Document Outline

• Clavister cOS Core
• Table of Contents
• Preface
• Chapter 1: cOS Core Overview
  • 1.1. Features
  • 1.2. cOS Core Architecture
    • 1.2.1. State-based Architecture
    • 1.2.2. cOS Core Building Blocks
    • 1.2.3. Basic Packet Flow
  • 1.3. cOS Core State Engine Packet Flow
• Chapter 2: Management and Maintenance
  • 2.1. Managing cOS Core
    • 2.1.1. Overview
    • 2.1.2. Default Administrator Accounts
    • 2.1.3. The Web Interface
    • 2.1.4. The CLI
    • 2.1.5. CLI Scripts
    • 2.1.6. Secure Copy
    • 2.1.7. The Console Boot Menu
    • 2.1.8. Changing Management Access
    • 2.1.9. Management Advanced Settings
    • 2.1.10. Working with Configurations
  • 2.2. Events and Logging
    • 2.2.1. Overview
    • 2.2.2. Log Messages
    • 2.2.3. Creating Log Receivers
    • 2.2.4. Logging to MemoryLogReceiver
    • 2.2.5. Logging to Syslog Hosts
    • 2.2.6. Logging to the Clavister Logger
    • 2.2.7. Severity Filter and Message Exceptions
    • 2.2.8. SNMP Traps
    • 2.2.9. Advanced Log Settings
  • 2.3. RADIUS Accounting
    • 2.3.1. Overview
    • 2.3.2. RADIUS Accounting Messages
    • 2.3.3. Interim Accounting Messages
    • 2.3.4. Configuring RADIUS Accounting
    • 2.3.5. RADIUS Accounting Security
    • 2.3.6. RADIUS Accounting and High Availability
    • 2.3.7. Handling Unresponsive RADIUS Servers
    • 2.3.8. Accounting and System Shutdowns
    • 2.3.9. Limitations with NAT
    • 2.3.10. Advanced RADIUS Settings
  • 2.4. Monitoring
    • 2.4.1. Real-time Monitoring Counters
    • 2.4.2. Real-time Monitor Alerts
    • 2.4.3. The Link Monitor
    • 2.4.4. SNMP Monitoring
    • 2.4.5. Hardware Monitoring
    • 2.4.6. Memory Monitoring Settings
  • 2.5. Diagnostic Tools
    • 2.5.1. Overview
    • 2.5.2. Diagnostic CLI Commands
    • 2.5.3. The pcapdump CLI Command
    • 2.5.4. Hardware Fault Troubleshooting
  • 2.6. Maintenance
    • 2.6.1. Software Upgrades
      • 2.6.1.1. The Core Executable
    • 2.6.2. Auto-Update Mechanism
    • 2.6.3. Backing Up Configurations
    • 2.6.4. Restore to Factory Defaults
    • 2.6.5. Listing and Adding Ethernet Interfaces
  • 2.7. Licensing
• Chapter 3: Fundamentals
  • 3.1. The Address Book
    • 3.1.1. Overview
    • 3.1.2. IP Addresses
    • 3.1.3. Ethernet Addresses
    • 3.1.4. Address Groups
    • 3.1.5. Auto-Generated Address Objects
    • 3.1.6. Address Book Folders
  • 3.2. IPv6 Support
  • 3.3. Services
    • 3.3.1. Overview
    • 3.3.2. Creating Custom Services
    • 3.3.3. ICMP Services
    • 3.3.4. Custom IP Protocol Services
    • 3.3.5. Service Groups
    • 3.3.6. Custom Service Timeouts
  • 3.4. Interfaces
    • 3.4.1. Overview
    • 3.4.2. Ethernet Interfaces
      • 3.4.2.1. Useful CLI Commands for Ethernet Interfaces
      • 3.4.2.2. Advanced Ethernet Interface Settings
    • 3.4.3. Link Aggregation
    • 3.4.4. VLAN
    • 3.4.5. PPPoE
    • 3.4.6. GRE Tunnels
    • 3.4.7. Loopback Interfaces
    • 3.4.8. Interface Groups
  • 3.5. ARP
    • 3.5.1. Overview
    • 3.5.2. The ARP Cache
    • 3.5.3. ARP Publish
    • 3.5.4. Using ARP Advanced Settings
  • 3.6. IP Rules and IP Policies
    • 3.6.1. Security Policies
    • 3.6.2. IP Rule Set Evaluation
    • 3.6.3. IP Rule Actions
    • 3.6.4. Multiple IP Rule Sets
    • 3.6.5. IP Rule Set Folders
    • 3.6.6. Configuration Object Groups
    • 3.6.7. IP Policies
    • 3.6.8. Application Control
  • 3.7. Schedules
  • 3.8. Certificates
    • 3.8.1. Overview
    • 3.8.2. Uploading Certificates
  • 3.9. Date and Time
    • 3.9.1. Overview
    • 3.9.2. Setting Date and Time
    • 3.9.3. Time Servers
    • 3.9.4. Settings Summary for Date and Time
  • 3.10. DNS
  • 3.11. Internet Access Setup
    • 3.11.1. Static Address Setup
    • 3.11.2. DHCP Setup
    • 3.11.3. The Minimum Requirements for Traffic Flow
    • 3.11.4. Creating a Route
    • 3.11.5. Creating IP Rules or IP Policies
    • 3.11.6. Defining DNS Servers
  • 3.12. ICMP Ping
• Chapter 4: Routing
  • 4.1. Overview
  • 4.2. Static Routing
    • 4.2.1. The Principles of Routing
    • 4.2.2. Static Routing
    • 4.2.3. Route Failover
    • 4.2.4. Host Monitoring for Route Failover
    • 4.2.5. Advanced Settings for Route Failover
    • 4.2.6. Proxy ARP
  • 4.3. Policy-based Routing
  • 4.4. Route Load Balancing
  • 4.5. Virtual Routing
    • 4.5.1. Overview
    • 4.5.2. A Simple Scenario
    • 4.5.3. The Disadvantage of Routing Rules
    • 4.5.4. IP Rules with Virtual Routing
    • 4.5.5. Multiple IP rule sets
    • 4.5.6. Trouble Shooting
  • 4.6. OSPF
    • 4.6.1. Dynamic Routing
    • 4.6.2. OSPF Concepts
    • 4.6.3. OSPF Components
      • 4.6.3.1. OSPF Router Process
      • 4.6.3.2. OSPF Area
      • 4.6.3.3. OSPF Interface
      • 4.6.3.4. OSPF Neighbors
      • 4.6.3.5. OSPF Aggregates
      • 4.6.3.6. OSPF VLinks
    • 4.6.4. Dynamic Routing Rules
      • 4.6.4.1. Overview
      • 4.6.4.2. Dynamic Routing Rule
      • 4.6.4.3. OSPF Action
      • 4.6.4.4. Routing Action
    • 4.6.5. Setting Up OSPF
    • 4.6.6. An OSPF Example
    • 4.6.7. OSPF Troubleshooting
  • 4.7. Multicast Routing
    • 4.7.1. Overview
    • 4.7.2. Multicast Forwarding with SAT Multiplex Rules
      • 4.7.2.1. Multicast Forwarding - No Address Translation
      • 4.7.2.2. Multicast Forwarding - Address Translation Scenario
    • 4.7.3. IGMP Configuration
      • 4.7.3.1. IGMP Rules Configuration - No Address Translation
      • 4.7.3.2. IGMP Rules Configuration - Address Translation
    • 4.7.4. Advanced IGMP Settings
  • 4.8. Transparent Mode
    • 4.8.1. Overview
    • 4.8.2. Enabling Internet Access
    • 4.8.3. Transparent Mode Scenarios
    • 4.8.4. Spanning Tree BPDU Support
    • 4.8.5. MPLS Pass Through
    • 4.8.6. Advanced Settings for Transparent Mode
• Chapter 5: DHCP Services
  • 5.1. Overview
  • 5.2. cOS Core DHCP Servers
    • 5.2.1. Static IPv4 DHCP Hosts
    • 5.2.2. Custom IPv4 Options
  • 5.3. IPv4 DHCP Relay
    • 5.3.1. DHCP Relay Advanced Settings
  • 5.4. IP Pools
  • 5.5. DHCPv6 Servers
• Chapter 6: Security Mechanisms
  • 6.1. Access Rules
    • 6.1.1. Overview
    • 6.1.2. IP Spoofing
    • 6.1.3. Access Rule Settings
  • 6.2. ALGs
    • 6.2.1. Overview
    • 6.2.2. The HTTP ALG
    • 6.2.3. The FTP ALG
    • 6.2.4. The TFTP ALG
    • 6.2.5. The SMTP ALG
      • 6.2.5.1. Anti-Spam Filtering
    • 6.2.6. The POP3 ALG
    • 6.2.7. The PPTP ALG
    • 6.2.8. The SIP ALG
    • 6.2.9. The H.323 ALG
    • 6.2.10. The TLS ALG
  • 6.3. Web Content Filtering
    • 6.3.1. Overview
    • 6.3.2. Active Content Handling
    • 6.3.3. Static Content Filtering
    • 6.3.4. Dynamic Web Content Filtering
      • 6.3.4.1. Overview
      • 6.3.4.2. Setting Up Dynamic Web Content Filtering
      • 6.3.4.3. Content Filtering Categories
      • 6.3.4.4. Customizing WCF HTML Pages
  • 6.4. Anti-Virus Scanning
    • 6.4.1. Overview
    • 6.4.2. Implementation
    • 6.4.3. Activating Anti-Virus Scanning
    • 6.4.4. Anti-Virus Options
  • 6.5. Intrusion Detection and Prevention
    • 6.5.1. Overview
    • 6.5.2. Subscribing to Clavister IDP
    • 6.5.3. IDP Rules
    • 6.5.4. Insertion/Evasion Attack Prevention
    • 6.5.5. IDP Pattern Matching
    • 6.5.6. IDP Signature Groups
    • 6.5.7. Setting Up IDP
    • 6.5.8. Best Practice Deployment
  • 6.6. Denial-of-Service Attacks
    • 6.6.1. Overview
    • 6.6.2. DoS Attack Mechanisms
    • 6.6.3. Ping of Death Attacks
    • 6.6.4. Fragmentation Overlap Attacks
    • 6.6.5. The Land and LaTierra Attacks
    • 6.6.6. The WinNuke attack
    • 6.6.7. Amplification Attacks
    • 6.6.8. TCP SYN Flood Attacks
    • 6.6.9. The Jolt2 Attack
    • 6.6.10. Distributed DoS Attacks
  • 6.7. Blacklisting Hosts and Networks
• Chapter 7: Address Translation
  • 7.1. Overview
  • 7.2. NAT
  • 7.3. NAT Pools
  • 7.4. SAT
    • 7.4.1. Introduction
    • 7.4.2. One-to-One IP Translation
    • 7.4.3. Many-to-Many IP Translation
    • 7.4.4. All-to-One IP Translation
    • 7.4.5. Port Translation
    • 7.4.6. SAT with FwdFast Rules
    • 7.4.7. Using an IP Policy for SAT
    • 7.4.8. Protocols Handled by SAT
• Chapter 8: User Authentication
  • 8.1. Overview
  • 8.2. Authentication Setup
    • 8.2.1. Setup Summary
    • 8.2.2. Local User Databases
    • 8.2.3. External RADIUS Servers
    • 8.2.4. External LDAP Servers
    • 8.2.5. Authentication Rules
    • 8.2.6. Authentication Processing
    • 8.2.7. HTTP Authentication
  • 8.3. ARP Authentication
  • 8.4. Customizing Authentication HTML Pages
  • 8.5. Policies Requiring Authentication
  • 8.6. User Identity Awareness
  • 8.7. Two Factor Authentication
  • 8.8. Radius Relay
• Chapter 9: VPN
  • 9.1. Overview
    • 9.1.1. VPN Usage
    • 9.1.2. VPN Encryption
    • 9.1.3. VPN Planning
    • 9.1.4. Key Distribution
    • 9.1.5. The TLS Alternative for VPN
  • 9.2. VPN Quick Start
    • 9.2.1. IPsec LAN to LAN with Pre-shared Keys
    • 9.2.2. IPsec LAN to LAN with Certificates
    • 9.2.3. IPsec Roaming Clients with Pre-shared Keys
    • 9.2.4. IPsec Roaming Clients with Certificates
    • 9.2.5. L2TP Roaming Clients with Pre-Shared Keys
    • 9.2.6. L2TP Roaming Clients with Certificates
    • 9.2.7. PPTP Roaming Clients
    • 9.2.8. iOS Setup
  • 9.3. IPsec Components
    • 9.3.1. Overview
    • 9.3.2. Internet Key Exchange (IKE)
    • 9.3.3. IKE Authentication
    • 9.3.4. IPsec Protocols (ESP/AH)
    • 9.3.5. NAT Traversal
    • 9.3.6. Algorithm Proposal Lists
    • 9.3.7. Pre-shared Keys
    • 9.3.8. Identification Lists
  • 9.4. IPsec Tunnels
    • 9.4.1. Overview
    • 9.4.2. LAN to LAN Tunnels with Pre-shared Keys
    • 9.4.3. Roaming Clients
    • 9.4.4. Fetching CRLs from an alternate LDAP server
    • 9.4.5. Troubleshooting with ikesnoop
    • 9.4.6. IPsec Advanced Settings
  • 9.5. PPTP/L2TP
    • 9.5.1. PPTP Servers
    • 9.5.2. L2TP Servers
    • 9.5.3. L2TP/PPTP Server Advanced Settings
    • 9.5.4. PPTP/L2TP Clients
    • 9.5.5. L2TP Version 3
      • 9.5.5.1. L2TPv3 Server
  • 9.6. SSL VPN
    • 9.6.1. Overview
    • 9.6.2. Configuring SSL VPN in cOS Core
    • 9.6.3. Installing the SSL VPN Client
    • 9.6.4. SSL VPN Setup Example
  • 9.7. CA Server Access
  • 9.8. VPN Troubleshooting
    • 9.8.1. General Troubleshooting
    • 9.8.2. Troubleshooting Certificates
    • 9.8.3. IPsec Troubleshooting Commands
    • 9.8.4. Management Interface Failure with VPN
    • 9.8.5. Specific Error Messages
    • 9.8.6. Specific Symptoms
• Chapter 10: Traffic Management
  • 10.1. Traffic Shaping
    • 10.1.1. Overview
    • 10.1.2. Traffic Shaping in cOS Core
    • 10.1.3. Simple Bandwidth Limiting
    • 10.1.4. Limiting Bandwidth in Both Directions
    • 10.1.5. Creating Differentiated Limits Using Chains
    • 10.1.6. Precedences
    • 10.1.7. Pipe Groups
    • 10.1.8. Traffic Shaping Recommendations
    • 10.1.9. A Summary of Traffic Shaping
    • 10.1.10. More Pipe Examples
  • 10.2. IDP Traffic Shaping
    • 10.2.1. Overview
    • 10.2.2. Setting Up IDP Traffic Shaping
    • 10.2.3. Processing Flow
    • 10.2.4. The Importance of Specifying a Network
    • 10.2.5. A P2P Scenario
    • 10.2.6. Viewing Traffic Shaping Objects
    • 10.2.7. Guaranteeing Instead of Limiting Bandwidth
    • 10.2.8. Logging
  • 10.3. Threshold Rules
  • 10.4. Server Load Balancing
    • 10.4.1. Overview
    • 10.4.2. SLB Distribution Algorithms
    • 10.4.3. Selecting Stickiness
    • 10.4.4. SLB Algorithms and Stickiness
    • 10.4.5. SLB Server Monitoring
    • 10.4.6. Setting Up SLB_SAT Rules
• Chapter 11: High Availability
  • 11.1. Overview
  • 11.2. HA Mechanisms
  • 11.3. Setting Up HA
    • 11.3.1. Physical HA Hardware Setup
    • 11.3.2. Wizard cOS Core HA Setup
    • 11.3.3. Manual cOS Core HA Setup
    • 11.3.4. Verifying that the Cluster Functions Correctly
    • 11.3.5. Unique Shared Mac Addresses
  • 11.4. HA Issues
  • 11.5. Upgrading an HA Cluster
  • 11.6. Link Monitoring and HA
  • 11.7. HA Advanced Settings
• Chapter 12: Advanced Settings
  • 12.1. IP Level Settings
  • 12.2. TCP Level Settings
  • 12.3. ICMP Level Settings
  • 12.4. State Settings
  • 12.5. Connection Timeout Settings
  • 12.6. Length Limit Settings
  • 12.7. Fragmentation Settings
  • 12.8. Local Fragment Reassembly Settings
  • 12.9. SSL Settings
  • 12.10. Miscellaneous Settings
• Appendix A: Update Subscriptions
• Appendix B: IDP Signature Groups
• Appendix C: Verified MIME filetypes
• Appendix D: The OSI Framework
• Appendix E: Third Party Software Licenses
• Alphabetical Index