Secure Web GatewaySWG-700/1200 Getting Started Guide

For future reference

SWG-700/1200 serial no:

Date installed:

Smoothwall contact:

Smoothwall® SWG-700/1200, Getting Started Guide, 1st Edition, 2011Smoothwall Ltd. publishes this guide in its present form without any guarantees. This guide replaces any other guides delivered with earlier versions of SWG-700/1200.No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of Smoothwall Ltd. For more information, contact: docs@smoothwall.netThis document was created and published in the United Kingdom.© 2001 – 2011 Smoothwall Ltd. All rights reserved.

Trademark notice

Smoothwall and the Smoothwall logo are registered trademarks of Smoothwall Ltd.Linux is a registered trademark of Linus Torvalds. Snort is a registered trademark of Sourcefire INC. DansGuardian is a registered trademark of Daniel Barron. Microsoft, Internet Explorer, Window 95, Windows 98, Windows NT, Windows 2000 and Windows XP are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Netscape is a registered trademark of Netscape Communications Corporation in the United States and other countries. Apple and Mac are registered trademarks of Apple Computer Inc. Intel is a registered trademark of Intel Corporation. Core is a trademark of Intel Corporation. All other products, services, companies, events and publications mentioned in this document, associated documents and in Smoothwall software may be trademarks, registered trademarks or service marks of their respective owners in the UK, US and/or other countries.

Acknowledgements

Smoothwall acknowledges the work, effort and talent of the Smoothwall GPL development team: Lawrence Manning and Gordon Allan, William Anderson, Jan Erik Askildt, Daniel Barron, Emma Bickley, Imran Chaudhry, Alex Collins, Dan Cuthbert, Bob Dunlop, Moira Dunne, Nigel Fenton, Mathew Frank, Dan Goscomb, Pete Guyan, Nick Haddock, Alan Hourihane, Martin Houston, Steve Hughes, Eric S. Johansson, Stephen L. Jones, Toni Kuokkanen, Luc Larochelle, Osmar Lioi, Richard Morrell, Piere-Yves Paulus, John Payne, Martin Pot, Stanford T. Prescott, Ralf Quint, Guy Reynolds, Kieran Reynolds, Paul Richards, Chris Ross, Scott Sanders, Emil Schweickerdt, Paul Tansom, Darren Taylor, Hilton Travis, Jez Tucker, Bill Ward, Rebecca Ward, Lucien Wells, Adam Wilkinson, Simon Wood, Nick Woodruffe, Marc Wormgoor. SWG-700/1200 contains graphics taken from the Open Icon Library project http://openiconlibrary.sourceforge.net/

Address Smoothwall Limited1 John Charles WayLeeds. LS12 6QAUnited Kingdom

Email info@smoothwall.net

Web www.smoothwall.net

Telephone USA and Canada:United Kingdom:All other countries:

1 800 959 37600870 1 999 500+44 870 1 999 500

Fax USA and Canada:United Kingdom:All other countries:

1 888 899 91640870 1 991 399+44 870 1 991 399

1st Edition

ContentsChapter 1 Introduction .................................................... 1

About this Guide................................................................................ 1Reviewing Package Contents.......................................................... 1Reviewing the Panel ......................................................................... 2The Panel Menu................................................................................. 3

Chapter 2 Quick Start...................................................... 5Getting Started Quickly .................................................................... 5

Chapter 3 Getting Started............................................... 7Installing in a Bridging-only Scenario ............................................. 7Installing in a Basic Installation Scenario....................................... 8Bridge and Admin Installation Scenario ......................................... 9Accessing and Registering ............................................................ 10Changing the IP Address................................................................ 11Configuring SWG-700/1200 on Your Network.............................. 12Installing Updates ........................................................................... 12What next? ....................................................................................... 12Getting the Latest Guardian Blocklists ......................................... 12Deploying a Guardian Web Security Policy .................................. 13Trying to Access a Blocked Site.................................................... 13

i

Contents

1st Edition

ii

Chapter 1

IntroductionWelcome to Smoothwall Secure Web Gateway (SWG-700/1200) – the intelligent web content filter with bridge mode.

About this GuideThis guide comprises:

• This chapter which contains SWG-700/1200 package and panel information

• Chapter 2, Quick Start on page 5 which covers a very quick start

• Chapter 3, Getting Started on page 7 which contains detailed, step-by-step information on how to install and configure SWG-700/1200.

To access all the latest documentation on SWG-700/1200, visit http://www.smoothwall.net/support/

Reviewing Package ContentsYour SWG-700/1200 package contains the items you will need to set up SWG-700/1200 initially.

Verify that you have the following components:

Component Information

SWG-700/1200 The SWG-700/1200 appliance.

AC power cord Provided with SWG-700/1200.

Ethernet crossover cable Provided with SWG-700/1200.

SWG-700/1200 Getting Started Guide

This guide.

Information sheets Applicable warranty and certification sheets.

An RJ45 to DB9 RS232 cable Keep this cable safe and to hand with SWG-700/1200. It may be needed in the future in order to gain RS232 console access.

1

IntroductionReviewing the Panel

Reviewing the Panel

The graphic below provides an overview of SWG-700/1200’s ports, buttons and screen:

Object Description

Ports Port 1 is the default interface.

Port 3 is the first bridge port.

Port 4 is the second bridge port.

Ports 2, 5 and 6 are additional network interfaces.

When configured in bridge mode, and SWG-700/1200 is not powered up, ports 3 and 4 are shorted together. This means that the client network will have unfiltered network access without having to re-cable.

Note: Ports 3 and 4 should not be used for any purpose other than bridging. It is not possible to reuse the ports if bridging mode is not needed.

Console Can be used to connect a serial console and administer SWG-700/1200.

USBs Reserved for future use.

Power Indicates when the power supply to SWG-700/1200 is on. The power switch is at the rear.

To initiate a clean shutdown when SWG-700/1200 is running, press the power switch.

To force a power off, press and hold the power switch for five seconds.

Note: It is not usually necessary to use the power switch to power on SWG-700/1200, as applying mains power should automatically start it.

Hard disk drive

Indicates hard disk drive activity.

Reset Can be used to reset SWG-700/1200 if it becomes unresponsive.

Screen By default, the panel screen runs in information mode and displays the following information:

• Current bandwidth usage on the external connection

• The internal IP address

• Current memory usage

• The hostname

• Time and date.

This is also where you view and access the panel menu options available.

Up Used to access and scroll through the panel menu.

Down Used to access and scroll through the panel menu.

ESC Used to cancel panel menu options.

2

Smoothwall SWG-700/1200Getting Started Guide

The Panel MenuThe panel menu enables you to reset administrator access and settings as well as reboot or shut down SWG-700/1200.

To access the panel menu:

1 Press either the Up or Down button to access the menu.

2 Continue to press the Up or Down button to navigate through the various menu options. The menu options available are:

3 Select the option you require and press ENTER to confirm your selection.

ENTER Used to select and confirm panel menu options. This button can also be used to advance the display of information when the LCD is in idle mode.

Option Description

Reset Admin Access Select to re-set the default rule which allows administrators to access and configure SWG-700/1200 from any source IP that can route to the first network interface.

Restore Default Settings

Restores SWG-700/1200 to the settings it had on first boot.

Reboot Reboots SWG-700/1200 immediately.

Shutdown Prompts SWG-700/1200 to perform a system shutdown.

Object Description

3

IntroductionReviewing the Panel

4

Chapter 2

Quick Start In this chapter:

• A quick start for bridge mode installation of SWG-700/1200.

Getting Started QuicklyBy following and completing all the steps in this chapter, you will configure SWG-700/1200 in transparent bridge mode, enabling client machines connected, via your network switch, to Port 3 to connect to your Internet connection in the regular way.

To get SWG-700/1200 up and running:

1 Connect an Ethernet cable from Port 3 to your client PC network switch (or straight to a PC via the included crossover cable).

2 Connect an Ethernet cable from Port 4 to your network firewall/internet router and using the supplied AC power cord, connect SWG-700/1200 to the power supply. SWG-700/1200 boots.

3 On a network-connected computer, browse to SWG-700/1200 at: https://192.168.111.1:441/ The computer must be on the same subnet, e.g. IP set to 192.168.111.2

4 Accept the SWG-700/1200 security certificate and log on using the default username: admin and the password: smoothwall.

5 If prompted to, enter and confirm SWG-700/1200's serial number and registration details.

Note: Ensure that you have entered the correct serial number as the serial number determines how your SWG-700/1200 is configured.

6 When prompted, click Confirm, wait for SWG-700/1200 and then log in again. When prompted, set the timezone, enter new admin and root passwords and select a web filtering policy. Click Save. SWG-700/1200 displays the control page.

7 Browse to Interfaces > Interfaces and locate the Settings area:

8 Set the Default Interface to Port 3 to Port 4. Enter the Primary DNS and Default Gateway of your upstream firewall or router device and click Save.

5

Quick StartGetting Started Quickly

9 Browse further down the same page to the Port 3 to Port 4 area:

10 Configure SWG-700/1200 with a static IP address on your network. Click Save at the bottom of the page and then click Restart to restart networking.

11 Reconfigure your client machine to an IP address on your regular network subnet (or use DHCP), and reconnect to the web GUI at: https://ip_you_gave_Smoothwall_SWG:441

12 Browse to guardian > proxy > web proxy and click Save and Restart. This step is needed whenever you change the network address for SWG-700/1200.

13 You need to ensure that SWG-700/1200 has all the latest software updates and features. Browse to system > maintenance > updates and click Refresh update list. Click Download Updates and then click Install. When prompted, go to system > maintenance > shutdown, select Immediately and click Reboot. After rebooting, which usually takes a couple of minutes, log in again.

14 You need to ensure that SWG-700/1200 has the latest blocklists. Normally this is done automatically over night. Navigate to system > maintenance > licenses and in the Blocklist subscriptions area, click Check for updates. Click Download update to download the list. When downloaded, click Install and apply changes to deploy the latest blocklist.

SWG-700/1200 is now configured in transparent bridge mode, and client machines connected via your switch to Port 3 will be able to connect to your Internet connection in the regular way configured for your network. All port 80 (web) traffic will be intercepted by SWG-700/1200, and a default CIPA compliant web filtering policy is already enabled.

15 By trying to access a blocked site, you can see SWG-700/1200’s block page. In Internet Explorer, enter: http://www.myspace.com/ SWG-700/1200 blocks access to the site and displays the block page.

For full information on working with SWG-700/1200 and how to customize a web security policy to suit your organization, see your SWG-700/1200 Administrator’s Guide.

6

Chapter 3

Getting StartedIn this chapter:

• A walk through of how to install SWG-700/1200 in a number of scenarios.

Installing in a Bridging-only ScenarioIn this scenario, the bridge is used to both administer SWG-700/1200-700 and 1200 Series and to filter the client network. Admin access can be gained by connecting from either side of the bridge.

To install in bridging-only mode:

1 Place SWG-700/1200 in a stable and secure location.

2 Connect an Ethernet cable from port 3 on the front panel to your client PC switch.

3 Connect an Ethernet cable from port 4 on the front panel of SWG-700/1200 to your network firewall.

Note: It does not matter which of ports 3 and 4 are connected to the switch or the firewall. Ports 1, 2, 5 and 6 can be used as additional network interfaces. There is no need to reconfigure clients on the bridge. As far as they are concerned, the bridge does not exist.

4 Using the supplied AC power cord, connect SWG-700/1200 to the power supply. SWG-700/1200 boots.

Note: If SWG-700/1200 does not power on and boot automatically, on the back panel, switch the power switch to on.

Once installed, you can review the panel menu and access and register SWG-700/1200.

7

Getting Started

Installing in a Basic Installation ScenarioThis is the simplest scenario. SWG-700/1200 is deployed using only one interface plugged into the network.

To configure a basic installation:

1 Place SWG-700/1200 in a stable and secure location.

2 Connect an Ethernet cable from port 1 to your network; the other ports are not used.

3 Using the supplied AC power cord, connect SWG-700/1200 to the power supply. SWG-700/1200 boots.

Note: If SWG-700/1200 does not power on and boot automatically, on the back panel, switch the power switch to on.

Once installed, you can review the panel menu and access and register SWG-700/1200.

8

Smoothwall SWG-700/1200Getting Started Guide

Bridge and Admin Installation ScenarioIn this scenario, port 1 is used only to administer SWG-700/1200. The bridging ports are in use, protecting the client network.

To configure bridging and admin:

1 Place SWG-700/1200 in a stable and secure location.

2 Connect an Ethernet cable from your admin computer to port 1 on the front panel of SWG-700/1200.

3 Connect an Ethernet cable from port 3 on the front panel of SWG-700/1200 to your client PC switch.

4 Connect an Ethernet cable from port 4 on the front panel of SWG-700/1200 to your network firewall.

5 Using the supplied AC power cord, connect SWG-700/1200 to the power supply. SWG-700/1200 boots.

Note: If SWG-700/1200 does not power on and boot automatically, on the back panel, switch the power switch to on.

Note: Ports 2, 5 and 6 can be used as an additional network interface. There is no need to reconfigure clients on the bridge. As far as they are concerned, the bridge does not exist.

9

Getting StartedAccessing and Registering

Accessing and RegisteringTo access SWG-700/1200:

1 On a network-connected computer, start a web browser and connect to SWG-700/1200 using HTTPS.

• In bridging-only mode, enter: https://192.168.111.1:441/

• In basic mode, enter: https://192.168.110.1:441/

Note: Your computer must be in the same subnet as SWG-700/1200. If it is not, you can add an alias or second IP to your computer’s network card, for example: 192.168.111.2 subnet mask 255.255.255.0. If you need to specify a gateway, it could be 192.168.111.1.

2 Accept the SWG-700/1200 security certificate and when the Login page opens, enter the following information:

3 Click Login. The SWG-700/1200 about page opens. Enter the following information:

4 Click Save. SWG-700/1200 prompts you to review the information you have supplied.

Note: Ensure that you have entered the correct serial number as the serial number determines how your SWG-700/1200 is configured.

5 When you are sure that you have entered the correct serial number and other information, and click Confirm. SWG-700/1200 reboots and configures its initial settings.

Note: Rebooting and initial configuration can take up to 5 minutes to complete.

Field Explanation

Username Enter admin – the default account used to administer SWG-700/1200.

Password Enter smoothwall – the default password for the administrator’s account.

Field Enter

Serial no. Your SWG-700/1200 software license key as received from your Smoothwall sales representative or Smoothwall partner.

Name The name of your organization’s contact person for SWG-700/1200.

Organization The name of your organization.

Department The department in which SWG-700/1200 is located.

Locality or town The town your organization is located in.

State The state your organization is located in.

Country The country your organization is located in.

Email The email address of your organization’s contact person for SWG-700/1200.

10

Smoothwall SWG-700/1200Getting Started Guide

6 Once SWG-700/1200 has rebooted, click in the logo. When prompted, re-enter the default username and password. Click Login and when prompted, enter the following information:

7 Click Save. SWG-700/1200 applies your selection and displays the control page which is its default home page. The control page contains external connectivity controls and a number of reports.

Changing the IP AddressAs mentioned in Accessing and Registering on page 10, SWG-700/1200 has pre-assigned internal IP addresses. You may need to change them to make SWG-700/1200 accessible on your network.

To change an IP address:

1 Browse to the Networking > interfaces > interfaces page, locate the interface from the Default interface drop-down list and, in the appropriate Settings area, enter the following settings:

2 Browse to the bottom of the page. Click Save to save the changes and then click Restart to restart networking.

Note: Restarting the networking system can take some time and may interrupt some services.

3 After 15 seconds, in your browser’s address field, enter the new IP address. When prompted, enter your user name and password. SWG-700/1200 now uses the new IP address.

4 Browse to the guardian > proxy > web proxy page and click Save and Restart to apply the changes to the web proxy.

Option/field Description

Timezone From the Timezone drop-down list, select your timezone.

Admin password Enter a new admin password.

Again Re-enter the admin password to confirm it.

Root password Enter a new root password.

Again Re-enter the root password to confirm it.

Initial web filter policy setup

Select one of the following web filter policies:

Workplace web filter policy – This is a less restrictive web filtering policy, it only blocks adult, drug and gambling content.

Workplace/productivity web filter policy – This web filtering policy blocks adult, drug and gambling content. It also blocks social networking and other sites that may impact productivity at work.

Education web filter policy – This web filtering policy is designed to protect students and is quite restrictive. This policy is suitable for use as a BECTA/CIPA compliant policy.

Field Explanation

IP address Enter the IP address you want SWG-700/1200 to use on your internal network.

Netmask If required, enter the netmask SWG-700/1200 should use on your internal network.

11

Getting StartedConfiguring SWG-700/1200 on Your Network

Configuring SWG-700/1200 on Your NetworkTo configure SWG-700/1200 on the network:

1 Browse to the networking > interfaces > interfaces page and configure the following settings:

2 Click Save to save and apply the settings.

Installing UpdatesThe next step is to ensure that SWG-700/1200 has the latest updates installed.

To check for and install updates:

1 On the system > maintenance > updates page, click Refresh update list. The Available updates area displays any updates available. If there are updates available, click Download Updates. SWG-700/1200 downloads the updates.

2 Click Install. SWG-700/1200 installs the updates and prompts you to reboot if necessary.

3 To reboot, go to the system > maintenance > shutdown page. Select Immediately and click Reboot. After rebooting, which usually takes a couple of minutes, log in again.

For full information on configuring and working with SWG-700/1200, see your SWG-700/1200 Administrator’s Guide.

What next?You are now ready to start getting the latest blocklists so that SWG-700/1200 can provide full content filtering for your network.

For more information, see the SWG-700/1200 Administrator’s Guide. You can also visit http://www.smoothwall.net/support/ to access our knowledge base, FAQs and training schedule.

Getting the Latest Guardian Blocklists Blocklists are groups of settings which are updated on a regular basis by Smoothwall to maintain SWG-700/1200’s list of undesirable, inappropriate or objectionable content.

To update blocklists:

1 Navigate to the system > maintenance > licenses page, in the Blocklist subscriptions area, click Check for updates.

2 Click Download update to download the list. When downloaded, click Install and apply changes to deploy the latest blocklist.

Note: After this initial blocklist download, SWG-700/1200 automatically checks for and downloads updated blocklists daily.

Setting Description

Primary DNS Enter the IP address of your primary DNS.

Secondary DNS Optionally, enter the IP address of your secondary DNS.

Default gateway

Enter the IP address of your network’s default gateway.

12

Smoothwall SWG-700/1200Getting Started Guide

Deploying a Guardian Web Security Policy By default, SWG-700/1200 comes with a comprehensive web security policy in place. There are several ways of deploying this policy on users’ computers. All of which are documented in your SWG-700/1200 Administrator's Guide.

In this section, we explain the quickest way to deploy the policy for review and testing purposes.

Note: The following steps explain how to deploy the default web security policy on a user’s computer with Internet Explorer 8 installed as the web browser.

To deploy the policy:

1 Start Internet Explorer, and from the Tools menu, select Internet Options.

2 On the Connections tab, click LAN settings and in the Proxy server area, select Use a proxy server for your LAN …

3 Enter your SWG-700/1200's IP address and port number 800. Click Advanced to access more settings. In the Exceptions area, enter SWG-700/1200’s IP address and any other IP addresses to content that you do not want filtered, for example, your intranet or local wiki.

4 Click OK, OK and OK to save the settings.

Trying to Access a Blocked SiteAs part of its default acceptable usage policy, SWG-700/1200 blocks access to many popular social networking sites, e.g. http://www.myspace.com/

By trying to access this site, you can see SWG-700/1200’s default block page.

To try and access a blocked site:

1 Deploy the default web security policy by configuring Internet Explorer to use SWG-700/1200 as its proxy server. In Internet Explorer, enter: http://www.myspace.com/ SWG-700/1200 blocks access to the site and displays the block page.

For full information on working with SWG-700/1200 and how to customize a web security policy to suit your organization, see the SWG-700/1200 Administrator’s Guide.

13

Getting StartedTrying to Access a Blocked Site

14

.

Copyright Smoothwall Ltd 2001-2011. All rights reserved

UK + INTERNATIONAL USA + CANADA

Smoothwall Ltd1 John Charles WayLeeds LS12 6QAUnited Kingdom

+44 (0)800 5 999 040 UK+44 (0)870 1 999 500 Intlenquiries@smoothwall.netwww.smoothwall.net

Smoothwall Inc6201 Fairview Road, Suite 320Charlotte NC 28210-4274United States of America

1-800-959-3760 USA + Canada1-888-899-9164 Faxinquiries@smoothwall.netwww.smoothwall.net