Administration Guide - SophosUTM

1 + (PPPoE) (PPPoA/PPTP) (PPP) (QoS) (OSPF) (PIM-SM) (CRLs) (CRLs) (CRLs) ' :first,installingthesoftware;second, , IfyouareemployingaSophosUTMhardwareappli ance,youcanskipthefollowingsectionsanddi rectlyjumptotheBasicConfigurationsection , (AWS).FormoreinformationonhowtodeploySop hosUTMonAWS, ,youareadvisedtoreadthefollowingdocument sthathelpyousetupSophosUTM, : (orcompatible) :40 GBSATA harddiskdriveorSSDlCD-ROMD rive:BootableIDEorSCSICD- (optional) , , (optional):OneUSBportforcommunicationswi thaUPSdeviceandoneUSBportforconnectingaS ophosUTMS martInstaller(SUSI)lSwitch(optional):Ane tworkdevicethatconnects(andselectsbetwee n) (HCL) , :lProcessor:Clocksignalfrequency2 GHzorhigherlBrowser:SophosUTMrequiresthe latestversionofFirefox(recommended),late stversionofChrome,latestversionofSafari, ,thebrowsermustbeconfigurednottouseaprox yfortheIPaddressofSophosUTM sinternalnetworkcard(eth0).

2 (UPS) , ,anothermessagewillbesenttotheadministra tor (RedundantArrayofIndependentDisks) , "HCL" ,pleasemakesureyouhavethefollowingitemsa vailable:lTheSophosUTMCD-ROMlThelicensek eyforSophosUTMT hesetupprogramwillcheckthehardwareofthes ystem, ,usethefollowingkeys(pleasealsonotethead ditionalkeyfunctionslistedatthebottomofa screen):lF1 :Usethesekeystonavigatethroughthetextbox es(forexample,thelicenseagreementorwhens electingakeyboardlayout).lTabkey:Movebac kandforthbetweentextboxes,lists, :Theenteredinformationisconfirmed, , :lCPUlSizeandtypeofharddiskdrivelCD-ROMd rivelNetworkinterfacecardslIDEorSCSI controllersIfyoursystemdoesnotmeetthemin imumrequirements, , , (UK), , , , , , ,selectanetworkinterfacecardtobetheinter nalnetworkcard(eth0).

3 Interfaceshavinganactiveconnectionaremar kedwith[link]. ,networkmask, : , ,thesubnetisdefinedbythefirstthreeoct-et softheaddress:inthiscase, ,itisnotonthesamesubnet, , , , , ,connecttotheinternalnetwork, , (eth0), , , (Alt+F1)maydisplaythemessage"NoIPoneth0" (aprocesswhich,dependingonyourhardware,c antakeseveralminutes), , , , ,forexample,ifyouwanttooperateitinbridge modeorinstandard(routing)mode, , , ( ,theIPaddressofeth0).Inordertostayconsis tentwithourconfigurationexampleabove, :4444(notetheHTTPS protocolandportnumber4444).Deviatingfrom theconfigurationexample,eachSophosUTMshi pswiththefollowingdefaultsettings:lInter faces:Internalnetworkinterface(eth0) :noneToaccessWebAdminofanySophosUTM,ente rthefollowingURLinstead: :4444 Toprovideauthenticationandencryptedcommu nication, 'svalidity, , , (AMI)ofSophosUTM, , ,anumberofcertificatesandcertificateauth oritiesarebeingcreated:lWebAdminCA:TheCA withwhichtheWebAdmincertificatewassigned (seeManagement>WebAdminSettings>HTTPSC ertificate).

4 LVPNS igningCA:TheCAwithwhichdigitalcertificat esaresignedthatareusedforVPNconnections( seeSite-to-siteVPN>CertificateManagement >CertificateAuthority).24 UTM9lWebAdminCertificate:Thedigitalcerti ficateofWebAdmin(seeSite-to-siteVPN>Cert ificateManagement>Certificates). :ThedigitalcertificateofSophosUTMthatisu sedforVPNconnections(seeSite-to-SiteVPN> CertificateManagement>Certificates).Thel oginpageappears.(Withsomebrowsersitmay,h owever,happenthatyouarepresentedanothers ecuritywarningbecausethecertificatehasch angedaccordingtoyourenteredvalues.)Figur e2 :Ifyouwanttousethewizard, :Ifyouhaveabackupfile, ,youcansafelyclickCancel(atanytimeduring thewizard ssteps)andtherebyexitthewizard, (atextfile).

5 , Iftheselectedlicensedoesnotcontainacerta insubscription, (eth0). , IfyouchangetheIPaddressoftheinternalinte rface, , , , , Ifyourlicensedoesnotallowoneofthefollowi ngfeatures, , , , , :DashboardIfyouencounteranyproblemswhile completingthesesteps, , (seesectionBasicConfiguration) ,selectthebackupfileyouwanttorestore, , ,suchasNetworkProtection, , , ,submenuitem,andthetab,forexample:"Onthe Interfaces&Routing>Interfaces>Hardwareta b, "Note SophosUTMrequiresthelatestversionofFiref ox(recommended),latestversionofChrome,la testversionofSafari, ,thebrowsermustbeconfigurednottouseaprox yfortheIPaddressofSophosUTM sinternalnetworkcard(eth0). ,thatis, :Configurenetwork,service,andtimeperiodd efinitionsaswellasuseraccounts,usergroup s, :Configuresystemfacilitiessuchasnetworki nterfacesaswellasroutingoptions, :ConfigurenetworkservicessuchasDNSandDHC P, :Configurebasicnetworkprotectionfeatures suchasfirewallrules,voiceoverIP, :ConfigureyourremoteEthernetdevice(RED) , ,displayingthesearchresults, Youcansetfocusonthesearchboxviathekeyboa rdshortcutCTRL+ :lUsername/ , :Everymenu,submenu, ,youronlinehelpwillalsobeupdated, :TorequestthealreadydisplayedWebAdminpag eagain, Neverusethereloadbuttonofthebrowser, ,delete,orclonetheitem(formoreinformatio n,seechapterButtonsandIcons).

6 Toaddanitemtothelist, ,where".."isaplaceholderfortheobjectbein gcreated( ,interface). ,whichcanbebrowsedwithForward(>>)andBack ward(<<) , ,youcanchangethedefaultsettingforalllistsontheManagement>WebAdminSettings> , , ,thatis, (s) ,therealname,thecomment, ,thesearchconsidersalltextswhichyoucanse einthelist, (althoughcase-insensitive). *and? : ,"inter"matches"Internet","interface",an d"printer".Beginningofaword:Markthesearc hexpressionwitha\ ,\bintermatches"Internet"and"interface"b utnot"printer".Endofaword:Markthesearche xpressionwitha\ ,http\bmatches"http"butnot"https".Beginn ingofanentry:Markthesearchexpressionwith a^ ,^intermatches"InternetUplink"butnot"Upl inkInterfaces".IPaddresses:SearchingforI Paddresses, ,192\.

7 168matches" ".TosearchmoregenerallyforIPaddressesuse \dwhichmatchesanydigit.\d+ ,\d+\.\d+\.\d+\.\d+ Itmakessensetoratheruseaneasy, >Users& :ExampleofaDialogBoxEachdialogboxcancons istofvariouswidgetssuchastextboxes,check boxes, ,manydialogboxesofferadrag-and-dropfunct ionality, , , ,thisopensthelistofavailablenetworks,int erfaces,users/groups, ,however,theycanstillbeedited, ,ontheotherhand,servestoconfirmyoursetti ngsinthebackend, , ,graywhendisabled, :Hastwodifferentfunctions:(1)Opensanobje ctlist(seesectionbelow)ontheleftsidewher eyoucanchooseappropriateobjectsfrom.(2) :(1) Iconinlistheader:theactions, ,Enable,Disable,Delete,applytotheselecte dlistobjects.(2) Iconintextbox:withtheactionsImportandExp ortyoucanimportorexporttext, , + ,whichcaneitherbenewline,colon, ,markthewholetextintheExportedTextfielda ndpressCTRL+ +V, :Usingthesetwoarrows,youcansortlisteleme ntsbymovinganelementdownorup, : Dependingonthelocationyoucannavigatethro ughthepagesofalonglist, :SavesthecurrentviewofdatainaCSV(comma-s eparatedvalues) , :DragginganObjectFromtheObjectListNetwor ksAnobjectlistisopenedautomaticallywheny ouclicktheFoldericon(seesectionabove),or youcanopenitmanuallyviaakeyboardshortcut (seeManagement>WebAdminSettings>UserPref erences).

8 TheobjectlistgivesyouquickaccesstoWebAdm inobjectslikeusers/groups,interfaces,net works, , ,amongstothers, > :lGeneralInformation:Hostname,model,lice nseID,subscriptions, , :Currentsystemutilization, ,insomecasesthatdoesnotrepresenttheactua lsizeofthephysicalmemoryinstalled, (uninterruptiblepowersupply)module(ifava ilable)lToday'sThreatStatus:Acounterfort hemostrelevantsecuritythreatsdetectedsin cemidnight:lThetotalofdroppedandrejected datapacketsforwhichloggingisenabledlThet otalofblockedintrusionattemptslThetotalo fblockedviruses(allproxies)lThetotalofbl ockedspammessages(SMTP/POP3)lThetotalofb lockedspyware(allproxies)lThetotalofbloc kedURLs(HTTP/S)lThetotalofblockedwebserv erattacks(WAF) , , , : : :Theintrusionpreventionsystem(IPS) :Anapplication-levelgatewayfortheHTTP/Sp rotocol, :Anapplication-levelgatewayformessagesse ntviatheSimpleMailTransferProtocol(SMTP) .

9 LPOP3 Proxy:Anapplication-levelgatewayformessa gessentviathePostOfficeProtocol3(POP3).l RED:ConfigurationofRemoteEthernetDevice( RED) :Highavailability(HA)failoverandclusteri ng,thatis,thedistributionofprocessing-in tensivetaskssuchascontentfiltering,virus scanning,intrusiondetection, :ManagementofyourSophosUTMapplianceviath ecentralmanagementtoolSophosUTMM anager(SUM).lSophosMobile Control:Managementofyourmobiledevicestoc ontrolcontent, :Protectionofyournetworkfromwebtrafficth atcarriesharmfulanddangerouscontentsucha sviruses,worms, :Bydefault, , :lWebProtection: , ,forexample, , : : :StatusofthelogpartitionofyourSophosUTMu nit, : : : :Memory/ : , , , ,achartandatable, , :# ,theportused,bandwidthusageperserverconn ection, 'sIPaddress,bandwidthusageperclientconne ction, "unclassified" ,theremightbeonlyoneclientintheinformati onwindowbutthreeclientsinthetable,thelat teractuallybeingtheconnectionsofthesingl eclienttothreedifferent, :Thetotalofnetworktrafficproducedduringt he"lifetime" : :Severalclientsusingfacebook.

10 Aslongasoneclientkeepstheconnectionopen, :Dependingontheapplicationtype,therearea ctionsavailable(exceptforunclassifiedtra ffic). ,forexample, , , TheFlowMonitordisplaysmuchmoredifferenti atedinformationontrafficifNetworkVisibil ityisenabled(seechapterWebProtection>App licationControl>NetworkVisibility).Whenh overingthemousecursoronachartabigdotwill appear, , ,thedotchangesitscolordependingonwhichli neitsinformationreferto, WhenreportingisturnedoffforAuthenticatio nunderLogging&Reporting>ReportingSetting s>Settings,sectionReportingSettings, , ,thesessiontimesoutafterthetimespandefin edontheManagement>WebAdminSettings> :lSystemSettingslWebAdminSettingslLicens inglUp2 DatelBackup/ , (ifnotyetdoneintheInstallationWizard): ' , (FQDN).