2. About myself… Ajay Nawani (Easy name: AJ) Presales Head – Global Operation Cyberoam India Email: ajay.nawani@cyberoam.com

10. Cyberoam is the only Identity-based Unified Threat Management appliance that provides integrated Internet security to enterprises and educational institutions through its unique granular user-based controls. Cyberoam – Identity Based Security

11. PATENT PENDING: IDENTITY-BASED TECHNOLOGY User

12. Layer 8 Firewall (Patented Technology)

14. Large Enterprises CR 1500i CR 1000i CR 750ia CR 500ia Small to Medium Enterprises CR 300i CR 200i CR 100ia Small Offices CR 50ia CR 35ia CR 25ia CR 15i CR 15wi Cyberoam UTM appliance range

17. Bundle Subscription (One time subscription)

20. Cyberoam is the only Identity-based Unified Threat Management appliance that provides integrated Internet security to enterprises and educational institutions through its unique granular user-based controls. Cyberoam – Identity Based Security

22. Cyberoam SSL VPN

24. Cyberoam SSL-VPN features

26. Cyberoam – End Point Data Protection Protect your Data. Protect your Assets. Cyberoam End Point Data Protection Protect Your Data, Protect Your Assets

29. Cyberoam iView The Intelligent Logging & Reporting Solution Its an Open Source, its free!

33. Cyberoam iView’s Logging & Reporting Facilitates Security, Compliance, Forensics Cyberoam iView’s Logging & Reporting

35. Cyberoam Central Console (CCC Series) Central Console (CCC)

37. CCC Cyberoam UTM Appliance Corporate Head Office Branch1 Branch2 Branch3 Branch Offices Branch…N CCC Deployment (Enterprise)

41. Cyberoam Package Cyberoam Appliance Documentation CD Blue Straight-through Ethernet Cable Red Crossover Ethernet Cable Quick Start Guide Serial Cable Power Cable

42. Web Based Administration Console: Username: cyberoam Password: cyber Text Based Administration console (Telnet or Serial Connection): Password: admin SSH: Username: admin Password: admin Cyberoam Factory Defaults Zone Type IP Address Port A B 172.16.16.16/255.255.255.0 192.168.2.1/ 255.255.240.0 LAN WAN

45. Before Cyberoam Scenario - Gateway Default Gateway: 192.168.0.1 Firewall INT IP:192.168.0.1/24 DMZ IP: 172.16.1.1/24 EXT IP: 61.0.5.2/29 Gateway IP: 61.0.5.1 Router IP:61.0.5.1/29 Network: 192.168.0.x/24 Users Mail Server IP:172.16.1.3 Gateway: 172.16.1.1 Database Server IP:172.16.1.4 Gateway: 172.16.1.1 DMZ Zone Switch Web Server IP:172.16.1.2 Gateway: 172.16.1.1 Switch IP Address ___ ___ ___ ___ Subnet Mask ___ ___ ___ ___ Zone Type LAN/WAN/DMZ Port A IP Address ___ ___ ___ ___ Subnet Mask ___ ___ ___ ___ Zone Type LAN/WAN/DMZ Port B IP Address ___ ___ ___ ___ Subnet Mask ___ ___ ___ ___ Zone Type LAN/WAN/DMZ IP Address ___ ___ ___ ___ Subnet Mask ___ ___ ___ ___ Zone Type LAN/WAN/DMZ Port C Port D IP address of the Default Gateway: ___ ___ ___ ___ DNS IP Address: ___.___.___.___ System Time Zone: ______________ System Date and Time: ______________ Email ID of the administrator : ______________

46. Cyberoam in Gateway Mode Default Gateway: 192.168.0.1 Network:192.168.0.x/24 Router IP:61.0.5.1/29 Users Mail Server IP:172.16.1.3 Gateway: 172.16.1.1 Database Server IP:172.16.1.4 Gateway: 172.16.1.1 Switch Web Server IP:172.16.1.2 Gateway: 172.16.1.1 Switch Console INT IP:192.168.0.1/24 DMZ IP: 172.16.1.1/24 EXT IP: 61.0.5.2/29 Gateway IP: 61.0.5.1 DMZ Zone

47. WAN Zone LAN Zone DMZ Zone Local Zone Cyberoam in Gateway mode have Four default zone LAN Zone : Network connected to LAN interface of Cyberoam WAN Zone : Network connected to WAN interface of Cyberoam DMZ Zone : Network connected to DMZ interface of Cyberoam Local Zone : IP Addresses assigned on Cyberoam interfaces falls under Local Zone Gateway Mode- Zone information

49. Default Gateway: 192.168.0.1 Before Cyberoam Scenario - Bridge Bridge IP Address ___.___.___.___ Subnet Mask ___.___.___.___ IP address of the Default Gateway ___.___.___.___ DNS IP Address ___.___.___.___ System Time Zone ______________ System Date and Time ______________ Email ID of the administrator ______________ Users Router Switch Network: 192.168.0.x/24 Firewall INT IP: 192.168.0.1/24

50. Default Gateway: 192.168.0.1 Cyberoam in Bridge Mode Users Router Network: 192.168.0.x/24 Firewall INT IP: 192.168.0.1/24 Bridge IP Address ___.___.___.___ Subnet Mask ___.___.___.___ 192.168. 0 . 5 255.255.255. 0 IP address of the Default Gateway ___.___.___.___ DNS IP Address 202 . 54 . 1 . 30 System Time Zone ______________ System Date and Time ______________ Email ID of the administrator ______________ 192.168. 0 . 1

51. LOCAL Zone WAN Zone LAN Zone Cyberoam in transparent mode have three default zone LAN Zone : Network connected to LAN interface of Cyberoam WAN Zone : Network connected to WAN interface of Cyberoam Local Zone : IP Address assigned on the Bridge Interface falls under Local Zone Bridge Mode- Zone information

56. Cyberoam’s HTTP proxy listens on port 3128 by default Configure to use an upstream parent proxy server Configure Web Proxy System  Web Proxy

57. The Network Configuration Wizard requires you to configure the Default Internet Access Policy Default Internet Access Policy

59. Cyberoam Registration

63. Appliance Access System  Administration  Appliance Access

64. Appliance Access (via Zones) Network  Interface  Zone

65. View port wise network (physical interface) and zone details. If virtual sub-interfaces are configured for VLAN implementation, they are also nested and displayed beneath the physical interface. Interface - Physical interfaces/ports available on Cyberoam. If virtual sub-interface is configured for the physical interface, it also displayed beneath the physical interface. Virtual sub-interface configuration can be updated or deleted. IP Management Network  Interface

66. Firewall Management

67. Zone Types LAN : The Internal and most secure zone. WAN : The external, no-control and non-reliable zone. DMZ : The secured publicly accessible server zone. Local : All ports of the Cyberoam Appliance fall in this zone. VPN : It is the only zone that does not have an assigned physical port/interface . Zone Management

68. Zone Mangement Network  Interface  Zone

69. Cyberoam provides several standard services and allows creating: • Customized service definitions • Firewall rule for Customized service definitions Service Management Objects  Services  Add

70. Manage Firewall Rules

72. Cyberoam Default Firewall rule #2

73. Cyberoam Default Firewall rule #1

75. Note : MAC based hosts can be added on the fly while creating firewall rules as well. Add MAC based host Objects  Hosts  MAC Host  Add

76. Firewall rule for MAC host

78. Add NAT Policy Firewall  NAT Policy  Add

79. Add firewall rule to include NAT policy Firewall  Rule  Add

81. Add Virtual Host Firewall  Virtual Host  Add

82. Add Firewall rule to include the Virtual Host

83. Once the virtual host is created successfully, Cyberoam automatically creates a loopback firewall rule for the zone of the mapped IP address. Loopback firewall rule is created for the service specified in virtual host. If port forwarding is not enabled in virtual host then firewall rule with “All Services” is created. Loopback rules allow internal users to access the internal resources using its public IP (external IP) or FQDN. Loopback Firewall rule

84. Port Forwarding concept Example: We have one public IP 154.146.25.37. In the DMZ, we have connected multiple servers like Web Server (192.168.1.157), FTP Server (192.168.1.158) and RDP Server (192.168.1.159). We want to publish all these servers using only one public IP 154.146.25.37. In this case, we will use Port Forwarding while configuring the Virtual Host. We will have to create 3 Virtual Hosts for above 3 servers with same external IP and different Internal IP addresses, with port forwarding. We have already created a Virtual Host for the Web Server with port 80, now we will create remaining two Virtual Hosts for FTP and RDP.

85. Creation of Virtual Hosts

86. Creation of Firewall Rules

90. DoS Configuration Firewall  DoS

92. Unified Threat Control’s in firewall rule

95. User Authentication process initiates, when the client tries to authenticate. Local Authentication Flow

96. External Authentication Flow

97. Note : All users need not authenticate against the same authentication server. VPN & SSL-VPN users can now authenticate against a different server than the one selected for firewall authentication. Authentication Settings Identity  Authentication  Auth Settings

98. Authentication Servers Identity  Authentication  Authentication Server

99. Authentication Methods Normal - HTTP client - Corporate client Windows: http://download.cyberoam.com/solution/optionals/Corporateclientsetup.exe Windows (Vista & Windows 7 – 32 bit): http://download.cyberoam.com/solution/optionals/Corporateclientsetup_vista_win7.exe Clientless - No Authentication Required Single Sign On - Authentication is done in sync with user’s authentication in domain

100. Single Sign On Flow (SSO)

101. Identity Based Policies

105. Web Filter  Policy  Add

106. Application Filter  Policy  Add

108. QoS  Policy  Add

113. User-MAC binding

117. Basics of Content Filter

120. Web Categories Web Filter  Categories

122. Default Application Policies Default Web Filter Policies

124. Filtering Adult Content in case Safe Search is enabled

135. Anti Virus General Configuration Anti Virus  Mail  Configuration

137. Default SMTP scanning rule Anti Virus  Mail  SMTP Scanning Rules The default rules scans emails from any sender / recipient. Apply scanning in the appropriate firewall rule to scan incoming & outgoing emails.

138. Custom SMTP rules Anti Virus  Mail  Address Groups  Add Use address group to create custom rules The above custom rule will block all executable attachments for the recipient sales.manager@abc.com

142. How does Cyberoam HTTP AV work? Blocks all virus infected files being downloaded Cyberoam Virus Definition includes - Viruses - Worms - Trojans & Spyware - Hacker Utilities - Malware How does it help? - Blocks spyware not only from spyware sites but also from innocent sites - Malware being stopped at gateway level

144. HTTP Antivirus Configuration Anti Virus  HTTP  Configuration Anti Virus  HTTP  Scanning Rules Note: Default mode selected is batch mode.

145. Gateway Anti-Spam

148. Spam Detection Process

151. Enabling IP Reputation Anti Spam  Configuration

152. Global Spam Digest Settings Anti Spam  Quarantine  Spam Digest Settings Set the email frequency & from email address.

153. Enable User based Spam Digest Enable Spam Digest settings on user or group level.

154. User Quarantine Area

155. Few On-appliance Mail Reports Mail Usage Report: Top Mail Senders iView the open source reporting software powered by Cyberoam is integrated as the Cyberoam’s on-appliance reporting tool starting with Version X.

156. Few On appliance Mail Reports Spam Report: Top Applications used for Spam

157. On appliance Mail Reports Anti Virus Report: Top Viruses

159. IPS acts as the Second layer of defense, It scans the traffic that has been allowed by the firewall for threats. Introduction to IPS

161. IPS  Policy  General Policy Default IPS Policy IPS  Policy Cyberoam offers four pre-defined policies to choose from. General Policy, LANtoWAN strict, LANtoWAN general & DMZ policy. Seen above are the signature categories.

162. IPS Reports Reports  Attacks (IPS)

169. Default VPN Zone Being a zone based firewall, Cyberoam creates the VPN zone which is used while creating firewall rules to control VPN traffic. Network  Interface  Zone

170. Default VPN Zone Creation of firewall rules using the VPZ zone.

171. VPN Configuration & TFT

172. IPSec (Remote Access) VPN  IPSec Configure

173. IPSec (Site-to-Site) VPN  IPSec Configure

174. L2TP VPN  L2TP Configure

175. L2TP VPN  L2TP  Connection

176. PPTP VPN  PPTP

177. L2TP & PPTP Host Objects Objects  Hosts  IP Host Cyberoam creates PPTP & L2TP hosts by default which can be used while creating firewall rules to control VPN traffic.

178. Default VPN firewall rules

179. Custom VPN firewall rules Creating custom firewall rules using the L2TP/PPTP host objects to control the remote access traffic.

183. Global Setting page allows you to configure certain parameters globally for both the type of Access Select protocol TCP or UDP from the dropdown list. Selected network protocol will be the default protocol for all the SSL VPN clients. Connection over UDP provides better performance. SSL certificate from the dropdown list to be used for authentication. If you do not have certificate Specify the range of IP addresses reserved for the SSL Clients. SSL clients will be leased IP address from the configured pool.

186. Select tunnel type Select the access mode by clicking the appropriate option Bookmarks are the resources that will be available through Web portal Accessible Resources allows restricting the access to the certain hosts of the private network SSL-VPN Policy Creation

187. SSL-VPN Portal SSL-VPN users authenticate on the portal with their username/password. If Cyberoam is integrated with external authentication server, the user needs to enter the credentials accordingly.

188. Once logged into the portal the users get access to the bookmarks & the link to download the configuration file required for tunnel mode access. SSL-VPN Portal (Welcome Page)

192. Multilink Configuration

196. Weight: 3 Weight: 1 Active-Active gateway load balancing

197. Setup Gateway- Configure Weights Network  Gateway  Click on the gateway name By default Cyberoam assigns the weight as 1 to all the gateways configured using the initial network configuration wizard. One needs to change the weights of the gateway manually as shown above.

200. Gateways configured as Active

201. Enable load balancing in Firewall Rule

202. Active-Passive Gateway Failover

205. A backup gateway is the one that can be used in an active/passive setup. The traffic is routed through Backup gateway only when Active gateway is down Backup gateway with failover condition Network  Gateway  Click on the gateway name

206. Automatic Failover Backup gateway will take over and traffic will be routed through backup gateway when any of the active gateway fails Backup gateway will take over and traffic will be routed through backup gateway when all the configured active gateways fail Backup gateway will take over and traffic will be routed through back up gateway if ISP1 gateway fails Configure when the Backup gateway should take over the active gateway.

207. Manual Gateway Failover Administrator has to manually change the gateway if the active gateway fails . If you want Backup gateway to inherit the parent gateway’s (Active gateway) weight specify weight.

208. Enable Active-Passive gateway configuration through firewall rule Create a firewall rule for top management Route the traffic through one gateway Configure the another available gateway as Backup

212. The above example defines a static route where all requests destined for 4.2.2.2 will always be routed via 1.1.1.1 (Port B). This traffic will be dropped in case the interface is down. Static Routing Network  Static Route  Unicast

213. Static routing method satisfies most of the requirements, but is limited to forwarding based on destination address only. Policy based routing is extended static routes which provide more flexible traffic handling capabilities. It allows for matching based upon source address, service/application, and gateway weight for load balancing. Hence, it offers granular control for forwarding packets based upon a number of user defined variables like: • Destination • Source • Application • Combination of all of the above Policy Based Routing

214. With the above firewall rule all HTTP traffic from LAN-WAN will be load balanced. Policy Based Routing

215. With the above firewall rule all SMTP traffic from LAN-WAN will always be routed via ISP1. This traffic will be routed via ISP2 (backup) while ISP1 is down. Policy Based Routing

216. Source Network routing allows Administrators to direct traffic generated from particular Network over designated links according to the business policies. When you define Source based routing for a particular subnet, all the traffic coming from that subnet will be forwarded to the defined Interface. Source Based Routing Network  Static Route  Source Route All the traffic from network 192.168.1.0/24 will always be routed via ISP1 gateway

218. OSPF (Open Shortest Path First) is one of IGPs (Interior Gateway Protocols). Compared with RIP, OSPF can serve much more networks and period of convergence is very short. OSPF is widely used in large networks such as ISP backbone and enterprise networks. The Cyberoam implementation of OSPF supports OSPF version 2 (as described in RFC 2328) and plain text and Message Digest 5 (MD5) authentication Dynamic Routing - OSPF

219. BGP (Border Gateway Protocol) is a path vector protocol that is used to carry routing between routers that are in the different administrative domains (Autonomous Systems) e.g. BGP is typically used by ISPs to exchange routing information between different ISP networks. The Cyberoam implementation of BGP supports Version 4 (RFC 1771), Communities Attribute (RFC 1997), Route Reflection (RFC 2796), Multi-protocol extensions (RFC 2858) and Capabilities Advertisement (RFC 2842) Additionally, a firewall rule is to be configured for the zone for which the BGP traffic is to be allowed i.e. LAN to LOCAL or WAN to LOCAL. Dynamic Routing - BGP

220. Configuration of RIP, OSPF & BGP is beyond the scope of CCNSP and is a part of CCNSE curriculum. Please refer the document on Cyberoam knowledgebase sites for configuration: RIP: http://kb.cyberoam.com/default.asp?id=1000&SID=&Lang=1 OSPF: http://kb.cyberoam.com/default.asp?id=999&SID=&Lang=1 BGP: http://kb.cyberoam.com/default.asp?id=1001&SID=&Lang=1 Dynamic Routing - Configuration

221. Cyberoam supports multicast traffic forwarding in both Gateway / Bridge Mode. Multicast forwarding is controlled by specifying static routes for multicast traffic. In Gateway mode, multicast forwarding needs to be enabled and then static routing needs to be configured. In Bridge mode, only multicast forwarding needs to be enabled. Multicast forwarding can be enabled and the mroutes can be added from both the GUI and console. Multicast routing configuration is beyond the scope of CCNSP and is a part of CCNSE curriculum. Refer knowledge base article for multicast routing configuration: http://kb.cyberoam.com/default.asp?id=1021&SID=&Lang=1 Multicast Routing

223. General Administration- Web admin console port settings System  Administration  Settings  Port Settings

225. To create a new administration profile. Role Based Administration System  Administration  Profile  Add

226. As per the above new user configuration, profile option is only activated if we set the user type as Administrator. Here, we have selected the user type as Administrator and we have selected the profile as we created in previous slide. Role Based Administration Attach a profile to a user.

230. The administrator can also configure to receive pre-defined reports via email on a daily or a weekly basis. Logs & Reports  View Reports Report Management

231. Sample Reports: User Wise Reports

232. Sample Reports: Blocked Attempts Report

233. Sample Reports: Application Group Report

234. Sample Reports: Top Web Users Report

237. DHCP Configuration for dynamic lease. DHCP Server Configuration Network  DHCP  Server (Dynamic)

238. DHCP Server Configuration Network  DHCP  Server (Static)

241. Manage ARP Network  ARP

242. NTP configuration for time synchronization System  Time

243. NTP configuration for time synchronization (Wizard)

246. Diagnostic Tools: Services Status System  Maintenance  Services

247. Diagnostic Tools: System health graphs System  System Graphs

249. Event Viewer Logs & Reports  Event Viewer  Web Filter

250. Event Viewer Logs & Reports  Event Viewer  IM

251. Event Viewer Logs & Reports  Event Viewer  Anti Virus

254. On Appliance Help

255. Cyberoam Knowledge Base (http://kb.cyberoam.com)

256. Cyberoam Knowledge Base (http://docs.cyberoam.com)

257. Cyberoam Security Center (http://csc.cyberoam.com)

258. Customer My Account (http://customer.cyberoam.com)

259. Partner Portal (http://partner.cyberoam.com)

261. Email Support: Chat support: http://www.cyberoam.com/presalessupport Presales Contact Details EMEA [email_address] APAC [email_address] Latin America [email_address] North America and Canada [email_address] India [email_address] SAARC Countries [email_address] Region Toll Free Number Non Toll Free Number USA +1-877-777-0368 +1-973-302-8446 Europe +44-808-120-3958 +44-203-355-7917 APAC +1-877-777-0368 +1-973-302-8446 Middle East & Africa +1-877-777-0368 +1-973-302-8446 India 1-800-301-00013 +91-79-66065777

263. Thank You [email_address]