61

GlobeSurfer

®

II 1.8 - 7.2 - 7.2 S

REFERENCE MANUAL

‘Event-Type’

A textual description of the event:

Blocked: The packet was blocked. The message is colored red.

Accepted: The packet was accepted. The message is colored green.

‘Details’

More details about the packet or the event, such as protocol, IP addresses, ports, etc.

To view or change the security log settings:

1.

Click the ‘Settings’ button that appears at the top of the ‘Firewall Log’ screen. The ‘Security Log Settings’ screen will

appear (see Figure 5.93).

Figure 5.93 Security Log Settings

2.

Select the types of activities for which you would like to have a log message generated:

•

‘Accepted Events’

‘Accepted Incoming Connections’ Write a log message for each successful attempt to establish an inbound connection

to the home network.

‘Accepted Outgoing Connections’ Write a log message for each successful attempt to establish an outgoing connection

to the public network.

•

‘Blocked Events’

‘All Blocked Connection Attempts’ Write a log message for each blocked attempt to establish an inbound connection to

the home network or vice versa. You can enable logging of blocked packets of specific types by disabling this option,

and enabling some of the more specific options below it.

‘Specific Events’ Specify the blocked events that should be monitored. Use this to monitor specific event such as

SynFlood. A log message will be generated if either the corresponding check-box is checked, or the “All Blocked

Connection Attempts” check-box is checked.

•

‘Other Events’

‘Remote Administration Attempts’ Write a log message for each remote-administration connection attempt, whether

successful or not.

‘Connection States’ Provide extra information about every change in a connection opened by the firewall. Use this

option to track connection handling by the firewall and Application Level Gateways (ALGs).

•

‘Log Buffer’

‘Prevent Log Overrun’ Select this check box in order to stop logging firewall activities when the memory allocated for

the log fills up.

3.

Click ‘OK’ to save the settings.

62

GlobeSurfer

®

II 1.8 - 7.2 - 7.2 S

REFERENCE MANUAL

The following are the available event types that can be recorded in the firewall log:

1.

Firewall internal - an accompanying explanation from the firewall internal mechanism will be added in case this event-type

is recorded.

2.

Firewall status changed - the firewall changed status from up to down or the other way around, as specified in the event

type description.

3.

STP packet - an STP packet has been accepted/rejected.

4.

Illegal packet options - the options field in the packet’s header is either illegal or forbidden.

5.

Fragmented packet - a fragment has been rejected.

6.

WinNuke protection - a WinNuke attack has been blocked.

7.

ICMP replay - an ICMP replay message has been blocked.

8.

ICMP redirect protection - an ICMP redirected message has been blocked.

9.

Packet invalid in connection - a packet has been blocked, being on an invalid connection.

10.

ICMP protection - a broadcast ICMP message has been blocked.

11.

Broadcast/Multicast protection - a packet with a broadcast/multicast source IP has been blocked.

12.

Spoofing protection - a packet from the WAN with a source IP of the LAN has been blocked.

13.

DMZ network packet - a packet from a demilitarized zone network has been blocked.

14.

Trusted device - a packet from a trusted device has been accepted.

15.

Default policy - a packet has been accepted/blocked according to the default policy.

16.

Remote administration - a packet designated for GlobeSurfer

®

II management has been accepted/blocked.

17.

Access control - a packet has been accepted/blocked according to an access control rule.

18.

Parental control - a packet has been blocked according to a parental control rule.

19.

NAT out failed - NAT failed for this packet.

20. DHCP request -

GlobeSurfer

®

II sent a DHCP request (depends on the distribution).

21. DHCP response - GlobeSurfer

®

II received a DHCP response (depends on the distribution).

22.

DHCP relay agent - a DHCP relay packet has been received (depends on the distribution).

23.

IGMP packet - an IGMP packet has been accepted.

24.

Multicast IGMP connection - a multicast packet has been accepted.

25.

RIP packet - a RIP packet has been accepted.

26.

PPTP connection - a packet inquiring whether GlobeSurfer

®

II is ready to receive a PPTP connection has been accepted.

27.

Kerberos key management 1293 - security related, for future use.

28.

Kerberos 88 - for future use.

29.

AUTH:113 request - an outbound packet for AUTHprotocol has been accepted (for maximum security level).

30.

Packet-Cable - for future use.

31.

IPV6 over IPV4 - an IPv6 over IPv4 packet has been accepted.

32.

ARP - an ARP packet has been accepted.

33.

PPP Discover - a PPP discover packet has been accepted.

34.

PPP Session - a PPP session packet has been accepted.

35.

802.1Q - a 802.1Q (VLAN) packet has been accepted.

36.

Outbound Auth1X - an outbound Auth1X packet has been accepted.

37.

IP Version 6 - an IPv6 packet has been accepted.

38. GlobeSurfer

®

II initiated traffic - all traffic that GlobeSurfer

®

II initiates is recorded.

39.

Maximum security enabled service - a packet has been accepted because it belongs to a permitted service in the

maximum security level.

40.

SynCookies Protection - a SynCookies packet has been blocked.

41.

ICMP Flood Protection - a packet has been blocked, stopping an ICMP flood.

42.

UDP Flood Protection - a packet has been blocked, stopping a UDP flood.

63

GlobeSurfer

®

II 1.8 - 7.2 - 7.2 S

REFERENCE MANUAL

43.

Service - a packet has been accepted because of a certain service, as specified in the event type.

44.

Advanced Filter Rule - a packet has been accepted/blocked because of an advanced filter rule.

45.

Fragmented packet, header too small - a packet has been blocked because after the defragmentation, the header was too

small.

46.

Fragmented packet, header too big - a packet has been blocked because after the defragmentation, the header was too

big.

47.

Fragmented packet, drop all - not used.

48.

Fragmented packet, bad align - a packet has been blocked because after the defragmentation, the packet was badly

aligned.

49.

Fragmented packet, packet too big - a packet has been blocked because after the defragmentation, the packet was too

big.

50.

Fragmented packet, packet exceeds - a packet has been blocked because defragmentation found more fragments than

allowed.

51.

Fragmented packet, no memory - a fragmented packet has been blocked because there was no memory for fragments.

52.

Fragmented packet, overlapped - a packet has been blocked because after the defragmentation, there were overlapping

fragments.

53.

Defragmentation failed - the fragment has been stored in memory and blocked until all fragments arrived and

defragmentation could be performed.

54.

Connection opened - usually a debug message regarding a connection.

55.

Wildcard connection opened - usually a debug message regarding a connection.

56.

Wildcard connection hooked - usually debug message regarding connection.

57.

Connection closed - usually a debug message regarding a connection.

58.

Echo/Chargen/Quote/Snork protection -a packet has been blocked, protecting from Echo/Chargen/Quote/Snork.

59.

First packet in connection is not a SYN packet - a packet has been blocked because of a TCP connection that had started

without a SYN packet.

60.

Error: No memory - a message notifying that a new connection has not been established because of lack of memory.

61.

NAT Error : Connection pool is full - a message notifying that a connection has not been created because the connection

pool is full.

62.

NAT Error: No free NAT IP - a message notifying that there is no free NAT IP, therefore NAT has failed.

63.

NAT Error: Conflict Mapping already exists - a message notifying that there is a conflict since the NAT mapping already

exists, therefore NAT has failed.

64.

Malformed packet: Failed parsing - a packet has been blocked because it is malformed.

65.

Passive attack on ftp-server: Client attempted to open Server ports - a packet has been blocked because of an

unauthorized attempt to open a server port.

66.

FTP port request to 3rd party is forbidden (Possible bounce attack) - a packet has been blocked because of an

unauthorized FTP port request.

67.

Firewall Rules were changed - the firewall rule set has been modified.

68.

User authentication - a message during login time, including both successful and failed authentication.

69.

First packet is Invalid - First packet in connection failed to pass firewall or NAT

64

GlobeSurfer

®

II 1.8 - 7.2 - 7.2 S

REFERENCE MANUAL

6

SYSTEM SETUP

The System Setup include settings and functions rrelated to the general behaviour of your GlobeSurfer

®

II.

6.1

Telephone

GlobeSurfer

®

II is equipped with a telephony connector and can replace a regular fixed line service (POTS). In order to setup fixed

line telephony to make phone calls through GlobeSurfer

®

II, connect GlobeSurfer

®

II to the first telephony plug. Note that you should

configure your country in the GlobeSurfer

®

II Quick setup wizard, see section 2.3.2.

6.1.1

Missed calls

The ‘Missed calls’ tab shows a list of calls, with Caller ID if received, that was received but not answered including a time

stamp of the event (see Figure 6.1). By clicking ‘Clear log’ you will erase the history of missed calls.

Figure 6.1 Missed Calls

6.1.2

Incoming calls

The ‘Incoming calls’ tab shows calls, with Caller ID if received, that was received and answered including a time stamp and

duration of the event (see Figure 6.2). By clicking ‘Clear log’ you will erase the history of incoming calls.

Figure 6.2 Incoming Calls

6.1.3

Outgoing calls

The ‘Outgoing calls’ tab shows calls, with Caller ID, that has been initiated from your telephones using GlobeSurfer

®

II

including a time stamp and duration of the event (see Figure 6.3). By clicking ‘Clear log’ you will erase the history of outgoing

calls.

65

GlobeSurfer

®

II 1.8 - 7.2 - 7.2 S

REFERENCE MANUAL

Figure 6.3 Outgoing Calls

6.1.4

Telephone settings

The ‘Telephone settings’ tab controls the behaviour of the fixed line telephony sopprt of GlobeSurfer

®

II.

Use the ‘Telephone settings’ tab to make the following settings:

6.2

SIM setup

The SIM card in the GlobeSurfer

®

II requires a PIN code to be entered before it can be used. The PIN code you receive from your ISP

can be changed to a PIN code of your own. By default the PIN code is required but it can be stored in the GlobeSurfer

®

II after the first

use so that you don’t have to enter it more than once. These settings can be changed but note that you should disconnect before doing

any changes to the SIM setup.

Figure 6.4 SIM Setup

To change the PIN of your SIM card or save PIN on GlobeSurfer

®

II, perform the following:

1. Click ‘SIM Setup’ on the ‘System setup’ screen of the management console. The SIM Setup screen will appear (see Figure 6.4).

2. Enter the PIN code in the first field to be able to change any settings.

3. a. To be forced to enter the PIN code each time the GlobeSurfer

®

II is started, de-select the Enabled checkbox at Save PIN.

b.

If you want to change the PIN code, enter a new PIN code in the ‘New PIN code’ and ‘Verify new PIN code’ fields.

4. Click OK to save your changes.