security lock Console port Reset button AC power ReceptacleBottom Panel With Product Label Receptacle 4shows the product label for the UTM5 6shows the product label for the UTM25 Choosing a Location for the UTM Using the Rack-Mounting Kit V1.0, January Understanding the Steps for Initial Connection Using the Setup Wizard to Provision the UTM in Your Network Qualified Web Browsers Logging In to the UTM V1.0, January V1.0, January Understanding the Web Management Interface Menu Layout V1.0, January Using the Setup Wizard to Perform the Initial Configuration Setup Wizard of 10 LAN Settings Dhcp Setup Wizard LAN Settings Setting Description or Subfield and Description Setting Description or Subfield and Description DNS Proxy Setup Wizard of 10 WAN Settings Setup Wizard WAN Settings Setting Description or Subfield and Description ISP LoginISP Type ISP Internet IP AddressDomain Name Server DNS Servers Get Automatically from ISP radio button Setup Wizard of 10 System Date and Time Adjust for Daylight Savings Time checkbox Setup Wizard System Date and Time Settings Setup Wizard of 10 Services Web Setup Wizard Services SettingsInstant Messaging Peer-to-Peer P2P Setup Wizard of 10 Email Security Setup Wizard Email Security SettingsSetting Description or Subfield and Description Action Scan Exceptions Setup Wizard of 10 Web Security See Performance Management on Setup Wizard Web Security Settings Setup Wizard of 10 Web Categories to Be Blocked Setup Wizard Content Filtering Settings Blocked Categories Scheduled DaysBlocked Categories Time of Day Setup Wizard of 10 Email Notification Setup Wizard Administrator Email Notification SettingsAdministrator Email Notification Settings Setup Wizard of 10 Signatures & Engine Setup Wizard Signatures & Engine Settings Setup Wizard of 10 Saving the ConfigurationUpdate Settings Update Frequency Testing Connectivity Verifying Proper InstallationTesting Http Scanning Registering the UTM with Netgear Click Register What to Do Next Understanding the Internet and WAN Configuration Tasks Manually Configuring Internet and WAN Settings Automatically Detecting and Connecting Configuring the Internet Connections V1.0, January Internet connection methods Connection Method Data RequiredPptp Manually Configuring the Internet Connection Setting the UTM’s MAC Address V1.0, January Pptp and PPPoE Settings Internet IP Address Settings DNS Server Settings Network Address Translation All Models Classical Routing All Models Configuring Auto-Rollover Mode Dual-WAN Port Models Only Setting Description or Subfield and Description Port Mode Auto-Rollover Mode Settings Dual-WAN Port Models Only Configuring the Internet Connections on WAN1WAN2 V1.0, January Using the Services menu see Services-Based Rules on Protocol Binding Settings Dual-WAN Port Models Only Destination Configuring Secondary WAN Addresses V1.0, January Select Network Config Dynamic DNS from the menu Configuring Dynamic DNS V1.0, January WAN2 Dynamic DNS Status DNS Service Settings Configuring Advanced WAN Options Setting Description or Subfield and Description MTU Size Advanced WAN SettingsUse Default Address radio button Port Speed Upload/Download Settings Additional WAN-Related Configuration Tasks Managing Virtual LANs and Dhcp Options Chapter LAN Configuration Managing the UTM’s Port-Based VLANs V1.0, January Dhcp Server Vlan Dhcp Options DNS Proxy Dhcp Relay Ldap Server Configuring a Vlan Profile V1.0, January Vlan ID Vlan Profile SettingsPort Membership Vlan Enable Dhcp Starting IP Inter Vlan Routing Configuring Multi-Home LAN IPs on the Default Vlan Managing Groups and Hosts LAN Groups Managing the Network Database V1.0, January Add Known PCs and Devices Settings Setting Up Address Reservation onAdding PCs or Devices to the Network Database Editing PCs or Devices in the Network Database Changing Group Names in the Network Database Setting Up Address Reservation Configuring and Enabling the DMZ Port V1.0, January DMZ Setup Settings Own LAN IP address as the primary DNS server IP address Managing Routing Configuring Static Routes Static Route Settings Configuring Routing Information Protocol RIP Select Network Configuration Routing from the menu RIP Configuration Settings Authentication for RIP-2B/2MOut Only . Static Route Example V1.0, January About Firewall Protection Chapter Firewall Protection Administrator Tips Using Rules to Block or Allow Specific Kinds of Traffic Services-Based RulesNumber of Supported Firewall Rule Configurations Outbound Rules Service Blocking Outbound Rules Overview Customized Services onTo Block or Allow Specific Traffic on Hosts LAN Groups on NAT IP Inbound Rules Port Forwarding V1.0, January Inbound Rules Overview Hosts LAN Groups on Useful when debugging your rules Order of Precedence for Rules Setting LAN WAN Rules LAN WAN Outbound Services Rules LAN WAN Inbound Services Rules Setting DMZ WAN Rules V1.0, January DMZ WAN Outbound Services Rules DMZ WAN Inbound Services Rules Setting LAN DMZ Rules LAN DMZ Outbound Services Rules LAN DMZ Inbound Services Rules LAN WAN Inbound Rule Hosting a Local Public Web Server Inbound Rules Examples V1.0, January V1.0, January LAN WAN or DMZ WAN Inbound Rule Specifying an Exposed Host LAN WAN Outbound Rule Blocking Instant Messenger Outbound Rules Example Attack Checks Configuring Other Firewall Features Attack Checks Settings L2TP VPN Pass through Setting Session Limits Session Limit Settings Session TimeoutManaging the Application Level Gateway for SIP Sessions Adding Customized Services Creating Services, QoS Profiles, and Bandwidth Profiles V1.0, January TCP Services Settings Creating Quality of Service QoS Profiles V1.0, January Default High Medium High Low QoS Profile Settings Creating Bandwidth Profiles V1.0, January Bandwidth Profile Settings Setting a Schedule to Block or Allow Specific Traffic Enabling Source MAC Filtering V1.0, January Setting up IP/MAC Bindings IP/MAC Binding Settings Event Notifications onIP/MAC Bindings Configuring Port Triggering V1.0, January 10. Port Triggering Settings Using the Intrusion Prevention System V1.0, January V1.0, January 11. IPS Less Familiar Attack Names Attack Name Description or Subfield and Description WebMisc About Content Filtering and Scans Content Filtering and Optimizing Scans Default E-mail and Web Scan Settings Default E-mail and Web Scan Settings Scan Type Default Scan Setting Default Action if applicable Configuring E-mail Protection Customizing E-mail Protocol Scan Settings Customizing E-mail Anti-Virus and Notification Settings E-mail Anti-Virus and Notification Settings Notification SettingsPerformance see Performance Management on Mail Email Alert Settings Mail Content Filtering TIME%, %PROTOCOL%, %FROM%, %TO%, %SUBJECT%FILENAME%, %ACTION%, %VIRUSNAME% V1.0, January Filter by Password-Protected Attachments ZIP, RAR, etc E-mail Filter Settings Protecting Against E-mail Spam Password-Protected Attachments ZIP, RAR, etc. section aboveFilter by File Name Protected Attachments ZIP, RAR, etc. section above Setting Up the Whitelist and Blacklist V1.0, January Whitelist/Blacklist Settings Configuring the Real-time Blacklist V1.0, January Configuring Distributed Spam Analysis Distributed Spam Analysis Settings Anti-Spam Engine Settings Low Medium-LowBlock spam email Customizing Web Protocol Scan Settings and Services Configuring Web and Services Protection Setting Description or Subfield and Description Web Web Protocol, Instant Messaging, and Peer-to-Peer Settings Configuring Web Malware Scans Malware Scan Settings Html Scan Configuring Web Content Filtering V1.0, January Content Filtering, screen 1 10 Content Filtering, screen 2 11 Content Filtering, screen 3 Performance Management on Content Filtering SettingsFull-Text Search Block Web Objects Blocked Categories Scheduled Days Configuring Web URL Filtering URLNetgear V1.0, January URL Filtering Settings Setting Description or Subfield and Description WhitelistBlacklist URL% Https Scan Settings V1.0, January V1.0, January Specifying Trusted Hosts 10. Https Settings V1.0, January 11. Trusted Hosts Settings Configuring FTP Scans 12. FTP Scan Settings Setting Web Access Exceptions and Scanning Exclusions Setting Web Access Exception RulesBlock Files with the Following Extensions To set Web access exception rules Groups and Hosts LAN Groups on 13. Add and Edit Block Scanning Exception Settings Setting Scanning Exclusions 14. Add Scanning Exclusion Settings V1.0, January Chapter Virtual Private Networking Using IPsec Connections IP Addressing for VPNs in Dual WAN Port Systems UTM IP Addressing for VPNs in Dual WAN Port Systems Creating Gateway-to-Gateway VPN Tunnels with the Wizard V1.0, January Connection Name and Remote IP Type IPsec VPN Wizard Settings for a Gateway-to-Gateway Tunnel Secure Connection Remote Accessibility Manually Adding or Editing a VPN Policy onEnd Point Information a V1.0, January Creating a Client to Gateway VPN Tunnel V1.0, January Fqdn IPsec VPN Wizard Settings for a Client-to-Gateway Tunnel V1.0, January V1.0, January Only Connect Manually checkbox Security Policy Editor Remote Party SettingsGateway Tunnel Status on Security Policy Editor My Identity Settings On page 7-10. In this example, the domain name is Testing the VPN Connection Testing the Connections and Viewing Status InformationSecurity Policy Editor Security Policy Settings Detection checkbox Netgear VPN Client Status and Log Information V1.0, January Viewing the UTM IPsec VPN Connection Status Status Indications for the VPN Client System Tray IconSystem Tray Icon Status IPsec VPN Connection Status Information Viewing the UTM IPsec VPN Log Managing IPsec VPN Policies IKE Policies Screen Managing IKE Policies List of IKE Policies Information Manually Adding or Editing an IKE Policy V1.0, January 10. Add IKE Policy Settings Description or Subfield and Description Mode Config RecordGeneral Local RemoteIKE SA Parameters Group 1 768 bit ConfiguringGroup 5 1536 bit Keepalives and Dead Configuration on Screen see User Database Configuration on VPN Policies Screen Managing VPN Policies Remote 11. List of VPN Policies Information Manually Adding or Editing a VPN Policy V1.0, January Configuring Keepalives 12. Add VPN Policy SettingsDescription or Subfield and Description General Dead Peer Manual Policy Parameters Traffic Selection Auto Policy Parameters Configuring Extended Authentication Xauth Group 768 bitGroup 1536 bit Configuring Xauth for VPN Clients User Database Configuration Radius Client ConfigurationInformation, see Radius Client Configuration on V1.0, January Backup Radius Server 14. Radius Client SettingsConnection Configuration Primary Radius Server Assigning IP Addresses to Remote Users Mode Config Mode Config OperationConfiguring Mode Config Operation on the UTM V1.0, January Description or Subfield and Description Client Pool 15. Add Mode Config Record Settings Traffic Tunnel Security Level V1.0, January 16. Add IKE Policy Settings for a Mode Config Configuration Menu, select Group 2 1024 bit Description or Subfield and Description Remote Configuring the ProSafe VPN Client for Mode Config Operation 192.168.1.0 Mask Gateway Tunnel 18. Security Policy Editor My Identity, Mode Config Settings Menu Testing the Mode Config Connection Configuring Keepalives and Dead Peer Detection Configuring Keepalives 20. Keepalive Settings Configuring Dead Peer Connection 21. Dead Peer Detection Settings Configuring NetBIOS Bridging with IPsec VPN V1.0, January Understanding the SSL VPN Portal Options Chapter Virtual Private Networking Using SSL Connections Using the SSL VPN Wizard for Client Configurations SSL VPN Wizard of 6 Portal Settings SSL VPN Wizard Portal Settings Portal Layout and Theme NameScreen as shown in -8 on SSL VPN Portal Pages to Display SSL VPN Wizard of 6 Domain Settings SSL VPN Wizard Domain Settings Domain NameRadius Client SSL VPN Wizard of 6 User Settings SSL VPN Wizard User Settings SSL VPN Wizard of 6 Client IP Address Range and Routes SSL VPN Wizard Client IP Address Range and Routes Settings Client IP Address RangeAdd Routes for VPN Tunnel Clients SSL VPN Wizard of 6 Port Forwarding SSL VPN Wizard Port Forwarding Settings Add New Host Name for Port Forwarding SSH SSL VPN Wizard of 6 Verify and Save Your Settings Accessing the New SSL Portal Login Screen V1.0, January Viewing the UTM SSL VPN Log Viewing the UTM SSL VPN Connection Status Manually Configuring and Editing SSL Connections Creating the Portal Layout V1.0, January V1.0, January Revalidate Add Portal Layout Settings Configuring Applications for Port Forwarding Configuring Domains, Groups, and Users Adding Servers and Port Numbers Adding a New Host Name Port Forwarding Applications/TCP Port NumbersTCP Application Port Number Fully Qualified Domain Name. The full server name Configuring the SSL VPN Client Configuring the Client IP Address Range Tunnel Clients on Adding Routes for VPN Tunnel Clients Using Network Resource Objects to Simplify Policies Adding New Network Resources Editing Network Resources to Specify Addresses Add Resource Addresses Settings Configuring User, Group, and Global Policies Viewing Policies Adding a Policy Policy For 10. Add Policy Settings Network Resource Objects to Simplify Policies on Description or Subfield and Description Add SSL VPN Policies 10. Add Policy Settings V1.0, January V1.0, January Configuring VPN Authentication Domains, Groups, and Users Managing Users, Authentication, and Certificates Authentication Protocols and Methods Configuring Domains Ldap Add Domain Settings Creating the Portal Layout on Configuring Groups for VPN Policies Creating and Deleting Groups Editing Groups VPN Group Settings Configuring User Accounts V1.0, January Add User Settings See Configuring Extended Authentication Xauth onPolicies on Configuring Login Policies Setting User Login Policies Configuring Login Restrictions Based on IP Address Add Defined Addresses Settings Configuring Login Restrictions Based on Web Browser Internet Explorer Opera Netscape Navigator Changing Passwords and Other User Settings Edit User Settings Enabled see Configuring Extended Authentication Xauth onManaging Digital Certificates V1.0, January 11 Certificates, screen 1 Managing CA Certificates Managing Self Certificates Generating a CSR and Obtaining a Self Certificate from a CA Setting Generate Self Certificate Request Settings 512 1024 2048 V1.0, January Viewing and Managing Self Certificates Managing the Certificate Revocation List 15Certificates, screen 3 Bandwidth Capacity Performance Management Features That Reduce Traffic Network and System Management 10-3 Content Filtering Source MAC Filtering Features That Increase Traffic 10-6 Network and System Management Port Triggering Configuring the DMZ Port Configuring Exposed Hosts Using QoS and Bandwidth Assignment to Shift the Traffic MixConfiguring VPN Tunnels Assigning QoS Profiles System Management Changing Passwords and Administrator SettingsMonitoring Tools for Traffic Management Assigning Bandwidth Profiles 10-10 Network and System Management Network and System Management 10-11 Configuring Remote Management Access Https//IPaddress or https//FullyQualifiedDomainName Using an Snmp Manager Snmp Settings Managing the Configuration FileSetting Description or Subfield and Description Settings Trusted Snmp Hosts Backup Settings Restore Settings Updating the Firmware Reverting to Factory Default Settings Viewing the Available Firmware Versions Upgrading the Firmware and Rebooting the UTM Updating the Scan Signatures and Scan Engine Firmware Rebooting Without Changing the Firmware 10-22 Network and System Management Signatures & Scan Engine Settings Configuring Automatic Update and Frequency Settings System Date & Time Settings Configuring Date and Time Service Network and System Management 10-25 10-26 Network and System Management Enabling the WAN Traffic Meter Monitoring System Access and Performance 11-2 Monitoring System Access and Performance WAN Traffic Meter Settings Traffic CounterLogging, Alerts, and Event Notifications on System, E-mail, and Syslog Logs on Configuring the E-mail Notification Server Configuring Logging, Alerts, and Event Notifications Configuring and Activating System, E-mail, and Syslog Logs E-mail Notification SettingsServer requires authentication checkbox and enter Monitoring System Access and Performance 11-7 Email Logs to Administrator E-mail and Syslog Settings Send Logs via Syslog Configuring and Activating Update Failure and Attack Alerts Alerts Settings ACTION%, %VIRUSNAME% PROTOCOL%, %FROM%, %TO%, %SUBJECT%, %FILENAME% Configuring and Activating Firewall Logs Monitoring Real-Time Traffic, Security, and Statistics Firewall Logs Settings Dashboard, screen 1 Spam to configure, see Protecting Against E-mail Spam on Settings onTotal Threats System on Total Traffic Bytes Threats Counts Dashboard Most Recent 5 and Top 5 Information Categories, see Using the IntrusionCategory Most Recent 5 Description Top 5 Description Prevention System on Dashboard, screen 3 Dashboard Service Statistics Information Viewing System Status Viewing Status Screens System Status Status and System Information Setting Status 11 System Status, screen 2 NAT LAN PortDhcp Viewing Active VPN Users Viewing VPN Tunnel Connection Status11. System Status Interface Statistics 12. IPsec VPN Connection Status Information Viewing Port Triggering Status To view the status of the Port Triggering feature 13. Port Triggering Status Information Viewing the WAN Ports Status 11-28 Monitoring System Access and Performance Edit Vlan Profile screen see Configuring a Vlan Profile on Models see Manually Configuring the Internet Connection onViewing Attached Devices and the Dhcp Log Viewing Attached Devices 11-30 Monitoring System Access and Performance Viewing the Dhcp Log Querying the Logs Querying Logs and Generating Reports Monitoring System Access and Performance 11-33 15. Logs Query Settings See Configuring and Activating Firewall Logs on This field is available for the following logsFollowing protocols can be selected Following reasons can be selected Following categories can be selectedThis field is available only for the Spam log This field is available only for the Malware log EMERG, ALERT, CRITICAL, ERROR, WARNING, Notice This field is available only for the Service logThis field is available only for the Content filters log Log Management Example Using Logs to Identify Infected Clients Scheduling and Generating Reports Generating Reports Email Reports 16. Generate Report SettingsWeb Reports System Reports Scheduling Reports 17. Schedule Report Settings Using Diagnostics Utilities Email Reports Web Reports System ReportsReport List Sending a Ping Packet Using the Network Diagnostic Tools Tracing a Route Displaying the Routing TableLooking up a DNS Address 27 Diagnostics, screen 2 Using the Realtime Traffic Diagnostics Tool Generating Network Statistics Gathering Important Log Information Rebooting and Shutting Down the UTM Troubleshooting and Using Online Support Power LED Not On Basic FunctioningTest LED Never Turns Off LAN or WAN Port LEDs Not On Troubleshooting the Web Management Interface When You Enter a URL or IP Address a Time-out Error Occurs Troubleshooting the ISP Connection 12-6 Troubleshooting and Using Online Support Testing the LAN Path to Your UTM Troubleshooting a TCP/IP Network Using a Ping Utility Ping -n 10 IP address Testing the Path from Your PC to a Remote Device Restoring the Default Configuration and Password Problems with Date and Time Using Online SupportEnabling Remote Troubleshooting Sending Suspicious Files to Netgear for Analysis Malware Analysis Settings Accessing the Knowledge Base and Documentation Feature Default behavior Router Login Table A-1. UTM Default Configuration SettingsInternet Connection Local Network LAN Table A-2. UTM Physical and Technical Specifications Feature Specification Environmental Specifications Table A-3. UTM IPsec VPN SpecificationsInterface Specifications Setting Specification MD5, SHA-1, MAC-MD5/SHA-1, HMAC-MD5/SHA-1 Table A-4. UTM SSL VPN Specifications What to Consider Before You Begin Internet WAN port Physical facility Computer Network Configuration Requirements Internet Configuration RequirementsCabling and Computer Hardware Requirements Internet Connection Information Where Do I Get The Internet Configuration Information? Overview of the Planning Process Figure B-2 Inbound Traffic to a Single WAN Port System Inbound Traffic Inbound Traffic to a Dual WAN Port System Inbound Traffic Dual WAN Ports for Improved ReliabilityInbound Traffic Dual WAN Ports for Load Balancing VPN Road Warrior Client Virtual Private Networks VPNsTo-Gateway To-Gateway Through a NAT Figure B-7 VPN Road Warrior Single Gateway WAN Port Reference Case VPN Road Warrior Client-to-Gateway Figure B-10 VPN Road Warrior Dual Gateway WAN Ports for Load Balancing VPN Gateway-to-Gateway Figure B-13 Figure B-15 VPN Telecommuter Single Gateway WAN Port Reference Case VPN Telecommuter Client-to-Gateway Through a NAT Router Figure B-18 Figure B-20 VPN Telecommuter Dual Gateway WAN Ports for Load Balancing Term Description or Subfield and Description Table C-1. Log Message Terms Table C-3. System Logs Reboot RebootSystem Log Messages System Startup Service Logs Table C-4. System Logs ServiceTable C-5. System Logs NTP Login/Logout Firewall RestartIPsec Restart WAN Status Auto-Rollover ModeSystem Logs WAN Status, Auto Rollover ACTIVEWAN2 Table C-9. System Logs WAN Status, Load Balancing Load-Balancing Mode PPP Logs Table C-10. System Logs WAN Status, PPPoE Idle-Timeout Table C-12. System Logs WAN Status, PPP Authentication Table C-11. System Logs WAN Status, Pptp Idle-Timeout Traffic Metering Logs Unicast LogsIcmp Redirect Logs Multicast/Broadcast Logs Invalid Packet LoggingTable C-16. System Logs Multicast/Broadcast Table C-17. System Logs Invalid Packets Invalidbadhwchecksumdrop SRC=192.168.20.10 Invalidbadchecksumdrop SRC=192.168.20.10Invalidmalformedpacketdrop SRC=192.168.20.10 Invalidshortpacketdrop SRC=192.168.20.10 Web Filtering and Content Filtering Logs Content Filtering and Security Logs Spam Logs Table C-19. Content Filtering and Security Logs Spam Table C-21. Content Filtering and Security Logs Virus Table C-20. Content Filtering and Security Logs TrafficTraffic Logs Virus Logs Table C-24. Content Filtering and Security Logs Port Scan Table C-23. Content Filtering and Security Logs IPSIPS Logs Port Scan Logs LAN to WAN Logs Routing LogsLAN to DMZ Logs DMZ to WAN Logs WAN to LAN Logs DMZ to LAN LogsWAN to DMZ Logs V1.0, January What are the benefits of Two-Factor Authentication? Why do I need Two-Factor Authentication? What is Two-Factor Authentication Netgear Two-Factor Authentication Solutions Figure D-1 Figure D-3 Document Link Appendix E Related Documents V1.0, January Numerics Index Index-2 Index-3 Index-4 Index-5 Index-6 Index-7 Index-8 Index-9 Index-10 Index-11 Index-12 Index-13 Index-14 Index-15 Index-16