blockbit gsm administrator guide€¦ · 6.3 installation process .....44 7 network environments 47...

BLOCKBIT GSM Guia do Administrador

© BLOCKBIT 1

BLOCKBIT GSM Administrator Guide

VERSION 1.2.1 February/2019


2 © BLOCKBIT

About this document

The content provided in this document is BLOCKBIT's intellectual property. Its manipulation or reproduction by third-parties, non-authorized employees and disengaged employees without proper, express and prior authorization is prohibited. Subjecting the offender to penalties of law, without prejudice to relevant civil sanctions.

Last Review: February/2019

Release: 2


© BLOCKBIT 3

Contact us:

NORTH AMERICA

703 Waterford Way – 4th floor

Miami – FL 33126 – United States

Phone: +1 305 373 4660

EUROPE

2 Kingdom Street – 6th floor

Paddington – London – W2 6BD – England

Phone: +44 203 580 4321

LATIN AMERICA

Rua Eng. Francisco Pitta Brito 779 – 3º andar

São Paulo – SP – 04753-080 – Brasil

Fone: +55 11 2165 8888

Talk to our specialists:

E-mail: [email protected]

Site: www.blockbit.com

mailto:[email protected]

http://www.blockbit.com/


4 © BLOCKBIT

TABLE OF CONTENTS

1 DOCUMENT VERSION CONTROL 24

2 INTRODUCTION 25

2.1 Resources – BLOCKBIT GSM .............................................................................................. 25

2.2 Features – BLOCKBIT GSM ................................................................................................ 26

2.3 Environment check for BLOCKBIT GSM Installation. ........................................................ 26

2.4 About this Administrator Guide ........................................................................................ 28

3 ARCHITECTURE – BLOCKBIT GSM 29

3.1 Platform ............................................................................................................................ 29

3.2 Architecture ...................................................................................................................... 30

4 INSTALLATION – BLOCKBIT GSM 32

4.1 Importing Virtual Machine ................................................................................................ 32

4.2 Start the Virtual Machine – First Access ..................................................................... 37

5 CONFIGURING THE EXCEPTION 39

5.1 Google Chrome exception configuration .......................................................................... 39

5.2 Mozilla Firefox exception configuration ........................................................................... 40

5.3 Microsoft Internet Explorer exception configuration ....................................................... 42

6 INSTALLATION WIZARD 43

6.1 Language Selection ........................................................................................................... 43

6.2 Wizard actions button....................................................................................................... 43

6.3 Installation process ........................................................................................................... 44

7 NETWORK ENVIRONMENTS 47

8 INTERFACE WEB 50

8.1 Accessing the Web Interface – BLOCKBIT GSM ................................................................ 50

9 BLOCKBIT GSM - MANAGER 52

9.1 Interface Web – User Menu.............................................................................................. 52

9.2 User Menu – “Log Out” ..................................................................................................... 80

10 DEVICE MANAGER 81

10.1 Device Manager Tab ......................................................................................................... 82

10.2 Device Manager – Actions Menu – “Add Group” ............................................................. 92

10.3 Device Manager – Actions Menu – “Delete Groups” ....................................................... 94


© BLOCKBIT 5

10.4 Device Manager – Actions Menu – “Select All Groups” and “Deselect All Groups” ........ 96

10.5 Device Manager – Actions Menu – “Expand all Groups” and “Collapse all Groups” ....... 96

10.6 Device Manager – Actions Menu – Add “Device” ............................................................ 97

10.7 Device Manager – Actions Menu – “Delete Device“ ...................................................... 106

10.8 Device Manager – Actions Menu – “Select all Devices” and “Deselect all Devices”...... 107

10.9 Device Manager – Actions Menu – “Reload Status” ...................................................... 108

10.10 Device Manager – Actions Menu – “Synchronize Devices” ........................................... 109

10.11 Device Manager – Actions Menu – “Update Devices” ................................................... 110

11 DEVICE COMMUNITIES 112

11.1 Device Communities – Actions Menu ............................................................................ 114

11.2 Device Community – “Edit” button ................................................................................ 121

11.3 Device Community – “Delete” button ............................................................................ 122

11.4 Device Community – Exploring BLOCKBIT UTM configurations ..................................... 122

12 DEVICE TEMPLATES 126

12.1 Device Templates – Actions Menu – “Add Template” ................................................... 128

12.2 Device Templates – Actions Menu – “Delete Templates” ............................................. 130

12.3 Device Templates – Actions Menu – “Clone Template” ................................................ 131

12.4 Device Templates – Actions Menu – “Select All” and “Deselect All” ............................. 133

13 POLICY PACKAGES 134

13.1 Policy Packages – Actions Menu – “Create Package” .................................................... 135

13.2 Policy Packages – Actions Menu – “Delete Packages” ................................................... 136

13.3 Policy Packages – Actions Menu – “Clone Packages” .................................................... 138

13.4 Policy Packages – Actions Menu – “Select All” and “Deselect All” ................................ 139

13.5 Policy Packages – Viewing and Feeding Policy Packages ............................................... 139

14 POLICIES TEMPLATES 158

14.1 Policy Templates – Actions Menu – Add Template ........................................................ 159

14.2 Policy Templates – Actions Menu – Delete Templates .................................................. 160

14.3 Policy Templates – Actions Menu – Clone Templates.................................................... 162

14.4 Policy Templates – Actions Menu – Select All and Deselect All ..................................... 163

14.5 Policy Templates – “Edit” Button ................................................................................... 164

14.6 Policy Templates – “Delete” Button ............................................................................... 164

14.7 Policy Templates – Selection Box ................................................................................... 165

14.8 Policy Templates – “View” Button ................................................................................. 166


6 © BLOCKBIT

15 USERS – USERS 175

15.1 Users – Actions Menu – Add to Group ........................................................................... 176

15.2 Users – Actions Menu – Select All and Deselect All ........................................................ 178

16 USERS - GROUPS 179

16.1 User Groups – Actions Menu – Create Group ................................................................ 180

16.2 User Groups – Actions Menu – Delete Group ................................................................ 181

16.3 User Groups – Actions Menu – Select All and Deselect All ............................................. 182

16.4 User Groups – “Edit” Button ........................................................................................... 182

16.5 User Groups – “Delete” Button ...................................................................................... 186

17 OBJECTS 188

17.1 Objects – Address ........................................................................................................... 188

17.2 Objects – Services ........................................................................................................... 194

17.3 Objects – Times ............................................................................................................... 200

17.4 Objects – Schedules ........................................................................................................ 206

17.5 Object – Dictionary ......................................................................................................... 211

17.6 Objects – Content Types ................................................................................................. 218

18 DEPLOYS PANEL 225

18.1 Deploys – Accept, Running, Pending and Error .............................................................. 226

18.2 Deploys Panel – Search and Filters ................................................................................. 227

18.3 Deploys Panel – Deploys List........................................................................................... 227

18.4 Deploys Panel – “Activity”, “Accept”, “Cancel” and “Reinstall” Buttons........................ 232

19 INSTALL PACKAGE 236

19.1 What................................................................................................................................ 236

19.2 Where ............................................................................................................................. 237

19.3 When ............................................................................................................................... 238

19.4 Who ................................................................................................................................. 239

20 BLOCKBIT GSM - ANALYZER 241

20.1 Network Traffic ............................................................................................................... 242

20.2 Policy Usage .................................................................................................................... 253

20.3 Web Filter ....................................................................................................................... 258

20.4 Application Control ......................................................................................................... 273

20.5 Intrusion Prevention ....................................................................................................... 281

20.6 Threat Protection ............................................................................................................ 291


© BLOCKBIT 7

20.7 User Behavior ................................................................................................................. 306

20.8 Reports ........................................................................................................................... 310

20.9 Events ............................................................................................................................. 316

20.10 Loggers ........................................................................................................................... 320

21 INTERFACE BLOCKBIT GSM CLI – COMMAND LINE 340

21.1 [arp] ................................................................................................................................ 341

21.2 [arping] ........................................................................................................................... 343

21.3 [date] .............................................................................................................................. 343

21.4 [debug-deployer] ............................................................................................................ 345

21.5 [debug-sync] ................................................................................................................... 345

21.6 [enable-root] .................................................................................................................. 345

21.7 [ethtool] .......................................................................................................................... 346

21.8 [exit] ............................................................................................................................... 347

21.9 [fdisk] .............................................................................................................................. 347

21.10 [free] ............................................................................................................................... 349

21.11 [fsck] ............................................................................................................................... 350

21.12 [help] .............................................................................................................................. 351

21.13 [history] .......................................................................................................................... 352

21.14 [Hostname] ..................................................................................................................... 353

21.15 [ifconfig] ......................................................................................................................... 354

21.16 [ifstat] ............................................................................................................................. 355

21.17 [iotest] ............................................................................................................................ 356

21.18 [ip] .................................................................................................................................. 357

21.19 [ipcalc] ............................................................................................................................ 357

21.20 [less] ............................................................................................................................... 358

21.21 [logger-config] ................................................................................................................ 359

21.22 [logger-devices-add] ....................................................................................................... 362

21.23 [logger-devices-list] ........................................................................................................ 363

21.24 [logger-disable] ............................................................................................................... 363

21.25 [logger-enable] ............................................................................................................... 363

21.26 [logger-key] .................................................................................................................... 364

21.27 [lscpu] ............................................................................................................................. 364

21.28 [mkfs] .............................................................................................................................. 365

21.29 [more] ............................................................................................................................. 365

21.30 [netstat] .......................................................................................................................... 366


8 © BLOCKBIT

21.31 [ntpdate] ......................................................................................................................... 367

21.32 [passwd] .......................................................................................................................... 367

21.33 [ping] ............................................................................................................................... 368

21.34 [reboot] ........................................................................................................................... 368

21.35 [reset] .............................................................................................................................. 369

21.36 [reset-admin-blocks] ....................................................................................................... 369

21.37 [reset-admin-password].................................................................................................. 369

21.38 [reset-admin-sessions] .................................................................................................... 370

21.39 [reset-logs] ...................................................................................................................... 370

21.40 [rewizard] ........................................................................................................................ 371

21.41 [route] ............................................................................................................................. 371

21.42 [sar] ................................................................................................................................. 372

21.43 [set-network-dns] ........................................................................................................... 373

21.44 [set-network-gateway] ................................................................................................... 374

21.45 [set-network-interface] ................................................................................................... 374

21.46 [set-network-timezone] .................................................................................................. 375

21.47 [show-devices] ................................................................................................................ 375

21.48 [show-uuid] ..................................................................................................................... 376

21.49 [shutdown] ...................................................................................................................... 376

21.50 [tcpdump] ....................................................................................................................... 376

21.51 [tcptop] ........................................................................................................................... 377

21.52 [telnet] ............................................................................................................................ 378

21.53 [tracepath] ...................................................................................................................... 379

21.54 [traceroute] ..................................................................................................................... 380

21.55 [update-gsm] ................................................................................................................... 383

21.56 [uptime] .......................................................................................................................... 383

21.57 [vmstat] ........................................................................................................................... 384

21.58 [whois] ............................................................................................................................ 384


© BLOCKBIT 9

TABLE OF FIGURES

Figure 1 – "Alert". ......................................................................................................................... 28

Figure 2 – CLI – Command Line Interface. .................................................................................... 28

Figure 3 – UTM administrator guide. ........................................................................................... 28

Figure 4 – Architecture – BLOCKBIT GSM platform. ..................................................................... 29

Figure 5 – BLOCKBIT GSM – Architecture. .................................................................................... 30

Figure 6 – Login VMware. ............................................................................................................. 32

Figure 7 – Console VMware. ......................................................................................................... 33

Figure 8 – Select creation type. .................................................................................................... 33

Figure 9 – Select OVF and VMDK files. ......................................................................................... 34

Figure 10 – Select Storage. ........................................................................................................... 34

Figure 11 – Select storage – “Extracting OVA, this could take some time...”. ............................. 35

Figure 12 – Deployment options. ................................................................................................. 36

Figure 13 – Ready to complete. .................................................................................................... 36

Figure 14 – Starting BLOCKBIT GSM for the first time. ................................................................ 37

Figure 15 – BLOCKBIT GSM login screen. ..................................................................................... 37

Figure 16 – Chrome Exception – “Proceed to 172.16.32.212 (unsafe)”. ..................................... 40

Figure 17 – Mozilla Firefox Exception – Your connection is not secure. ...................................... 41

Figure 18 – Mozilla Firefox Exception – Confirm Security Exception. .......................................... 42

Figure 19 – Microsoft Internet Explorer Exception – There is a problem with this website’s security certificate. ....................................................................................................................... 42

Figure 20 – Installation Wizard – Language Selection. ................................................................. 43

Figure 21 – Installation Wizard – “Previous”, “Next” and “Save” buttons. ................................. 43

Figure 22 – Installation Wizard – Accept License. ........................................................................ 44

Figure 23 – Installation Wizard – System Settings. ...................................................................... 44

Figure 24 – Installation Wizard – Network Settings. .................................................................... 45

Figure 25 – Installation Wizard – Administration. ........................................................................ 46

Figure 26 – Network Topology. .................................................................................................... 47

Figure 27 – Management Vision. .................................................................................................. 49

Figure 28 – Login Screen – System Administration. ..................................................................... 50

Figure 29 – Device Manager. ........................................................................................................ 51

Figure 30 – User menu.................................................................................................................. 52

Figure 31 – User menu – Profile. .................................................................................................. 53

Figure 32 – User Menu – Edit Profile. ........................................................................................... 53

Figure 33 – Edit Profile – Change the Password ........................................................................... 54

Figure 34 – User menu – “Settings” button. ................................................................................ 54

Figure 35 – System Settings – Settings. ........................................................................................ 55

Figure 36 – “System”. ................................................................................................................... 55

Figure 37 – System Settings – General ......................................................................................... 56

Figure 38 – “Save”. ....................................................................................................................... 56

Figure 39 – System Settings – System Backup. ............................................................................ 57

Figure 40 – System Settings – System Restore. ............................................................................ 58

Figure 41 – Licensing – PuTTY. ...................................................................................................... 59

Figure 42 –show-uuid. .................................................................................................................. 60

Figure 43 – System Settings - License. .......................................................................................... 60

Figure 44 – Save license. ............................................................................................................... 61


10 © BLOCKBIT

Figure 45 – System Settings – License. ......................................................................................... 61

Figure 46 – System Settings – Update. ........................................................................................ 62

Figure 47 – System Settings – Sessions. ....................................................................................... 63

Figure 48 – Active Sessions. ......................................................................................................... 64

Figure 49 – System Settings – Services. ....................................................................................... 65

Figure 50 – “Network”. ................................................................................................................ 65

Figure 51 – Network Settings. ...................................................................................................... 66

Figure 52 – Network Interfaces. ................................................................................................... 67

Figure 53 – Edit Interface. ............................................................................................................ 67

Figure 54 – Email. ......................................................................................................................... 68

Figure 55 – SMTP connection ok. ................................................................................................. 69

Figure 56 – SMTP connection failed. ............................................................................................ 69

Figure 57 – SMTP invalid login. .................................................................................................... 69

Figure 58 – “Admin”. .................................................................................................................... 70

Figure 59 – Administrators. .......................................................................................................... 70

Figure 60 – Administrators – Actions Menu. ............................................................................... 71

Figure 61 – Edit Profile. ................................................................................................................ 72

Figure 62 - Delete Profile. ............................................................................................................ 73

Figure 63 - Clone Profile. .............................................................................................................. 73

Figure 64 – Select All. ................................................................................................................... 74

Figure 65 – Administrators. .......................................................................................................... 74

Figure 66 – Administrators – Actions Menu. ............................................................................... 75

Figure 67 - Administrators – Actions Menu. ................................................................................ 76

Figure 68 - Delete Users. .............................................................................................................. 77

Figure 69 – Select All. ................................................................................................................... 77

Figure 70 – Botão “Activity”. ........................................................................................................ 78

Figure 71 – Activity. ...................................................................................................................... 78

Figure 72 – Activity – Calendar. ................................................................................................... 79

Figure 73 – Log Out. ..................................................................................................................... 80

Figure 74 – Device Manager – “Device”....................................................................................... 81

Figure 75 – Device Manager......................................................................................................... 81

Figure 76 – Device Manager Screen. ............................................................................................ 82

Figure 77 – Device Manager – Device has no connection – Status Connection error. ................ 82

Figure 78 – Device Manager – Connected Device – Online. ........................................................ 83

Figure 79 – Device Name – Status Connection error. .................................................................. 83

Figure 80 – Device Manager – Online. ......................................................................................... 83

Figure 81 – Action button – Device Name. .................................................................................. 83

Figure 82 – “Access CLI” – Command Line Interface. .................................................................. 84

Figure 83 – “Access Interface Web”. ............................................................................................ 84

Figure 84 – “Access Interface Web” – Blocked Pop-up. .............................................................. 84

Figure 85 – “Update/Synchronize”. ............................................................................................. 85

Figure 86 – Update/Sync Device. ................................................................................................. 85

Figure 87 – Device Name – Synchronize. ..................................................................................... 86

Figure 88 – License Status – License Number. ............................................................................. 86

Figure 89 – License Status. ........................................................................................................... 86

Figure 90 – Device Manager – Version. ....................................................................................... 87


© BLOCKBIT 11

Figure 91 – Device Manager – Devices Template. ....................................................................... 87

Figure 92 – Devices Cluster Head Office – Task Information. ...................................................... 88

Figure 93 – Policy Package – Policies Branch Office. .................................................................... 88

Figure 94 – Policy Package – Task Information. ........................................................................... 89

Figure 95 – Policy Package – Policies Head Office. ....................................................................... 89

Figure 96 – Policy Package – Task Information. ........................................................................... 90

Figure 97 – Device Manager – Botões “Edit”, “Delete” and the checkbox. ................................. 90

Figure 98 – Device Manager – Delete device. .............................................................................. 91

Figure 99 – Device Manager – Action Menu. ............................................................................... 92

Figure 100 – Device Manager – Actions Menu. ............................................................................ 93

Figure 101 – Device Manager – Create Group. ............................................................................ 94

Figure 102 – Device Manager –Actions Menu – Delete Groups. ................................................. 95

Figure 103 – Device Manager – Delete group. ............................................................................. 95

Figure 104 – Device Manager – Select All Groups. ....................................................................... 96

Figure 105 – Device Manager – Actions Menu – Add Device....................................................... 97

Figure 106 – Device Manager – Add Device. ................................................................................ 98

Figure 107 – BLOCKBIT UTM – Menu System – Administration................................................... 99

Figure 108 – BLOCKBIT UTM – Menu System – Administration – Tab “Central Management”. . 99

Figure 109 – Generate new deploy key. ..................................................................................... 100

Figure 110 – Deploy key. ............................................................................................................ 100

Figure 111 – Generate new API key. .......................................................................................... 101

Figure 112 – API key. .................................................................................................................. 101

Figure 113 – Text copied to the clipboard – Deploy Key. ........................................................... 101

Figure 114 – BLOCKBIT UTM – “Central Management” tab. ...................................................... 102

Figure 115 – BLOCKBIT GSM – Add Device – Deploy Key. .......................................................... 102

Figure 116 – Text copied tro the clipboard– API Key. ................................................................ 103

Figure 117 – BLOCKBIT GSM – Add Device – API Key. ................................................................ 103

Figure 118 – Device Manager – Add Device – example. ............................................................ 104

Figure 119 – The queue of saved settings. ................................................................................. 105

Figure 120 – Device Manager – Established communication. ................................................... 105

Figure 121 – Device Manager – Registered devices. .................................................................. 106

Figure 122 – Device Manager – Selected Devices. ..................................................................... 106

Figure 123 – Device Manager – Actions Menu – Delete Devices ............................................... 107

Figure 124 – Device Manager – Remove Devices....................................................................... 107

Figure 125 – Device Manager – Select All Devices. .................................................................... 108

Figure 126 – Device Manager – Actions Menu – Reload Status. ................................................ 109

Figure 127 - Reload all devices. .................................................................................................. 109

Figure 128 – Device Manager – Actions Menu – Synchronize. .................................................. 110

Figure 129 – Device Manager – Actions Menu – Update Devices. ............................................ 111

Figure 130 - Update devices. ...................................................................................................... 111

Figure 131 – Device Communities – Topology Full Meshed. ..................................................... 112

Figure 132 – Device Communities – Topology Star. ................................................................... 113

Figure 133 – “Devices”. ............................................................................................................... 113

Figure 134 – “Device Communities” tab. ................................................................................... 113

Figure 135 – Device Communities. ............................................................................................. 113

Figure 136 – Device Communities – Actions Menu. ................................................................... 114


12 © BLOCKBIT

Figure 137 – Device Communities – Actions Menu. .................................................................. 115

Figure 138 – Device Communities – Actions Menu – Add Communities. ................................. 115

Figure 139 – Device Community – Create Community. ............................................................. 116

Figure 140 – Device Community – General. ............................................................................... 117

Figure 141 – Device Communities – Menu Device. ................................................................... 117

Figure 142 – Device Communities – Actions Menu – Add Device. ............................................ 117

Figure 143 – Device Communities – Add Device. ...................................................................... 118

Figure 144 – Device Communities – Registered Devices. .......................................................... 119

Figure 145 – Device Communities – "Save". .............................................................................. 119

Figure 146 – Device Community – Device Communities Selection. .......................................... 119

Figure 147 – Device Communities – Actions Menu – Delete Communities. ............................. 120

Figure 148 – Device Communities – Remove Communities. ..................................................... 120

Figure 149 – Device Communities – Select All. .......................................................................... 120

Figure 150 – Device Community – “Edit” Button. ...................................................................... 121

Figure 151 – Device Communities – “Save” Button. .................................................................. 121

Figure 152 – Device Community – Delete selected item. .......................................................... 122

Figure 153 – VPN IPSEC – BLOCKBIT UTM HUB – Topology Star. .............................................. 123

Figure 154 – VPN IPSEC – BLOCKBIT UTM SPOKES – Topology Star. ......................................... 123

Figure 155 – VPN IPSEC – BLOCKBIT UTM Topology Full Meshed. ............................................ 124

Figure 156 – VPN IPSEC – BLOCKBIT UTM Topology Full Meshed and other devices. .............. 124

Figure 157 – IPsec connections – BLOCKBIT UTM. .................................................................... 125

Figure 158 – Button “Devices”. .................................................................................................. 126

Figure 159 – Device Templates. ................................................................................................ 126

Figure 160 – Device Templates – Actions Menu and Template Column. .................................. 126

Figure 161 – Device Templates – Actions Menu. ....................................................................... 127

Figure 162 – Device Templates – Add Template........................................................................ 128

Figure 163 – Device Templates – New Template. ...................................................................... 128

Figure 164 – Device Templates – Edit Template. ....................................................................... 129

Figure 165 – Device Templates – Set of configurations. ............................................................ 130

Figure 166 – Device Templates – "Save". ................................................................................... 130

Figure 167 – Device Templates – Selection of Templates that will be deleted. ........................ 131

Figure 168 – Device Templates – Delete Templates. ................................................................. 131

Figure 169 – Device Templates – Delete Template. .................................................................. 131

Figure 170 – Device Templates – Actions Menu – Clone Templates. ........................................ 132

Figure 171 – Device Templates – Clone Template. .................................................................... 132

Figure 172 – Clone template. ..................................................................................................... 132

Figure 173 – Device Templates – Cloned Device Template. ...................................................... 133

Figure 174 – Device Templates – Select All................................................................................ 133

Figure 175 – Policy Manager – “Policies”................................................................................... 134

Figure 176 – “Policy Packages” tab. ........................................................................................... 134

Figure 177 – Policies – Policy Manager. ..................................................................................... 134

Figure 178 – Policy Manager – Actions Menu. .......................................................................... 135

Figure 179 – Policy Manager – New Policy Package. ................................................................. 136

Figure 180 – Policy Manager – Delete Packages. ....................................................................... 137

Figure 181 – Policy Manager – Actions Menu – Delete Packages. ............................................ 137

Figure 182 – Policy Manager – Remove Packages? ................................................................... 137


© BLOCKBIT 13

Figure 183 – Policy Manager – Selection of packages to be cloned. ......................................... 138

Figure 184 – Policy Manager – Actions Menu – Clone Packages. .............................................. 138

Figure 185 – Policy Manager – Clone Selected Itens. ................................................................. 138

Figure 186 – Policy Manager – Policie Package Clonada. ........................................................... 139

Figure 187 – Policy Manager – Policie Package “Select All”. ...................................................... 139

Figure 188 – Policy packages – “List Group Policies”. ................................................................ 140

Figure 189 – Policy Manager – Policies Branch office. ............................................................... 140

Figure 190 – Policy Manager – Actions Menu – Create Policy Group. ....................................... 141

Figure 191 – Policy Manager – Create a Policy Group – New Group. ........................................ 141

Figure 192 – Policy Manager – Policies Branch office – Administrator Access. ......................... 142

Figure 193 – Policy Manager – Access Administration – Action Buttons. .................................. 142

Figure 194 – Policy selected to be removed. ............................................................................. 142

Figure 195 – Policy Manager – Menu Actions – “Delete Policies”. ............................................ 143

Figure 196 – Policy Manager – Delete itens policies. ................................................................. 143

Figure 197 – Selected policy to be moved. ................................................................................. 144

Figure 198 – Policy Manager – Actions Menu – Move Policies. ................................................. 144

Figure 199 – Policy Manager – Move Policy. .............................................................................. 144

Figure 200 – Policy Manager – Actions Menu – Import Template. ............................................ 145

Figure 201 – Policy Manager – Template Name. ....................................................................... 145

Figure 202 – Group selection – Salve Template. ........................................................................ 146

Figure 203 – Group Selection – Save Template. ......................................................................... 146

Figure 204 – Policy Manager – Actions Menu – Save Template. ............................................... 147

Figure 205 – Message – Successfully. ......................................................................................... 147

Figure 206 – Policy Manager – Actions Menu – Create Policy. .................................................. 148

Figure 207 – Policy Manager – New Policy. ................................................................................ 149

Figure 208 – Policy Manager – New Policy – General. ............................................................... 150

Figure 209 – Policy Manager – New Policy – “Save”. ................................................................. 150

Figure 210 – Policy Manager – Policy Manager Policies Branch office. ..................................... 150

Figure 211 – Policy Manager – Access Administration............................................................... 151

Figure 212 – Policy selected to be deleted. ................................................................................ 151

Figure 213 – Policy Manager – Actions Menu – Delete Policies. ............................................... 152

Figure 214 – Policy Manager – Delete itens policies. ................................................................. 152

Figure 215 – Policy Manager – Actions Menu – Move Policies. ................................................. 153

Figure 216 – Policy Manager – Move Policy. .............................................................................. 153

Figure 217 – Policy Manager – Actions Menu – Delete Tag. ...................................................... 154

Figure 218 – Policy Manager – Delete Tags. ............................................................................... 154

Figure 219 – Policy Manager – Actions Menu – Valid. ............................................................... 155

Figure 220 – Policy Manager – Delete Tags. ............................................................................... 155

Figure 221 – Policy Manager – Actions Menu – Collapse All. .................................................... 156

Figure 222 – Policy Manager – Policies collected. ...................................................................... 156

Figure 223 – Policy Manager – Actions Menu – Expand All. ...................................................... 157

Figure 224 – Policy Manager – Expanded Policies. .................................................................... 157

Figure 225 – Policy Template – “Policies”. ................................................................................. 158

Figure 226 – Policy Templates. ................................................................................................... 158

Figure 227 – Policies – Policy Templates. ................................................................................... 159

Figure 228 – Policy Templates – Actions Menu. ......................................................................... 159


14 © BLOCKBIT

Figure 229 – Policy Templates – Actions Actions. ...................................................................... 159

Figure 230 – Policy Template – New Policy Template. .............................................................. 160

Figure 231 – Policy Templates – Selection of Templates to be deleted. ................................... 161

Figure 232 – Policy Templates – Delete Templates. .................................................................. 161

Figure 233 – Policy Templates – Remove the template message. ............................................ 161

Figure 234 – Policy Templates – Selection of Templates to be cloned...................................... 162

Figure 235 – Policy Templates – Clone Templates. .................................................................... 162

Figure 236 – Policy Templates –Clone Template messsage. ..................................................... 162

Figure 237 – Policy Templates – Cloned Template. ................................................................... 163

Figure 238 – Policy Templates – Select All. ................................................................................ 163

Figure 239 – Policy Templates – Edit Template. ....................................................................... 164

Figure 240 – Policy Templates – “Delete”. ................................................................................. 165

Figure 241 – Policy Templates – Remove Template message. .................................................. 165

Figure 242 – Policy Templates – Selected. ................................................................................. 166

Figure 243 – Policy Templates – View Template. ..................................................................... 166

Figure 244 – Policy Templates – Tags. ....................................................................................... 168

Figure 245 – Policy Templates – Search by Tags. ....................................................................... 168

Figure 246 – Policy Templates – Actions Menu. ........................................................................ 169

Figure 247 – Policy Templates – Actions Menu – Create Policy. ............................................... 169

Figure 248 – Policy Templates – New Policy. ............................................................................. 170

Figure 249 – Policy Templates – Actions Menu – Move Policies. .............................................. 171

Figure 250 – Policy Templates – Move Policy. ........................................................................... 171

Figure 251 – Policy selected to be deleted. ............................................................................... 171

Figure 252 – Policy Templates – Menu Actions – Delete Policies. ............................................. 172

Figure 253 – Policy Templates – Delete itens policies. .............................................................. 172

Figure 254 – Policy Templates – Actions Menu – Delete Tag. ................................................... 173

Figure 255 – Policy Templates – Delete Tags. ............................................................................ 173

Figure 256 – Policy Templates – Actions Menu – Valid. ............................................................ 174

Figure 257 – Policy Templates – Delete Tags. ............................................................................ 174

Figure 258 – Users – “Users”. ..................................................................................................... 175

Figure 259 – Users – Users. ........................................................................................................ 175

Figure 260 – Users main screen. ................................................................................................ 176

Figure 261 – Users – Actions. ..................................................................................................... 176

Figure 262 – Users – Selection of users to bea added. .............................................................. 177

Figure 263 – Users – Add to group. ............................................................................................ 177

Figure 264 – Users – Add users to group. .................................................................................. 177

Figure 265 – Users – Select All. .................................................................................................. 178

Figure 266 – Users. ..................................................................................................................... 179

Figure 267 – Users – User Groups. ............................................................................................. 179

Figure 268 – Users Groups. ........................................................................................................ 179

Figure 269 – User Groups – Menu Actions- Create Group. ....................................................... 180

Figure 270 – User Groups – Create Group. ................................................................................ 180

Figure 271 – User Groups – Groups you want to delete. .......................................................... 181

Figure 272 – User Groups – Actions Menu. ............................................................................... 181

Figure 273 – User Groups – Message asking if you wish to delete the user(s). ........................ 182

Figure 274 – User Groups – Select All. ....................................................................................... 182


© BLOCKBIT 15

Figure 275 – User Groups – Registered users. ........................................................................... 183

Figure 276 – User Groups – Add User and Delete Users. ........................................................... 183

Figure 277 – User Groups – Add Users. ...................................................................................... 184

Figure 278 – User Groups – Added group users. ........................................................................ 184

Figure 279 – User Groups – User selected to be deleted. .......................................................... 185

Figure 280 – User Groups – Delete Users. .................................................................................. 185

Figure 281 – User Groups – Message asking if you wish to delete the user(s). ......................... 185

Figure 282 – User Groups – “Save” Settings............................................................................... 186

Figure 283 – User Groups – “Save” Button. ............................................................................... 186

Figure 284 – User Groups – Main Screen. .................................................................................. 186

Figure 285 – User Groups – Delete items. .................................................................................. 187

Figure 286 – Objects. .................................................................................................................. 188

Figure 287 – Objects – Address. ................................................................................................. 188

Figure 288 – Objects – Address Objects. .................................................................................... 189

Figure 289 – Objects – Menu Actions. ........................................................................................ 189

Figure 290 – Objects – Object Address – Create Object. ........................................................... 190

Figure 291 – Objects – Create address object. ........................................................................... 190

Figure 292 – Objects – Address Objects – Objects selected to be deleted. ............................... 191

Figure 293 – Objects – Address Object – Delete Object. ........................................................... 192

Figure 294 – Objects – Message asking if you want to delete objects. ..................................... 192

Figure 295 – Objects – Select All. ............................................................................................... 192

Figure 296 – Objects – Edit Address Object. .............................................................................. 193

Figure 297 – Address Objects – Message asking if you want to delete the selected item. ....... 194

Figure 298 – “Objects” button. ................................................................................................... 194

Figure 299 – Objects – Services. ................................................................................................. 194

Figure 300 – Service Objects. ..................................................................................................... 195

Figure 301 – Objects – Actions Menu. ........................................................................................ 195

Figure 302 – Service Objects – Create Object. ........................................................................... 196

Figure 303 – Service Objects – Create Service Objects. ............................................................. 196

Figure 304 – Service Objects – Objects selected to be deleted. ................................................ 197

Figure 305 – Service Objects – Delete Object. ........................................................................... 197

Figure 306 – Service Objects – Message asking if you want to delete the objects. ................... 198


Figure 308 – Service Objects – “Edit” button. ............................................................................ 199

Figure 309 – Service Objects – Message asking if you want to delete the selected item. ........ 200

Figure 310 – “Objects” button. ................................................................................................... 200

Figure 311 – Objects – Time. ...................................................................................................... 200

Figure 312 – Time Objects. ......................................................................................................... 201

Figure 313 – Objects – Actions Menu. ........................................................................................ 201

Figure 314 – Objects time – Create Object. ............................................................................... 202

Figure 315 – Objects Time – Create a schedule object. ............................................................. 202

Figure 316 – Time Objects – Objects selected to be deleted. .................................................... 203

Figure 317 – Time Objects – Delete Objects. ............................................................................. 203

Figure 318 – Time Objects – Mesage if you want to delete objects. ......................................... 203


Figure 320 – Time Objects – “Edit” Button................................................................................. 205


16 © BLOCKBIT

Figure 321 – Time Objects – Message asking iuf you want to delete the selected item. ......... 206

Figure 322 – “Objects” Button. .................................................................................................. 206

Figure 323 – Objects – Period/Dates. ........................................................................................ 206

Figure 324 – Schedule Objects. .................................................................................................. 207

Figure 325 – Objects – Actions Menu. ....................................................................................... 207

Figure 326 – Date Objects – Create Object. ............................................................................... 208

Figure 327 – Schedule Objects – Create Date Objects. .............................................................. 208

Figure 328 – Date Objects – Message asking if you want to delete objects. ............................ 209


Figure 330 – Schedule Objects – “Edit” button. ........................................................................ 210

Figure 331 – Schedule Objects – Message asking if you want to delete the selected item. ..... 211

Figure 332 – “Objects” button. .................................................................................................. 211

Figure 333 – Objects – Dictionaries. .......................................................................................... 212

Figure 334 – Objects – Dictionary Objects ................................................................................. 212

Figure 335 – Objects – Actions Menu. ....................................................................................... 212

Figure 336 – Objects – Dictionary Object – Create Object. ....................................................... 213

Figure 337 – Objects – Create a Dictionary object. .................................................................... 214

Figure 338 – Objects – Dictionary Objects – Objects selected to be deleted. ........................... 215

Figure 339 – Objects – Dictionary Objects – Delete Object. ...................................................... 215

Figure 340 – Objects – Message asking if you want to delete the objects. ............................... 215


Figure 342 – Dictionary Objects – “Edit” Button. ...................................................................... 217

Figure 343 – Dictionary Objects – Message asking if you want to delete the selected item. ... 218

Figure 344 – “Objects” button. .................................................................................................. 218

Figure 345 – Objects – Content Types. ...................................................................................... 218

Figure 346 – Content Type Objects. ........................................................................................... 219

Figure 347 – Content Type Objects – Create Object. ................................................................. 219

Figure 348 – Content Type Objects – Create a mime object. .................................................... 220

Figure 349 – Content Type Objects – Objects selected to be deleted....................................... 221

Figure 350 – Content Type Objects – Delete Object. ................................................................. 221

Figure 351 – Content Type Objects – Message asking if you want to delete objects. .............. 221


Figure 353 – Content Type Objects – “Edit” button. ................................................................. 223

Figure 354 – Content Types Objects – Message asking if you want to delete the selected item. .................................................................................................................................................... 224

Figure 355 – Botão “Deploys Panel”. ......................................................................................... 225

Figure 356 – Deploys Panel – List. .............................................................................................. 225

Figure 357 – “Deploys” button. .................................................................................................. 225

Figure 358 – Deploys. ................................................................................................................. 226

Figure 359 – Deploys Panel – Information Panel. ...................................................................... 226

Figure 360 – Deploys Panel – Deploys Search. .......................................................................... 227

Figure 361 – Deploys Panel – Switch Pages. .............................................................................. 227

Figure 362 – Deploys Panel – Deploy List. ................................................................................. 228

Figure 363 – Deploys Panel – Deploys Approval Proccess. ........................................................ 229

Figure 364 – Deploys Panel – Deploy Information..................................................................... 230

Figure 365 – Deploys Panel – Auditor. ....................................................................................... 230


© BLOCKBIT 17

Figure 366 – Deploys Panel – Scheduled. ................................................................................... 230

Figure 367 – Deploys Panel – Progress. ...................................................................................... 231

Figure 368 – Deploys Panel – Device Status. .............................................................................. 231

Figure 369 – Deploys Panel – Error Message. ............................................................................ 232

Figure 370 – “Accept” button. .................................................................................................... 232

Figure 371 – “Accept Package” button. ...................................................................................... 232

Figure 372 – “Reinstall” button. ................................................................................................. 233

Figure 373 – Reinstall Deploy. .................................................................................................... 233

Figure 374 – “Cancel” Button. .................................................................................................... 233

Figure 375 – Cancel Package installation. .................................................................................. 234

Figure 376 – Deploys Panel Action Buttons – "Activity". ........................................................... 234

Figure 377 – “Deploy Activity” button........................................................................................ 234

Figure 378 – “Remove” Button. .................................................................................................. 235

Figure 379 – Remove Deploy. ..................................................................................................... 235

Figure 380 – “Install Package” Button. ....................................................................................... 236

Figure 381 – Install Package. ...................................................................................................... 236

Figure 382 – Install Package – What. .......................................................................................... 237

Figure 383 – Install Package – Where......................................................................................... 238

Figure 384 – Install Package – When. ......................................................................................... 239

Figure 385 – Install Package – Who. ........................................................................................... 240

Figure 386 – BLOCKBIT GSM – Acessing the Analyzer. ............................................................... 241

Figure 387 – BLOCKBIT GSM – Home Screen. ............................................................................ 242

Figure 388 – Network Traffic. ..................................................................................................... 242

Figure 389 – Network Traffic – Selection Box. ........................................................................... 243

Figure 390 – Network Traffic –Device Selection. ....................................................................... 243

Figure 391 – Network Traffic – Date Selection. .......................................................................... 244

Figure 392 – Network Traffic – Calendar. ................................................................................... 245

Figure 393 – Network Traffic – Geolocation Hits. ...................................................................... 246

Figure 394 – Network Traffic – Bandwidth. ................................................................................ 247

Figure 395 – Network Traffic – Total Traffic. .............................................................................. 247

Figure 396 – Network Traffic – Zone Traffic. .............................................................................. 248

Figure 397 – Network Traffic – Zone Users. ............................................................................... 249

Figure 398 – Network Traffic – Top Services. ............................................................................. 250

Figure 399 – Network Traffic – Top Sources. ............................................................................. 251

Figure 400 – Network Traffic – Top Destination. ....................................................................... 253

Figure 401 – Network Traffic – Policy Usage. ............................................................................. 253

Figure 402 – Tooltip – Select a device. ....................................................................................... 253

Figure 403 – Policy Usage – Global Tags. ................................................................................... 254

Figure 404 – Policy Usage – Top Policies. ................................................................................... 255

Figure 405 – Policy Usage – History Traffic. ............................................................................... 255

Figure 406 – Policy Usage – Top Users. ...................................................................................... 256

Figure 407 – Policy Usage – Top Source. .................................................................................... 257

Figure 408 – Policy Usage – Top Destination. ............................................................................ 258

Figure 409 – Web Filter. ............................................................................................................. 259

Figure 410 – Web Filter – Traffic. ............................................................................................... 260

Figure 411 – Web Filter – Sites Allowed. .................................................................................... 261


18 © BLOCKBIT

Figure 412 – Web Filter – Denied Sites. ..................................................................................... 262

Figure 413 – Web Filter – Users – Total Hits. ............................................................................. 263

Figure 414 – Web Filter – Users – Total Hits. ............................................................................. 263

Figure 415 – Web Filter – Top Users. ......................................................................................... 264

Figure 416 – Web Filter – Policies – Total Traffic. ...................................................................... 265

Figure 417 – Web Filter – Policies – Total Hits. .......................................................................... 265

Figure 418 – Web Filter – Top Policies. ...................................................................................... 266

Figure 419 – Web Filter – Categories – Total Traffic. ................................................................. 267

Figure 420 – Web Filter – Categories – Total Hits. ..................................................................... 268

Figure 421 – Web Filter – Top categories. ................................................................................. 269

Figure 422 – Web Filter – Sites – Total Traffic. .......................................................................... 270

Figure 423 – Web Filter – Sites – Total Hits. .............................................................................. 270

Figure 424 – Web Filter – Top Sites. .......................................................................................... 271

Figure 425 – Web Filter – Content Type – Total Traffic. ............................................................ 272

Figure 426 – Web Filter – Content Type – Total Hits. ................................................................ 272

Figure 427– Top Content Type. .................................................................................................. 273

Figure 428 – Application Control. .............................................................................................. 274

Figure 429 – Application Control – Application Allowed. .......................................................... 274

Figure 430 – Application Control – Application Denied. ............................................................ 275

Figure 431 – Application Control – History. ............................................................................... 275

Figure 432 – Application Control – History - Allowed. ............................................................... 275

Figure 433 – Application Control – History - Denied. ................................................................ 276

Figure 434 – Application Control – Top Categories Allowed. .................................................... 276

Figure 435 – Application Control – Top Categories Allowed – Zoom. ....................................... 277

Figure 436 – Application Control – Top Categories Denied. ...................................................... 278

Figure 437 – Application Control – Top Categories Denied – Zoom. ......................................... 278

Figure 438 – Application Control – Top Applications Allowed. ................................................. 279

Figure 439 – Application Control – Top Applications Denied. ................................................... 280

Figure 440 – Intrusion Prevention.............................................................................................. 281

Figure 441 – Alerted, Blocked and History. ................................................................................ 282

Figure 442 – Alerts by Geolocation. ........................................................................................... 283

Figure 443 – Impact - High. ........................................................................................................ 284

Figure 444 – Impact - Medium. .................................................................................................. 285

Figure 445 – Impact - Low. ......................................................................................................... 286

Figure 446 – Layer 3 Intrusion Prevention. ................................................................................ 287

Figure 447 – Intrusion Classification. ......................................................................................... 288

Figure 448 – Top Source. ............................................................................................................ 289

Figure 449 – Top Destination. .................................................................................................... 290

Figure 450 – Threat Protection. ................................................................................................. 291

Figure 451 – Threat Protection - Threats. .................................................................................. 292

Figure 452 – Threat Protection - Malware. ................................................................................ 293

Figure 453 – Threat Protection – Threat by Geolocation. ......................................................... 294

Figure 454 – Threat Protection – Impact High. .......................................................................... 295

Figure 455 – Threat Protection – Impact Medium..................................................................... 296

Figure 456 – Threat Protection – Impact Low. ........................................................................... 297

Figure 457 – Threat Protection – Malicious IP Classification. .................................................... 298


© BLOCKBIT 19

Figure 458 – Threat Protection – Top Threat Types. .................................................................. 299

Figure 459 – Threat Protection – Top Users by Threats. ............................................................ 300

Figure 460 – Threat Protection – Top Users by Threats. ............................................................ 301

Figure 461 – Threat Protection – Top Malware. ........................................................................ 302

Figure 462 – Threat Protection – Top Infected Sites. ................................................................. 303

Figure 463 – Threat Protection – Top Source. ............................................................................ 304

Figure 464 – Threat Protection – Top Destination. .................................................................... 305

Figure 465 – User Behavior. ....................................................................................................... 306

Figure 466 – User Behavior. ....................................................................................................... 307

Figure 467 – Reports. .................................................................................................................. 310

Figure 468 – Reports – Actions Menu. ....................................................................................... 310

Figure 469 – Reports – Action Menu. ......................................................................................... 311

Figure 470 – Reports – Add Report - Settings. ........................................................................... 312

Figure 471 – Reports – Add Report - Datasets. .......................................................................... 314

Figure 472 – Reports – Add Report - Custom. ............................................................................ 315

Figure 473 – Reports – Select All. ............................................................................................... 316

Figure 474 – Events. .................................................................................................................... 316

Figure 475 – Events – Log Events. .............................................................................................. 319

Figure 476 – Events – Log Events – Expanded. ........................................................................... 320

Figure 477 – Loggers. .................................................................................................................. 320

Figure 478 – Logger Setup – Virtual Machine. ........................................................................... 321

Figure 479 – Virtual Machine – Edit Settings. ............................................................................ 321

Figure 480 – Virtual Machine – Add. .......................................................................................... 322

Figure 481 – Virtual Machine – Device Type. ............................................................................. 323

Figure 482 – Virtual Machine – Select Disk. ............................................................................... 324

Figure 483 – Virtual Machine – Create a Disk. ........................................................................... 325

Figure 484 – Virtual Machine – Advanced Options. ................................................................... 326

Figure 485 – Virtual Machine – Ready to Complete. .................................................................. 327

Figure 486 – Virtual Machine – Adding virtual Disk. .................................................................. 328

Figure 487 – Virtual Machine – Power On.................................................................................. 328

Figure 488 – Virtual Machine – Console Tab. ............................................................................. 329

Figure 489 – Logger – logger-config. .......................................................................................... 329

Figure 490 – Logger – Entire device, not just one partition. ...................................................... 330

Figure 491 – Logger – Criando Logger. ....................................................................................... 330

Figure 492 – Logger – Secret Key. ............................................................................................... 330

Figure 493 – Logger – Completed. .............................................................................................. 331

Figure 494 – GSM – Login. .......................................................................................................... 331

Figure 495 – GSM – Analyzer. ..................................................................................................... 331

Figure 496 – Loggers. .................................................................................................................. 332

Figure 497 – Loggers – Create Logger Device. ............................................................................ 332

Figure 498 – Loggers – Create Logger Device – Completed fields. ............................................ 332

Figure 499 – GSM – Analyzer. ..................................................................................................... 333

Figure 500 – GSM – Stores.......................................................................................................... 333

Figure 501 – GSM – Edit Device. ................................................................................................. 334

Figure 502 – UTM – System - Administration. ............................................................................ 335

Figure 503 – UTM – Central Management. ................................................................................ 335


20 © BLOCKBIT

Figure 504 – Logger Devices. ...................................................................................................... 336

Figure 505 – Loggers – Loggers Action Menu. ........................................................................... 336

Figure 506 – Loggers – Search Box. ............................................................................................ 337

Figure 507 – Loggers – Create Logger Device. ........................................................................... 337

Figure 508 – Loggers – Logger box. ............................................................................................ 339

Figure 509 – PuTTY Configuration. ............................................................................................. 340

Figure 510 – BLOCKBIT GSM – Command Line Interface. .......................................................... 341

Figure 511 – Command Line Interface – arp. ............................................................................. 342

Figure 512 – Command Line Interface – arp – Example. ........................................................... 342

Figure 513 – Command Line Interface – arping. ........................................................................ 343

Figure 514 – Command Line Interface – arping - Example. ....................................................... 343

Figure 515 – Command Line Interface – date. ........................................................................... 344

Figure 516 – Command Line Interface – date – Example 1. ...................................................... 344

Figure 517 – Command Line Interface – date – Example 2. ...................................................... 344

Figure 518 – Command Line Interface – debug-deployer. ........................................................ 345

Figure 519 – Command Line Interface – debug-sync. ................................................................ 345

Figure 520 – Command Line Interface – enable-root. ............................................................... 346

Figure 521 – Command Line Interface – ethtool. ...................................................................... 346

Figure 522 – Command Line Interface – ethtool - Example. ..................................................... 347

Figure 523 – Command Line Interface – exit. ............................................................................ 347

Figure 524 – Command Line Interface – fdisk. ........................................................................... 348

Figure 525 – Command Line Interface – fdisk – Example. ......................................................... 349

Figure 526 – Command Line Interface – free. ............................................................................ 350

Figure 527 – Command Line Interface – free – Example. .......................................................... 350

Figure 528 – Command Line Interface – fsck. ............................................................................ 351

Figure 529 – Command Line Interface – fsck - Example. ........................................................... 351

Figure 530 – Command Line Interface – help. ........................................................................... 352

Figure 531 – Command Line Interface – history. ....................................................................... 352

Figure 532 – Command Line Interface – hostname. .................................................................. 353

Figure 533 – Command Line Interface – hostname - Example. ................................................. 353

Figure 534 – Command Line Interface – ifconfig. ...................................................................... 354

Figure 535 – Command Line Interface – ifconfig - Example. ..................................................... 355

Figure 536 – Command Line Interface – ifstat. .......................................................................... 356

Figure 537 – Command Line Interface – ifstat - Example. ......................................................... 356

Figure 538 – Command Line Interface – iotest - Example. ........................................................ 357

Figure 539 – Command Line Interface – ip. ............................................................................... 357

Figure 540 – Command Line Interface – ipcalc. ......................................................................... 358

Figure 541 – Command Line Interface – ipcalc – Example. ....................................................... 358

Figure 542 – Command Line Interface – less. ............................................................................ 359

Figure 543 – Command Line Interface – logger-config – Example 1. ........................................ 360

Figure 544 – Command Line Interface – logger-config – Standalone. ....................................... 361

Figure 545 – Command Line Interface – logger-config – Example 2. ........................................ 361

Figure 546 – Command Line Interface – logger-config – Integrated. ........................................ 362

Figure 547 – Command Line Interface – logger-devices-add. ................................................... 362

Figure 548 – Command Line Interface – logger-devices-list. ..................................................... 363

Figure 549 – Command Line Interface – logger-disable. ........................................................... 363


© BLOCKBIT 21

Figure 550 – Command Line Interface – logger-enable. ............................................................ 363

Figure 551 – Command Line Interface – ethtool. ....................................................................... 364

Figure 552 – Command Line Interface – lscpu. .......................................................................... 364

Figure 553 – Command Line Interface – mkfs. ........................................................................... 365

Figure 554 – Command Line Interface – more. .......................................................................... 366

Figure 555 – Command Line Interface – netstat. ....................................................................... 367

Figure 556 – Command Line Interface – ntpdate. ...................................................................... 367

Figure 557 – Command Line Interface – ntpdate – Example. .................................................... 367

Figure 558 – Command Line Interface – passwd........................................................................ 368

Figure 559 – Command Line Interface – ping. ............................................................................ 368

Figure 560 – Command Line Interface – reboot. ........................................................................ 369

Figure 561 – Command Line Interface – reset. .......................................................................... 369

Figure 562 – Command Line Interface – reset-admin-blocks – Example. .................................. 369

Figure 563 – Command Line Interface – reset-admin-password. .............................................. 370

Figure 564 – Command Line Interface – reset-admin-sessions. ................................................ 370


Figure 566 – Command Line Interface – rewizard. .................................................................... 371

Figure 567 – Command Line Interface – route. .......................................................................... 371

Figure 568 – Command Line Interface – route – Example 1. ..................................................... 372

Figure 569 – Command Line Interface – route – Example 2. ..................................................... 372

Figure 570 – Command Line Interface – sar. .............................................................................. 373


Figure 572 – Command Line Interface – set-network-gateway. ................................................ 374


Figure 574 – Command Line Interface – set-network-timezone. .............................................. 375

Figure 575 – Command Line Interface – show-devices. ............................................................. 376

Figure 576 – Command Line Interface – show-uuid................................................................... 376

Figure 577 – Command Line Interface – shutdown. .................................................................. 376

Figure 578 – Command Line Interface – tcpdump. .................................................................... 377

Figure 579 – Command Line Interface – tcpdump – Example. .................................................. 377

Figure 580 – Command Line Interface – tcptop. ........................................................................ 377

Figure 581 – Command Line Interface – tcptop – Example. ...................................................... 378

Figure 582 – Command Line Interface – telnet. ......................................................................... 378

Figure 583 – Command Line Interface – telnet – Example. ....................................................... 379

Figure 584 – Command Line Interface – telnet – Example 1. .................................................... 379

Figure 585 – Command Line Interface – telnet – Example 2. .................................................... 379

Figure 586 – Command Line Interface – tracepath. ................................................................... 380

Figure 587 – Command Line Interface – traceroute_1. ............................................................. 381



Figure 590 – Command Line Interface – traceroute – Example 1. ............................................. 383

Figure 591 – Command Line Interface – update-gsm. ............................................................... 383

Figure 592 – Command Line Interface – uptime. ....................................................................... 383

Figure 593 – Command Line Interface – vmstat. ....................................................................... 384

Figure 594 – Command Line Interface – vmstat - Example. ....................................................... 384

Figure 595 – Command Line Interface – whois. ......................................................................... 385


22 © BLOCKBIT

Figure 596 – Command Line Interface – whois – Example. ....................................................... 386


© BLOCKBIT 23

TABLE OF TABLES

Table 1 – IP addressing. ................................................................................................................ 48

Table 2 – Top Hits Selection Box Options in Events. .................................................................. 317


24 © BLOCKBIT

1 DOCUMENT VERSION CONTROL

DATE DESCRIPTION

06/01/2017 Release.

10/17/2018 Review and addition of new contents.

28/02/2019 Update to GSM version 1.2.1.


© BLOCKBIT 25

2 INTRODUCTION

Thank you for choosing BLOCKBIT GSM.

This Administrator's Guide provides instructions on how to install, configure, and use BLOCKBIT GSM. Once you reach the end of this Guide, you will be able to use all the features and resources of BLOCKBIT GSM.

Global Security Management has been developed to manage multiple solutions for BLOCKBIT. Through it, you can manage Device Profiles, Inventory Management and Automation, Monitoring and many other solutions. This will be detailed further in this document.

The benefits your company will have by using BLOCKBIT GSM are various: Time savings, reduction of costs, reduction of configuration errors, standardization of security policies and consequently a drastic reduction of threats and cyber-attacks, one of its biggest advantages: It's because it does not restrict the number of managed devices. For a better understanding, here's an example: Assuming you are a network administrator of 1,000 stores and you need to block access to a particular social network domain for each store, without BLOCKBIT GSM it will be necessary to configure each store's Firewall to perform the lock. However, with BLOCKBIT GSM it is possible to lock all stores at the same time, just make the proper configuration on BLOCKBIT GSM and perform deploy to all stores, simple, fast and effective.

In addition, BLOCKBIT GSM provides greater control to the administrator by allowing the installation of loggers, which enables a holistic view of the network and its users through widgets, graphs, events, and reporting.

BLOCKBIT GSM delivers complete flexibility, standardization and protection for your business through a simplified, fast, easy-to-configure and uncomplicated platform, giving the network administrator a complete view of your business's security management. BLOCKBIT GSM meet the needs of small, medium and large companies.

2.1 Resources – BLOCKBIT GSM

• Device Grouping: This feature provides the possibility to group devices according to your needs, which causes considerable ease in the process of installing the configurations;

• Role Based Administration: Its main idea is to enable the control of several users, monitor their permissions for devices and granularity;

• Device Template-based Configuration: Templates are a set of general BLOCKBIT UTM device configurations, consisting of System, Authentication, Firewall, Web Cache, Web Filter, Antimalware, IPS, ATP, Traffic Shaping, SD-WAN, and DNS, so you can initialize the devices using the global settings quickly, practically and without errors, reducing TCO (total cost of ownership), maximizing IT staff performance and avoiding any possible configuration errors;

• Centralized User Management: This feature provides the administrator with the ability to design policies based on authenticated users and groups;

• Policy Template-based Management: Enables the creation of policies and policy groups to control device access protected networks, quickly, easily, and without error;


26 © BLOCKBIT

• Workflow for Audit and Deployment Control: BLOCKBIT GSM was developed with change management in mind, and all configurations are forwarded for approval to a previously selected auditor, allowing: Receiving and registering installation requests for configuration packages, evaluating the implications, costs, benefits and risks of proposed changes, justify and approve changes and scheduling of facilities;

• VPN Community Management: Build VPN communities - Virtual Private Network on BLOCKBIT GSM. These settings allow secure, fast and encrypted communication between devices.

BLOCKBIT GSM was developed through an Architecture based on ease of use and understanding, to minimize errors and give a complete view of management to the system administrators.

2.2 Features – BLOCKBIT GSM

• Policy Manager: In just one configuration interface, easily group security policies by the device, organizational unit, threat types, or controls. It is possible to integrate several resources into a single policy, such as WEB Category, Application Control, Bandwidth Control, Multiple Services, QoS - Quality of Service, Time and Traffic Quota, Link Selection and Redundancy, and Virus and Malware Control;

• Policy Template: Enables the creation of groups of policies allowing the reuse of other groups already created on the Policy Manager screen, gaining agility and practicality;

• Device Manager: Organize your devices by "Firmware" version, geographic region, administrative users, clients or organizational units, facilitating network management;

• Device Communities: Set VPN scopes settings and security parameters and easily distribute between devices;

• Device Templates: Define global system settings in a global way among Device Templates;

• Deploys Panel: Track and manage the installations of the BLOCKBIT GSM configuration packages on the managed devices.

2.3 Environment check for BLOCKBIT GSM Installation.

This Guide provides information on how to configure and manage BLOCKBIT GSM. Before proceeding with the installation, check the installation requirements. Please remember that we offer full support through our service channels, and we will be delighted to assist you.


© BLOCKBIT 27

2.3.1.1 Installation requirements

Ensure that communication with the internet is active, as the licensing, system upgrade and database processes require an internet connection.

Minimum requirements for GSM 1.2 installation:

• CPU: Dual Core;

• RAM: 4GB;

• Storage: 32GB;

• Supported Virtual platforms: VMware, XenServer or Hyper-V.

Minimum requirements for the Remote Analyzer install:

• CPU: Quad Core;

• RAM: 8GB;

• Storage: 128GB (Raid using SSD or SAS are recommended);


Minimum requirements for GSM 1.2 + Internal Analyzer:

• CPU: Octa Core;

• RAM: 16GB;

• Storage: 256GB (Raid using SSD or SAS are recommended);


To perform the installation and configuration you need an SSH client, serial console, and a web browser. Here are the recommended minimum applications:

Web Browser:

• Mozilla Firefox version 45;

• Google Chrome version 51;

• Microsoft Internet Explorer 9.

Acesso remoto (SSH e Console):

• PUTTY;

• CygWin;

• Mobaxterm.


28 © BLOCKBIT

2.4 About this Administrator Guide

This Guide has been developed especially for your administrator. All sections have been structured to make the installation process easy and fast. The whole step by step is presented with examples, making it easier to understand and clarify doubts.

Throughout the guide, you can find some icons followed by text. They are intended to alert you to an important note or note about that section.

Let's learn more about these icons:

• Alert: indicates notes or instructions that you should be followed with extra attention during the BLOCKBIT GSM installation process:

Figure 1 – "Alert".

• CLI - Command Line Interface: also known as Shell, indicates the commands that must be entered. Next to this symbol will be provided the command to be used:

Figure 2 – CLI – Command Line Interface.

• BLOCKBIT UTM Administrator Guide: When this symbol appears, the following information should be referenced in the BLOCKBIT UTM Administrator's Guide:

Figure 3 – UTM administrator guide.


© BLOCKBIT 29

3 ARCHITECTURE – BLOCKBIT GSM

This section will introduce the BLOCKBIT GSM Architecture.

Architecture is presented by a set of layers of components that integrated, define the technical aspects of the services offered by the system.

3.1 Platform

To understand Architecture, you need to understand the purpose of BLOCKBIT GSM and how the devices communicate.

BLOCKBIT GSM (Global Security Management) is designed to manage multiple BLOCKBIT solutions. When connecting a BLOCKBIT UTM device to the BLOCKBIT GSM, creates a secure Tunnel is established using encrypted communication, allowing the application of the generated configurations.

All settings applied through BLOCKBIT GSM are generated in file packages and are exported and implemented in BLOCKBIT UTM.

Figure 4 – Architecture – BLOCKBIT GSM platform.


30 © BLOCKBIT

3.2 Architecture

The architecture of BLOCKBIT GSM has been developed so that the system simplifies the centralized management of devices.

Figure 5 – BLOCKBIT GSM – Architecture.

The architecture is divided into the following component:

• Frontend;

• Backend;

• Data storage;

• Operational system.

More details about these components will be shown below:

3.2.1.1 Architecture – Frontend

The frontend is the development layer that provides the web interface and system controls. With Frontend capabilities, you can access any kind of information and execute configuration commands on the GSM BLOCKBIT services.

Frontend layer interfaces ensure that the end user does not have direct access to the other components available in other layers of the System Architecture.

The system is designed to offer two types of interface in the Frontend: Manager and Console layer:


© BLOCKBIT 31

• Manager: This is a Web application for device administration. It is through it that the administrator defines all the system configuration parameters and manages the configuration packages that will be installed on the remote devices;

• Console: Console: Administrative command line interface used for troubleshooting on the BLOCKBIT GSM device. This Frontend interface can be accessed through an SSH terminal connection.

3.2.1.2 Architecture – Backend

The backend is the development layer that provides the commands and programs that apply the settings requested through the Frontend interfaces to centralized management services and the Operating System.

Due to the system's modular feature using services that are independent of each other, information between the Frontend and Backend features is carried through two encrypted and key-authenticated paths: Database or SSH Connection.

• ApplyScripts: The main function of AppleScript is to read the configuration parameters stored in the database and rewrite these settings in the services and operating system;

• Deployer: This is the service responsible for installing the configuration packages generated through the Manager on the remote devices. Deployer is a Backend application that uses the public API implemented in BLOCKBIT UTM;

• Collectors: These are Backend services that use the BLOCKBIT UTM API to synchronize device information. Information such as License, Users, Network Cards, etc.

3.2.1.3 Data Storage

The data warehouse layer is the middle tier that provides the capabilities for storing and transferring information between the Frontend and Backend components. It is through the database system that Frontend writes system settings and parameters to be applied to the Backend and Operating System components.

3.2.1.4 Operating System

The BLOCKBIT GSM Operating System is also maintained by the BLOCKBIT research and development team, where the open source tools packages used to implement the services are available.

To simplify compatibility with the Appliances and ensure a good performance in the execution of the services, BLOCKBIT GSM runs on a Linux Kernel Operating System based on Intel x86 Architecture.


32 © BLOCKBIT

4 INSTALLATION – BLOCKBIT GSM

This section will introduce the step-by-step installation of the BLOCKBIT GSM.

BLOCKBIT GSM is only available in Virtual Machines compatible with the following solutions: VMware, XenServer, and Hyper-V.

To install BLOCKBIT GSM follow the guidelines below.

4.1 Importing Virtual Machine

Download the Open Virtual Appliance (OVA) from BLOCKBIT UTM, which can be requested through the Trial registration at our website: http://www.blockbit.com.

We will demonstrate the installation using VMware ESXi 6.5.0 software as an example:

1. Connect to the Internet, using the browser of your choice, and access the VMware ESXi management console on the VMware Host Client;

2. Fill in the fields with the following information:

• User name: user registered in VMware;

• Password: user password;

Figure 6 – Login VMware.

• Click on “Log in”.



© BLOCKBIT 33

3. Click on “Create/Register VM”;

Figure 7 – Console VMware.

4. Select the option “Deploy a virtual machine from an OVF or OVA file”;

Figure 8 – Select creation type.

Click on “Next”.

5. Select the BLOCKBIT UTM image you have download at our website. Fill in the following field:

• Enter a name for the virtual machine: enter the machine`s name. E.g.: BLOCKBIT GSM;


34 © BLOCKBIT

Figure 9 – Select OVF and VMDK files.

• Click on “Next”.

6. Select the datastore in which to store the configuration and disk files. E.g.: datastore1;

Figure 10 – Select Storage.

Click on “Next”;

7. Wait until the OVA is completely uploaded. During this process, the following message will be displayed: “Extracting OVA, this could take some time...”;


© BLOCKBIT 35

Figure 11 – Select storage – “Extracting OVA, this could take some time...”.

8. Set the virtual machine configuration:

• Network mappings: select a suitable network mode for your environment. Ex.: Bridged mode;

• Disk provisioning: select the option of your choice. Ex.: Thin; o Thick Disk: a type of discs fully allocated in the data store, i.e., if you create a

Thick disk with 20GB, it will occupy 20GB of your data store; o Thin Disk: a type of disk that allocates only the space that is written by the

operating system of the virtual machine. For instance, if you create a 20GB disk for a VM, it will initially occupy only a few KB / MB in the data store, however, by the time you start writing data to it through the operating system, its size can reach up to limit of 20GB.

For more information, see the VMware manual. In this example, we will use the disk provisioning type "Thin".


36 © BLOCKBIT

Figure 12 – Deployment options.


9. Review these setting before finishing the upload wizard;

Figure 13 – Ready to complete.

Click on “Finish”.


© BLOCKBIT 37

The import has completed, just click on the "Power on" Button to start the virtual machine and proceed to install the BLOCKBIT GSM.

4.2 Start the Virtual Machine – First Access

When you start the virtual machine for the first time, the following screen will be displayed:

Figure 14 – Starting BLOCKBIT GSM for the first time.

No step is required, just wait until the login screen is cleared.

Figure 15 – BLOCKBIT GSM login screen.

You will now need to configure IP. To configure IP, perform the following steps:

1. Localhost login: Log in via the CLI console, using the default credentials, as follows: User "admin" and password "admin";

2. Change BLOCKBIT GSM IP address.

The default IP address of BLOCKBIT GSM is 192.168.1.1. In this guide, we will use the IP address 172.16.102.235 as an example. If you want to change, follow the steps below:


38 © BLOCKBIT

Configuration details:

IP: 172.16.102.235 Mask: 255.255.254.0

Default route: 172.16.102.1

Enter the following commands:

After performing this procedure, the IP address has changed.

To ensure greater security to the environment we will carry out the change of the default password procedure.

To change the password, enter the following command:

By completing this process, the password will be updated.

ifconfig 172.16.102.235/23 , e digite “Enter”.

route add default gw 172.16.102.1 , e digite “Enter”.

It is highly recommended to change the default password of the console "admin" user. To change the default password, you must create a strong password. This password must contain at least 8 characters with letters uppercase and lowercase letters, numbers, and special characters.

Type in the command passwd and press “Enter”.

Type in the current password and press “Enter”.

Type in the new password twice.


© BLOCKBIT 39

5 CONFIGURING THE EXCEPTION

This section will guide you on how to configure the exception in web browsers: Google Chrome and Mozilla Firefox.

In the first access to the BLOCKBIT GSM Web Interface, the web browsers will probably display a security alert reporting a certificate error. This occurs due the browser does not recognize any certificate authority that validates access to this page as trusted. Therefore, you must configure the exception in the web browser:

1. To configure this exception, follow the steps below;

2. Select the web browser of your choice and access the following IP https://192.168.1.1 In case you have changed the IP address, access the new IP.

Each Browser has its procedure to add a connection to the exception list to be recognized as trusted. The guidelines on how to perform this procedure as follow.

5.1 Google Chrome exception configuration

To configure Google Chrome exception follow the steps below:

1. Click on “Hide Advanced”;

2. Click on “Proceed to 172.16.13.202 (unsafe)” to set this page as trusted.

If the web browser issues a security alert, follow the recommendations below.

https://192.168.1.1/


40 © BLOCKBIT

Figure 16 – Chrome Exception – “Proceed to 172.16.32.212 (unsafe)”.

Google Chrome exception configuration has been performed successfully.

5.2 Mozilla Firefox exception configuration

To configure Mozilla Firefox exception list, follow the steps below:

1. Click on “Advanced”;

2. Click on “Add Exception...”;


© BLOCKBIT 41

Figure 17 – Mozilla Firefox Exception – Your connection is not secure.

3. Click on “Confirm Security Exception”.


42 © BLOCKBIT

Figure 18 – Mozilla Firefox Exception – Confirm Security Exception.

Mozilla Firefox exception configuration has been performed successfully.

5.3 Microsoft Internet Explorer exception configuration

To configure Microsoft Internet Explorer, follow the steps below:

1. Click on “Continue to this web site (not recommended)”.

Figure 19 – Microsoft Internet Explorer Exception – There is a problem with this website’s security certificate.

Microsoft Internet Explorer exception configuration has been performed successfully.


© BLOCKBIT 43

6 INSTALLATION WIZARD

This section will guide you on how to configure the BLOCKBIT GSM Installation Wizard.

To perform the installation of the Installation Wizard, four steps are required: Accept License, System Settings, Network Settings, and Administration. Follow the guidelines below.

6.1 Language Selection

You can select the language of your choice (English US or Portuguese BR). The default language is "English US". To change the language, follow the steps below:

1. Click on the upper right corner "English US" and choose the desired language;

Figure 20 – Installation Wizard – Language Selection.

When you set the language, your interface will be updated with the chosen language.

6.2 Wizard actions button

By the end of each configuration page, there will be tree actions buttons “Previous”, “Next” and “Save”. Follows the descriptions for them:

Figure 21 – Installation Wizard – “Previous”, “Next” and “Save” buttons.

• Previous: Returns to the previous page;

• Next: Goes to the next step of configuration;

• Save: This option is enabled only after the fourth step is completed and it will save all the settings you have entered.


44 © BLOCKBIT

6.3 Installation process

Here's how to install the wizard step-by-step:

1. Accept License: Displays the terms of use of BLOCKBIT GSM. Read the term and select the checkbox: "Accept terms of use";

Figure 22 – Installation Wizard – Accept License.


2. System Settings: Fill in the fields with the following information:

• Hostname: enter the hostname according to the FQDN - Fully Qualified Domain Name. E.g.: GSM;

• Domain: Network domain. E.g.: blockbit.com;

• Timezone: Select the timezone in which your company is located. E.g.: America/Sao_Paulo;

• Language: Select the default language. E.g.: English;

Figure 23 – Installation Wizard – System Settings.


© BLOCKBIT 45

• Click on “Next”.

3. Network Settings: Fill in and set the following fields:

• Interface: Select the network interface you wish to. E.g.: eth0;

• IP Address: Set the IP address. E.g.: 172.16.102.235;

• Netmask: Set the network mask. E.g.: 255.255.254.0;

• Gateway: Set the gateway. E.g.: 176.16.102.1;

• DNS Server 1: Set the primary DNS service. E.g.: 176.16.102.161;

• DNS Server 2: Set the secondary DNS service. E.g.: DNS secundário do Google 8.8.4.4;

• NTP Server 1: Set the primary Network Time Protocol. E.g.: a.ntp.br;

• NTP Server 2: Set the secondary Network Time Protocol. E.g.: b.ntp.br.

Figure 24 – Installation Wizard – Network Settings.

• Clique no botão “Next”.

4. Administration: Fill in the following field information:

• Name: enter the administrator’s name. E.g.: admin;

• Email: enter the administrators’ email. This email will be used as login on BLOCKBIT GSM. E.g.: [email protected];

• Password: Enter a password that is at least eight characters long. The password must contain uppercase, lowercase letters, and special characters;

• Confirm Password: Confirm the password provide in the previous step.

It is imperative that BLOCKBIT GSM and BLOCKBIT UTM be synchronized by the same NTP server.


46 © BLOCKBIT

Figure 25 – Installation Wizard – Administration.

Click on Save[ ].

Once the steps above a finished the installation has been completed successfully.

The administrator's email will be used as login on BLOCKBIT GSM.


© BLOCKBIT 47

7 NETWORK ENVIRONMENTS

This section will display an example network environment using GSM BLOCKBIT.

To better contextualize this Administrator's Guide, we will use a fictitious topology, but very common among the likely environments that must implement the BLOCKBIT GSM.

BLOCKBIT GSM focuses on environments with many capillaries, that is, large environments remotely connected, but with similarities between remote points, thus reducing the Total Cost of Ownership (TCO) of managing the solution and maximizing ROI - Return on Investment from the company.

The network topology below is a suggested deployment of BLOCKBIT solutions for the BLOCKBIT UTM and BLOCKBIT GSM products:

Figure 26 – Network Topology.


48 © BLOCKBIT

In this example we will be using the following IP address’ table:

Table 1 – IP addressing.

Name External IP

Address Internal/protected

network BLOCKBIT

GSM group

Cluster

Head

Office

172.16.102.220 192.168.220.0/24 Head Office

Branch Office 1

172.16.102.221 192.168.221.0/24 Branch Office

Store 1 172.16.102.222 192.168.222.0/24 Stores

Store 2 172.16.102.223 192.168.223.0/24 Stores

Store 3 172.16.102.224 192.168.224.0/24 Stores

Webfilter 1

172.16.102.225 192.168.220.0/24 Pool Web

Filters

Webfilter 2

172.16.102.226 192.168.220.0/24 Pool Web

Filters

Webfilter 3

172.16.102.227 192.168.220.0/24 Pool Web

Filters

In the following image, we have the management view with the focus on BLOCKBIT GSM, in which it communicates with all the devices, BLOCKBIT UTM, which are grouped into 4 groups: Head Office, Branch Office, Web Filters Pool, and Stores


© BLOCKBIT 49

Figure 27 – Management Vision. With this grouping, you can apply the customized settings and policies for each of the groups according to your needs.


50 © BLOCKBIT

8 INTERFACE WEB

This section will demonstrate how to access the BLOCKBIT GSM Web Interface.

The BLOCKBIT UTM has a modern interface, easy to use and responsive, that is, it is able to fit

the screen of any device used for access (tablets, smartphones, notebook, etc.).

This ensures agility and ease for your company and can be accessed at any time and place.

To access the BLOCKBIT GSM Web Interface, follow the guidelines.

8.1 Accessing the Web Interface – BLOCKBIT GSM

Use one of the recommended browsers.

1. Access the address: https://172.16.102.135. In case you have changed it, access the new one.

2. Enter the following information:

• User: registered email. E.g.: [email protected];

• Password: user’s password;

• English: select the interface language. The available options are Portuguese and English.

Figure 28 – Login Screen – System Administration.

• Click on “Login” to access the Web interface.


© BLOCKBIT 51

3. This is the main screen of BLOCKBIT GSM, also known as “Device Manager”.

Figure 29 – Device Manager.

In this chapter, all buttons and menus will be explained.


52 © BLOCKBIT

9 BLOCKBIT GSM - MANAGER

BLOCKBIT GSM enables the administration of multiple network devices together, providing a full perspective of the infrastructure of all organizational units, the ability to generate configuration templates and security policy packages for sharing between groups of devices and for determining the controls of access by function, is able to establish and catalog all records of connection, access to Internet applications, personal data and content of private communications in accordance with the regulations of the Civil Registry of the Internet.

9.1 Interface Web – User Menu

The User menu is located in the upper right corner of the screen. To access just click the button with the name of the user. E.g.: admin.

Figure 30 – User menu.

The User menu consists of three buttons: "Profile", "Settings" and "Log Out". The following will be explained in detail.

9.1.1.1 User menu – User Profile

In the "Profile" option you can edit the user profile information. To access it, follow these steps:

1. At the right upper corner of the screen, click on “Profile”;

In the screen below the User, menu appears with the name "admin", this is due to the name registered in the "Name" item in the Installation Wizard chapter.


© BLOCKBIT 53

Figure 31 – User menu – Profile.

2. Modify the profiles changes to the profile. It also provides the following information:

• Name: Enter the registered username;

• Email: Enter the user’s email address;

Figure 32 – User Menu – Edit Profile.

There are three buttons at the upper right corner of the screen:

• “Close”: Closes the user profile editing screen;

• “Save”: This button is enabled when editing the profile and changing the password. By clicking on it, all provided information will be saved;

• “Password”: in this screen, it is possible to change the user’s password.

3. To change the password information, click on “Password”:

• Password: enter the new password;

• Confirm Password: Confirm the password provided in the previous step.


54 © BLOCKBIT

Figure 33 – Edit Profile – Change the Password

Click on Save[ ] to save the changes.

The system will be updated and you will need the login once again.

9.1.1.2 User menu – System Configuration

The “Settings” option allows you the change the system configuration. Follow the steps below:

1. In the user menu. Click on “Settings”;

Figure 34 – User menu – “Settings” button.

The System Settings screen will appear with the "General" tab preselected. The System Settings screen consists of four buttons in a vertical left menu: "System", "Network", "Admin" and "Activity". In addition, it has a central panel with a contextual set of options that fits according to the option selected in the menu on the left.


© BLOCKBIT 55

Figure 35 – System Settings – Settings.

Follows further descriptions regarding the features.

9.1.1.3 System Configuration – “System”

In the vertical menu on the left, when clicking the "System" button, the System Configuration will be displayed in a set of tabs, "General", "License", "Update", "Sessions" and "Services". In addition, a set of icons will appear in the right corner of the screen, these icons are contextual and adapt according to the needs of each selected tab.

Figure 36 – “System”.

9.1.1.4 System Configuration – “General” tab

1. In this screen, it is possible to change BLOCKBIT GSM general configuration:

• Hostname: enter the hostname according to the FQDN - Fully Qualified Domain Name. E.g.: GSM;

• Domain: Network domain. E.g.: blockbit.com;

• Timezone: Select the timezone in which your company is located. E.g.: America/Sao Paulo;

• Language: Select the default language. E.g.: English;


56 © BLOCKBIT

Figure 37 – System Settings – General

After making the desired changes, you must click the "Save" button, located in the upper right corner of the screen.

Figure 38 – “Save”.

Change changes will be saved successfully.

2. In the upper right corner of the screen, you can find a set of three contextual buttons: "System Backup", "System Restore" and the "Save" button (whose function is self-explanatory). In "System Backup" a copy of all GSM BLOCKBIT information such as BLOCKBIT GSM settings, devices, Device Templates, Policies, Objects, Imported Users and Deploys Panel results are copied. In this session, we will look at how to do a system backup.

• Click on System Backup[ ];

• The following screen will be displayed:


© BLOCKBIT 57

Figure 39 – System Settings – System Backup.

• This screen displays two options: "Key" and "Confirm Key"; o Key: Enter the encryption key that protects the backup; o Confirm Key: Confirm the encryption key;

• By clicking on the "Save" button (located in the bottom corner of the menu) will display the screen to select the location and name of the BLOCKBIT GSM backup file. Choose the location and folder of your choice to save it.

The Backup will be successfully created.

3. The second contextual button is "System Restore", the purpose of this button is basically

to apply the system settings previously saved in the GSM; The "System Restore" allows you to restore all of BLOCKBIT GSM information such as settings, devices, Device Templates, Policies, Objects, imported users and Deploys Panel results; The purpose of this area is precisely to demonstrate how to do this system restore.

• Click on System Restore[ ];

• The following screen will be displayed:

To perform the backup, you must create a secure key. It must contain at least eight characters in uppercase and lowercase letters, numbers, and special characters. Without this key, it is not possible to restore the backup


58 © BLOCKBIT

Figure 40 – System Settings – System Restore.

• This screen displays two option: “Key” and “Backup File”: o Key: enter the encryption key to secure the backup file; o Backup File: choose the file to be used in the system restore process.

• By clicking on the Save [ ] button will bring up a "Restore Backup" confirmation screen. Click on "OK" to set up the backup restore, wait for the restore confirmation of all the settings. The "System restore complete" screen will appear. Click on "OK".

The system will be restored successfully.

9.1.1.5 System Configuration – “License” tab

On this screen, you can apply or renew the BLOCKBIT GSM activation license. To perform the licensing, it is necessary to provide the BLOCKBIT GSM Universal Unique Indicator (UUID) for your service channel, which will provide you the license number.

The following is a step-by-step guide to licensing your BLOCKBIT GSM:

1. Verify that the access device has a recommended SSH client already installed. Let's exemplify the process using the application "PUTTY";

Before licensing, make sure BLOCKBIT GSM is connected to the internet.


© BLOCKBIT 59

2. Access the SSH console and fill the following fields:

• Host Name (or IP Address): enter BLOCKBIT GSM IP address. E.g.: 172.16.102.235;

Figure 41 – Licensing – PuTTY.

• Click on “Open”.

3. The console will be displayed requesting the user and password credentials;

4. Run the following command: show-uuid;

In “login as:” enter “admin” and press “Enter” again.

Enter the “password” and press “Enter”.


60 © BLOCKBIT

Figure 42 –show-uuid.

5. Send code "BLOCKBIT Network Appliance UUID" code to your BLOCKBIT service channel "for the release of the license. E.g.: 564DE73C-C437-82C5-6821E8B394598AB3;

6. You will receive the License number code from your service channel. E.g.: FE6C-0F1FACF1-46E0;

7. Return the BLOCKBIT GSM Web Interface to the License screen;

8. Make sure the "Accept Terms of Use" checkbox is checked, if it is unchecked, click to mark it;

9. In the "License Key" text box enter your license number, as exemplified by the image below;

Figure 43 – System Settings - License.


© BLOCKBIT 61

10. After making the desired changes, you must click on the Save button [ ], located in the upper right corner of the screen.

11. The message will appear asking if you want to update the license:

Figure 44 – Save license.

12. Click on OK[ ];

13. The information on the screen will be updated and will display the following information: "Serial Number", "License Key", "License Status", "License Expiration Date" and "Number of Devices", but with your data representing the current system state.

Figure 45 – System Settings – License.

9.1.1.6 System Configuration – “Update” tab

This screen has the function of updating your GSM. This panel consists of three options: "Version", "Scheduled" and "Automatic System Update".


62 © BLOCKBIT

Figure 46 – System Settings – Update.

• Version: Displays the current version and build of your GSM BLOCKBIT. E.g.: BLOCKBIT GSM 1.2.0 build 18090415;

• Scheduled: By clicking on the text box a menu will appear, in it, it is possible to change the scheduled time to perform the desired update, either simply click on the arrows to change the hours and minutes, do this, click outside the mode menu to finalize the selection. E.g.: 14:41;

• Automatic System Update: This checkbox allows an automatic system update to be performed. If it is selected, the update will occur at the scheduled time in the "Scheduled" option above.

1. In the upper right corner of the screen you can find two contextual buttons: "Update Now" and the "Save" button (whose function is self-explanatory);

2. By clicking on the update now [ ] button will update the system immediately instead of waiting for the scheduled.

Click on save [ ] located in the upper right corner of the screen to save the changes made to the settings.


© BLOCKBIT 63

9.1.1.7 System Configuration – “Sessions” tab

In this screen, you can configure authentication parameters and view the session of the administrators logged in to BLOCKBIT GSM, in addition to closing their sessions.

1. To configure the authentication parameters, simply change the fields to the values you want:

• Idle timeout: Sets the Idle time before the session expires, the value is in minutes. E.g.: 30;

• Login attempts: Number of maximum login failure attempts before blocking access, the value is in minutes. E.g.: 3;

• Lock timeout: The time that the user will be blocked when performing the maximum number of wrong login attempts, the value is in minutes. E.g.: 3.

Figure 47 – System Settings – Sessions.

Click on save[ ], located at the upper right corner of the screen to save all changes.

2. To visualize the active sessions of logged administrators, click on Active Sessions[ ] located at the upper right corner of the screen:

• Start: Date and time that the administrator has logged in BLOCKBIT GSM. E.g.: 201704-21 19:42:42;

• Name: sets the administrator’s user name. E.g.: admin;

• Address: sets the administrator’s IP address. E.g.: 192.168.111.14;

• Status: displays the login Status. E.g.: Active;

• Action: Allows you to remove the administrator session. By clicking the on the

Remove[ ] button will remove the administrator from the session and the login screen will be displayed to anyone who has been removed.

• Reload[ ]: updates the screen information.


64 © BLOCKBIT

Figure 48 – Active Sessions.

Click on Close[ ] to close the screen.

Click on save[ ] located at the upper right corner of the screen to save all changes.

9.1.1.8 System Configuration – “Services” tab

In this screen, you can change the communication and administration ports of BLOCKBIT GSM:

• HTTP: BLOCKBIT GSM Web Interface access port. E.g.: 80;

• HTTPS: BLOCKBIT GSM Web Interface access port. E.g.: 443;

• SSH: Access port to the BLOCKBIT GSM CLI console and communication with the managed devices. E.g.: 22;

• DEPLOY: Port of communication with the managed devices. E.g.: 444.

If the ports are changed on the BLOCKBIT GSM, they must also be changed on the other managed BLOCKBIT devices.

If the HTTP and/or HTTPS ports are changed, access to the Web Interface must be performed with the new ports configured.


© BLOCKBIT 65

Figure 49 – System Settings – Services.


9.1.1.9 User menu – “Network”

In the vertical menu on the left, when clicking on the "Network" button, the Network configuration will be displayed in a set of tabs: "General", "Interfaces" and "Email". In addition, a set of buttons will appear in the upper right corner of the screen, these buttons are contextual and adapt according to the needs of each selected tab.

Figure 50 – “Network”.

9.1.1.10 Network configuration – “General” tab

This screen allows changing the servers’ configuration:

• Gateway: sets the default network gateway. E.g.: 172.16.102.1;

• DNS Server 1: sets the primary DNS server. E.g.: 176.16.102.161;

• DNS Server 2: sets the secondary DNS server. E.g.: Google’s secondary DNS 8.8.4.4;

• NTP Server 1: sets the primary Network Time Protocol. E.g.: a.ntp.br;


66 © BLOCKBIT

• NTP Server 2: sets the secondary Network Time Protocol. E.g.: b.ntp.br.

Figure 51 – Network Settings.


9.1.1.11 Network configuration – “Interfaces” tab

In this screen, you can change the network interface configuration.

• Active interface button: allows enabling or disabling an interface. E.g.: In the green

color it means that the interface is enabled [ ] and in the white color means that

the interface is disabled[ ];

• Interface: sets the network interface name rede. E.g.: eth0;

• Address: sets BLOCKBIT GSM IP address. E.g.: 172.16.102.235;

• Mask: sets the network mask. E.g.: 255.255.254.0;

• Action: By clicking on the edit[ ] button, the Network configuration can be changed;

• Reload Interfaces button: by clicking on the refresh [ ] button the number of existing interfaces on BLOCKBIT GSM will be updated.


© BLOCKBIT 67

Figure 52 – Network Interfaces.

To edit the Network configuration of a specific interface follows the steps below:

1. On the Action column, click on Edit[ ]. Fill in the data as you wish:

• Address: BLOCKBIT GSM IP address. E.g.: 10.0.0.1;

• Mask: Network mask. E.g.: 255.255.255.0.

Figure 53 – Edit Interface.

2. To save the changes, click on Save[ ], otherwise, click on Close[ ] to close the window without saving it.

Click on synchronize [ ] located at the upper right corner of the screen to save all changes.

9.1.1.12 Network configuration – “Email” tab

This screen allows changing the email (SMTP) configuration used to send and receive emails.


68 © BLOCKBIT

Figure 54 – Email.

Follows the description for each field:

• Server: sets the email SMTP server. E.g.: smtp.blockbit.com;

• Port: sets the SMTP server port. E.g.: 587;

• User: sets the email user. E.g.: [email protected];

• Password: sets the user’s password;

• Security: sets the type of encryption that will be used during the authentication. The available options are: “SSL”, “TLS” and “none”.

After completing the fields, it is recommended to perform a scan by clicking the

Configurations [ ]. More information about this below:

• Configuration button: upon clicking on the configurations [ ] button, verification will be performed on the server, to see if it is working properly. Validation in the access credentials is executed and finally, a check is performed on the port service and can display three messages:

o SMTP connection ok: If the settings are working correctly, the results will be similar to the image below;


© BLOCKBIT 69

Figure 55 – SMTP connection ok.

o SMTP connection failed: If there is an error in the server settings, as exemplified

in the image below;

Figure 56 – SMTP connection failed.

o SMTP invalid login: If the credentials are incorrect, as exemplified in the image

below.

Figure 57 – SMTP invalid login.

Click on save [ ] located at the upper right corner of the screen to save all changes.


70 © BLOCKBIT

9.1.1.13 User Menu – “Admin”

When accessing the User menu and clicking on the "Admin" button, the Administrators screen will appear.

Figure 58 – “Admin”.

This screen is composed up of "Profiles" and "Users" tabs.

9.1.1.14 Administrators configuration – “Profiles”

In the "Profiles" tab we see the BLOCKBIT GSM Admin Profiles. It consists of the following fields:

• Profile Name: BLOCKBIT GSM administrators 1 profile;

• Actions: Enables the following actions:

o Edit button [ ]: Allows editing a profile;

o Delete button [ ]: Allows deleting a profile;

o Select Profile [ ]: Allows selecting one or more profiles.

Figure 59 – Administrators.

At the upper right corner of the screen we have the contextual buttons:

• Display results [ ]: Allows you to determine how many results are displayed per page. The available options are: 10, 20, 30, 40, 50, 100, 500;

• Search [ ]: By clicking on this button will display a small search box where you can

enter tags and perform a search based on these keywords, if click on cancel [ ] all tags are removed from the search box, clicking outside this search panel will have its

display stopped. To run a search, click on search [ ];

• Actions menu [ ]: Displays the following menu options:


© BLOCKBIT 71

Figure 60 – Administrators – Actions Menu.

The following actions will be displayed below:

9.1.1.15 Administrators – Actions Menu – “Create Profile”

When accessing the Actions Menu and clicking on the "Create Profile" button, the administration profiles configuration screen will appear. This screen is composed of the "Profile" section and two contextual buttons in the upper right corner, the first to "go back" and the second to "save" all the changes executed on this screen.

The "Profile" section allows you to define the permissions that the profile will control, according to the fields below:

• Name: Name of the administration profile. E.g.: “WebFilter - Admins”;

• Devices: Allows you to select the devices that will have administrator permissions;

• Devices Groups: Allows you to select the devices that will have administrator permissions. E.g.: “Pool Web Filters”;

• Manager: Displays various expandable menus with BLOCKBIT GSM Manager module sets

and settings, you can control access through the checkboxes, having the following

permissions: "None", "Read Only" and finally "Read" and "Write". The sets are:

• Devices: Device Manager, Device Communities, and Device

Template;

• Policies: Policy Manager and Policy Templates;

• Users: Users and Users Groups;

• Objects: These are Object types, Addresses, Services,

Times, Schedules, Dictionaries, and Content Types;

• Settings: User menu screens, System, Network and

Admin;

• Deploys: Deploys Panel screen.


72 © BLOCKBIT

• Analyzer: Displays various expandable menus with BLOCKBIT GSM Analyzer module sets

and settings, you can control access through the checkboxes, having the following

permissions: "None", "Read Only" and finally "Read" and "Write". The sets are

o Analysis: Network Traffic, Police Usage, Web Filter, Application Control, Intrusion

Prevention, Threat Protection, and User Behavior;

o Reports: Is the report panel, its only option is "Reports";

o Events: Refers to the event panel, its only option is "Events";

o Loggers: Sets access to the Loggers panel, which is its only option.

To set the desired permissions, select the item, expand the option using the arrow icon [ ] (if

necessary) and click on the selection [ ] icon, as shown below.

Figure 61 – Edit Profile.

• Click on save [ ] to save the profile;

• Otherwise, click on the top right of the screen in back [ ], this will take you back to “Profiles”.


© BLOCKBIT 73

The administration profiles have been successfully changed.

9.1.1.16 Administrators – Actions Menu – “Delete Profile”

The "Delete Profile" button in the action menu is for removing profiles that were previously selected by clicking on the checkbox. After selecting this option, a verification message will appear requesting confirmation.

Figure 62 - Delete Profile.

When you click OK[ ], the selected profiles will be removed. If Click on Cancel[

], this verification message will be dismissed without making any removal.

9.1.1.17 Administrators – Actions Menu – “Clone Profile”

The "Clone Profile" button in the action menu is for duplicating profiles that were previously selected by clicking the checkbox. After selecting this option, a verification message will appear requesting confirmation.

Figure 63 - Clone Profile.

When you click on OK[ ], the selected profiles will be duplicated. Click on Cancel[

] in case this verification message will be dismissed without making any removal.


74 © BLOCKBIT

9.1.1.18 Administrators – Actions Menu – “Select All” and “Deselect All”

By clicking on “Select All” in the action menu, will select all profiles.

Figure 64 – Select All.

This allows a change that affects all profiles to be easily implemented.

The "Deselect All" function is simply the opposite: Remove all previously selected selections.

9.1.1.19 Administrator Configurations – “Users” tab

In the "Users" tab we see the BLOCKBIT GSM Users. It consists of the fields:

• Name of the BLOCKBIT GSM Administrators profiles;

• Email: Email of registered users;

• Profile: User profile type, if it has auditor permission the [ ] icon will be

displayed;

• Actions: Provides the following essential functions:

o Edit button [ ]: allows editing a user profile;

o Delete button [ ]: allows deleting a user profile;

o Select User[ ]: allows selecting one or more user profiles.

Figure 65 – Administrators.



© BLOCKBIT 75

• Displaying results[ ]: Allows you to determine how many results are displayed per page, the available options are: 10, 20, 30, 40, 50, 100, 500;


enter tags and perform a search based on these keywords if you click on cancel [ ] all tags are removed from the search box, clicking outside this search panel will have its

display stopped. To execute a search click on the search[ ] icon;

• Actions menu [ ]: the following actions menu will be displayed:

Figure 66 – Administrators – Actions Menu.

Follows more details about these options.

9.1.1.20 Administrators – Actions Menu – “Create User”

When accessing the Actions Menu and clicking the "Create User" button, the "New Admin User" form will appear, as shown in the image below:


76 © BLOCKBIT

Figure 67 - Administrators – Actions Menu.

In this form it is possible to create a new user with their respective access profile, according to the fields below:

• Auditor: This checkbox determines whether the user has access as "Auditor";

• Name: sets the user name. E.g.: “Admin”;

• Email: sets the user’s email address. E.g.: “[email protected]”;

• Password: sets the user’s password;

• Confirm Password: confirms the user's password;

• Profile: n this session, it is possible to determine the access profile of the user that is being registered. Select the profile previously registered in the "Profiles" tab in the list. E.g.: “WebFilter - Admins”.

To create the user, click on Save [ ], otherwise, click on Close[ ] to close the window without saving it.

Click on save [ ] located at the upper right corner of the screen to save all changes.

9.1.1.21 Administrators – Actions Menu – “Delete Users”

The "Delete Users" button in the action menu is for removing users who were previously selected by clicking on the checkbox. After selecting this option, the verification message will appear requesting confirmation.


© BLOCKBIT 77

Figure 68 - Delete Users.

When you click on OK[ ], the selected users are removed. If you click on Cancel [

], this verification message will be dismissed without making any removal.

9.1.1.22 Administrators – Actions Menu – “Select All” and “Deselect All”

By clicking on “Select All” in the actions menu all users will be selected.

Figure 69 – Select All.

This allows a change that affects all users to be easily implemented.


9.1.1.23 User menu – “Activity”

By accessing the User menu and click on the “Activity” button the activity logs will be displayed.


78 © BLOCKBIT

Figure 70 – Botão “Activity”.

This screen is composed of the activity panel and 3 buttons at the top right of the screen.

In this list view, we see the record of all the activities performed by BLOCKBIT GSM users. It consists of the fields:

• Date: Demonstrates the date and time the activities were performed. E.g.: “08/10/2018 18:22:26”;

• User: Determines which user was responsible for performing the action that will be listed later. E.g.: “[email protected]”;

• Interface: Displays which interface was accessed by the previously mentioned user. E.g.: ”Settings Admin”;

• Action: It is the record of which activity was executed in the previously mentioned interface. E.g.: “delete”;

• IP: This is the IP address of the user who executed the registered action; E.g.: “192.168.1.1”;

• Details[ ]: By clicking on this icon displays more information about actions taken by the user. E.g.: “adm_users: 1”.

Figure 71 – Activity.

At the upper right corner of the screen we have:



© BLOCKBIT 79




• Calendar[ ]: The calendar allows you to make more precise searches taking into account temporal requirements, the allowed options are Today, Last 7 Days, Last 30 Days, This Month, Last Month (Last Month) and Custom (Custom). The custom mode allows you to choose a search between two periods ("From" to "To"), making this selection or clicking on the text boxes, a calendar will appear allowing the selection of the desired dates. To perform the search, click on "Submit", otherwise click outside the calendar or on "Clear".

Figure 72 – Activity – Calendar.

To review the complete activity list without applying the calendar settings, simply click the "Activity" button again in the vertical menu on the left.


80 © BLOCKBIT

9.2 User Menu – “Log Out”

You can leave the system at any time. Just click on the "Log Out" button.

Figure 73 – Log Out.

This will take the user back to the “Login” page.


© BLOCKBIT 81

10 DEVICE MANAGER

The Device Manager panel is of vital importance to BLOCKBIT GSM, its main function is the ability, as the name implies, and to manage all connected devices through a single central point, putting it in simple terms: Through this panel BLOCKBIT GSM manages the BLOCKBIT UTM and in the future, other digital solutions from BLOCKBIT.

This section will demonstrate how to create groups (page 92), add (page 97) and edit devices (page 90).

First, when logging into BLOCKBIT GSM, the "Devices" tab of the "Manager" will be automatically selected. In addition, you can access Device Manager by clicking on the Devices button located on the side vertical menu, or by selecting the appropriate tab (if the button has already been selected).

Figure 74 – Device Manager – “Device”.

When making one of these selections, the screen below will be available:

Figure 75 – Device Manager.

The columns and items in the Device Manager are explained below and the actions menu are analyzed later.


82 © BLOCKBIT

10.1 Device Manager Tab

In BLOCKBIT GSM it is possible to carry out inventory of all your devices easily, such as Status, License, Version, and Updates of the integrated devices.

The "Device Manager" tab consists of seven columns: "Name", "License Status", "Version", "Device Template", "Police IPV4", "Police IPV6" and "Actions". The devices are divided into groups and in addition, at the top right of the screen, there is a set of 3 contextual buttons.

Figure 76 – Device Manager Screen.

Follow the description of the columns.

10.1.1.1 Device Manager – “Name” Column

The columns "Name" displays the devices that were previously registered, ordered in their respective groups.

Just next to the name of each device registered there is a symbol that indicates the status of the connection between BLOCKBIT GSM and BLOCKBIT UTM.

If the red symbol is indicated, that device is not connected:

Figure 77 – Device Manager – Device has no connection – Status Connection error.

If the green symbol is indicated, that device is connected correctly:


© BLOCKBIT 83

Figure 78 – Device Manager – Connected Device – Online.

If you want to check the status just place the mouse on the status button and check:

Figure 79 – Device Name – Status Connection error.

Figure 80 – Device Manager – Online.

10.1.1.2 Device Name – Action buttons

Still in the Device Name Columns, just to the right of the device name, there are three action

buttons: Access CLI (Command Line Interface) [ ], Access Interface Web [ ] and

Synchronize[ ]:

Figure 81 – Action button – Device Name.

Follows the description for each of them:

10.1.1.3 Device Name – Action buttons – “Access CLI”

The action button “Access CLI - Command Line Interface”: accesses the text interface (shell)

through the existing connection with BLOCKBIT GSM:


84 © BLOCKBIT

Figure 82 – “Access CLI” – Command Line Interface.

Click on Access CLI[ ] will open a new tab in the browser to access the interface via the shell.

10.1.1.4 Device Name – Action buttons – “Access Web Interface”

The "Access Web Interface" action button accesses the web interface of the device through the existing connection with BLOCKBITG GSM, that is, opens a tab in the browser to directly access the desired BLOCKBIT UTM:

Figure 83 – “Access Interface Web”.

By clicking on the "Access Web Interface" button may cause an anti-pop-up browser. If it does, a red symbol will appear warning that the popup is blocked in the upper right corner of the browser screen:

Figure 84 – “Access Interface Web” – Blocked Pop-up.

You need to unlock. To do this follow the steps below:

1. Click on the pop-up blocking icon, located in the upper right corner of the browser;

2. The popup unlock screen will appear;

3. Click on “Allow”.

The unlock was successful. To proceed, click on the "Access Web Interface" button again. It will open a new tab in the browser with access to BLOCKBIT UTM.

Access to the BLOCKBIT UTM can also be performed directly on the IP address of the device on TCP port 98. E.g.: https://172.16.102.220:98


© BLOCKBIT 85

10.1.1.5 Device Name – Action buttons – “Update/Synchronize”

The "Update/synchronize" action button lets you synchronize or update the device:

Figure 85 – “Update/Synchronize”.

By clicking on the "Update/Synchronize" button. The following window will appear:

Figure 86 – Update/Sync Device.

Follows more information about these options:

• Update: This option has the function of updating the device to the most current version available. E.g.: A UTM 14.6 being upgraded to a UTM 1.5.2;

• Synchronize: The function of this option is to synchronize the information of the device in question with the tab "Device Manager", allowing the display of the License Status, the version, and various other information;

By clicking on the save [ ] button the update or synchronization will take place.

Para mais informações a respeito de quando foi feito o último sincronismo, deixe o mouse

parado em cima do botão synchronism[ ], algo como a janela abaixo aparecerá:


86 © BLOCKBIT

Figure 87 – Device Name – Synchronize.

Synchronization and update were successful.

10.1.1.6 Device Manager – Columns “License Status”

The "License Status" column displays license information such as License Status and License Serial Number. E.g.: 79DA-01C1-7EE2-54BD.

Figure 88 – License Status – License Number.

The status of icons that can be displayed are:

• Active [ ]: Displays whether the license is active or inactive and its respective activation

date (Begin) and expiration (End).

• Unknown [ ]: Identifies that the license status is unknown. If a license is already active and this icon continues to appear, it is recommended to synchronize (see the page Erro! Indicador não definido.).

• Expired [ ]: Demonstrates that the license has expired. To reactivate it, contact BLOCKBIT.

• Inactive [ ]: Demonstrates that the license is inactive.

If you want to check other license information, simply place your mouse over the status icon and a text box will appear. As shown in the box:

Figure 89 – License Status.


© BLOCKBIT 87

10.1.1.7 Device Manager – “Version” Column

The "Version" columns display the version information and firmware updates installed on the device. Ex.: BLOCKBIT UTM 1.3.0 build 17022114.

Figure 90 – Device Manager – Version.

10.1.1.8 Device Manager – “Template” Column

The columns "Template" displays the name of the Settings Template applied to the device. E.g.: Devices Head Office.

Figure 91 – Device Manager – Devices Template.

To view details of the Template installed on the device click on the name. E.g.: Devices Head Office.

The Task Information screen will appear:

• “Expand All” button: Expands all installation package information;

Access to BLOCKBIT GSM allows you to manage devices in different firmware versions, however, it is highly recommended to always use the latest and most up-to-date version available.


88 © BLOCKBIT

• “Collapse All” button: Minimizes installation package information. E.g.: install_package_data;

Figure 92 – Devices Cluster Head Office – Task Information.

If you want to close the Task Information screen, click on close[ ]. To download the

information, click on download[ ].

10.1.1.9 Device Manager – “IPv4 Policy” Column

The "IPV4 Policy" columns display the name of the policy package applied to the device. E.g.: Branch Office Policies.

Figure 93 – Policy Package – Policies Branch Office.

To view details of the Policy Package installed on the device, click on the name. E.g.: Policies Branch Office. The following Task Information screen will appear:


• “Collapse All” button: Minimizes installation package information;

• Package installation information. E.g.: install_package_data.


© BLOCKBIT 89

Figure 94 – Policy Package – Task Information.

If you want to close the Task Information screen, click on the Close[ ]. To download the

information, click on Download[ ].

10.1.1.10 Device Manager – “IPv6 Policy” Column

The "IPV6 Policy" column displays the name of the policy package applied to the device. E.g. .: Head Office Policies.

Figure 95 – Policy Package – Policies Head Office.

To view details of the Policy Package installed on the device, click on the name. E.g.: Policies Branch Office. The following Task Information screen will appear:


• “Collapse All” button: Minimizes installation package information;

• Package installation information. E.g.: install_package_data.


90 © BLOCKBIT

Figure 96 – Policy Package – Task Information.

If you want to close the Task Information screen, click on the Close[ ]. To download the

information, click on Download[ ].

10.1.1.11 Device Manager – “Actions” Column

The columns Actions displays the "Edit", "Delete" buttons and the checkbox for each device or group.

Figure 97 – Device Manager – Botões “Edit”, “Delete” and the checkbox.

10.1.1.12 Device Manager – “Edit” button

Using the Button Edit[ ], you can edit the information of the selected device or group.

1. Set the items you wish to edit;


© BLOCKBIT 91

2. Click on Edit[ ];

3. Edit the information as you please;

4. If you want to close the Task Information screen, click on the Cancel[ ]. To

download the information, click on Save[ ].

The changes have been made successfully.

10.1.1.13 Device Manager – “Delete” button

Using the Delete [ ] button, it is possible to remove an existing device or registered group.

1. Set the item you wish to delete;

2. Click on Delete[ ]; 3. A screen will appear asking if you want to delete the selected item:

Figure 98 – Device Manager – Delete device.

In case you wish to cancel it, click on Cancel [ ]. To complete it, click on OK [

].

The removal has been performed successfully.

10.1.1.14 Device Manager – Contextual buttons



92 © BLOCKBIT

• Displaying results [ ]: It allows you to determine how many results will be displayed per page, the available options are: 10, 20, 30, 40, 50, 100, 500;



display stopped. To execute a search click on the search [ ] icon; To create the user,

click on Save [ ], otherwise, click on Close [ ] to close the window

without saving it;

• Actions menu [ ]: the following actions menu will be displayed:

Figure 99 – Device Manager – Action Menu.

Next, more details about these options.

10.2 Device Manager – Actions Menu – “Add Group”

The Device or Device Manager groups are intended to organize the registered devices. They also make it easy to install deployments for the various devices in a single action, that is, you do not need to apply settings in each one, just select the group and it will be displayed and in case you want to change something, all the applications will be carried out only once. To create the device groups, follow these steps:


© BLOCKBIT 93

1. Click on the Actions menu[ ] icon;

2. Select the “Add Group” button;

Figure 100 – Device Manager – Actions Menu.

3. An "Add Group" screen will appear, allowing you to create the desired group. Fill in the fields:

a. Name: set the group name. E.g.: Store;

b. Description: sets a description for the group. E.g.: Group by devices of Store;

c. Devices: Here you determine which "Devices" are part of the group being created

(you can leave it blank to add the Devices later);

4. Logger: This function is to determine the "Logger" that will be used to send reports (logs) to the Analyzer.1


94 © BLOCKBIT

Figure 101 – Device Manager – Create Group.

Click on Save [ ].

The group has been created successfully.

10.3 Device Manager – Actions Menu – “Delete Groups”

BLOCKBIT GSM allows you deleting groups’ devices. Follow the steps to delete groups below:

1. Select the group you wish to delete by clicking on selection[ ];

2. Click on the Actions menu[ ] icon;

3. Click on the “Delete Groups” option;


© BLOCKBIT 95

Figure 102 – Device Manager –Actions Menu – Delete Groups.

4. A confirmation message will appear checking to delete the selected group:

Figure 103 – Device Manager – Delete group.

Click on OK [ ].

The group has been removed successfully.


96 © BLOCKBIT

10.4 Device Manager – Actions Menu – “Select All Groups” and “Deselect All Groups”

By clicking on “Select all Groups”, over the actions menu all groups will be selected.

Figure 104 – Device Manager – Select All Groups.

This allows a change that affects all groups to be easily implemented.

The "Deselect all Groups" function is simply the opposite: Remove all previously selected selections.

10.5 Device Manager – Actions Menu – “Expand all Groups” and “Collapse all Groups”

By clicking on "Expand all Groups" in the action menu all groups will be expanded.

This allows you to easily view the contents of all groups.

The "Collapse all Groups" function is simply the opposite: Close all previously expanded groups


© BLOCKBIT 97

10.6 Device Manager – Actions Menu – Add “Device”

For the integration of BLOCKBIT GSM and BLOCKBIT UTM, it is necessary to make the registrations of the device.

At this moment we will register the devices. To perform this registration, it is necessary to access the BLOCKBIT GSM Web Interface and the BLOCKBIT UTM Web Interface. For ease of understanding a bold and underlined reference with the name of the interface in which we are working will be described before the start of the step by step:

BLOCKBIT GSM Interface Web:

1. In the left vertical menu, Click on "Devices", the tab "Device Manager" will be opened automatically;

2. Click on the Actions menu [ ] icon;

3. Click on the “Add Device” option;

Figure 105 – Device Manager – Actions Menu – Add Device.

The registration of devices must be carried out in the following order: first on BLOCKBIT GSM and later on BLOCKBIT UTM.


98 © BLOCKBIT

4. The device addition screen will appear, fill in the following fields on the Add device screen:

Figure 106 – Device Manager – Add Device.

In this screen there is two information that was not mentioned in the previous session, they must be obtained in the Web Interface of BLOCKBIT UTM. This information is: Deploy Key and API Key.

5. Access BLOCKBIT UTM interface;

Interface Web BLOCKBIT UTM:

6. Access the System Menu [ ] located at the left side of the screen;


© BLOCKBIT 99

7. Click on Administration [ ];

Figure 107 – BLOCKBIT UTM – Menu System – Administration.

8. Click on “Central Management” tab. The following window will be displayed:

Figure 108 – BLOCKBIT UTM – Menu System – Administration – Tab “Central Management”.

9. Fill in all fields described below:

• Enable Manager[ ]: enables the integration module with BLOCKBIT GSM;

• Address: BLOCKBIT GSM IP address or hostname. E.g.: 172.16.102.235;

• Deploy Service: BLOCKBIT GSM communication port. Default port: 444;


100 © BLOCKBIT

• Administrator: Select the integration user that BLOCKBIT GSM will use to administer the BLOCKBIT UTM. E.g.: 172.16.102.235;

• Status: identifies the status of the communication with GSM BLOCKBIT. E.g.: Offline;

• Deploy key: Encryption key for communication between BLOCKBIT UTM and BLOCKBIT GSM. If this field is not complete, follow these steps:

o To generate the "Deploy key", Click on [ ]. The message will appear if you

want to generate a Deploy key [ ];

Figure 109 – Generate new deploy key.

o Click on [ ]. The system will create the Deploy Key, as displayed in the below example:

Figure 110 – Deploy key.

The communication is always initiated by the BLOCKBIT UTM with the destination BLOCKBIT GSM, in the communication port TCP 444 (Deploy Port, configurable in the System Settings of BLOCKBIT GSM).

A Policy must be created allowing devices to communicate with GSM BLOCKBIT on TCP port 444.


© BLOCKBIT 101

• API Key: BLOCKBIT UTM cryptographic user key, with the administration and use permissions of the communication API with BLOCKBIT GSM. If this field is not complete, follow these steps:

o To generate the "API key", Click on [ ]. The message will appear if you

want to generate an API key [ ];

Figure 111 – Generate new API key.

o Click on OK[ ]. The system will create the API Key, as displayed in the below example:

Figure 112 – API key.

10. Click on Save[ ] located at the upper right corner of the screen to save the configurations;

11. Copy the Deploy key to insert into the GSM BLOCKBIT. To copy the key, click on a copy [

] from Deploy Key. The following message will appear:

Figure 113 – Text copied to the clipboard – Deploy Key.

Click on OK [ ]. After completing all the fields, the following result will be displayed:


102 © BLOCKBIT

Figure 114 – BLOCKBIT UTM – “Central Management” tab.

12. Returns to BLOCKBIT GSM Web Interface;

Interface Web BLOCKBIT GSM:

13. On the "Add Device" panel, paste the Deploy Key into the correct text box;

Figure 115 – BLOCKBIT GSM – Add Device – Deploy Key.

14. Return to BLOCKBIT UTM Web Interface;

Interface Web BLOCKBIT UTM

15. Copy the API key to insert into BLOCKBIT GSM. To copy the key, click on a copy[ ] from the key API. The following message will appear:


© BLOCKBIT 103

Figure 116 – Text copied tro the clipboard– API Key.

Click on OK[ ].

16. Return to BLOCKBIT GSM web interface;

Interface Web BLOCKBIT GSM:

17. In the "Add Device" panel, paste the API key into the correct text box;

Figure 117 – BLOCKBIT GSM – Add Device – API Key.

18. Preencha os demais dados:

• User Admin: BLOCKBIT UTM user with administrator permissions. It will be used when you want to access the BLOCKBIT UTM Web Interface through BLOCKBIT GSM. E.g.: admin;

• Password: BLOCKBIT UTM user password with administrator permissions. If it is not entered, the password will be requested the moment you access the device;

• Device Group: Select the group to which you want to add the device. E.g.: Head Office;

• Logger: It is an optional field, select from the drop-down list which Logger will be used to generate reports. E.g.: Logger1;

• Name: Enter the name that identifies the device in BLOCKBIT GSM. E.g.: Cluster Head Office;

• Company: Enter the name of the company that owns the Device. E.g.: BLOCKBIT;

• Description: It is an optional field, enter a description if necessary.

After completing all the fields, we will have arrived at a result similar to that shown by the image below:


104 © BLOCKBIT

Figure 118 – Device Manager – Add Device – example.

Click on Save [ ].

The device has been added successfully message will be displayed;

19. Return to BLOCKBIT UTM Web Interface;

Interface Web BLOCKBIT UTM

20. Click on the Saved Settings Queue icon [ ] to apply the settings;


© BLOCKBIT 105

Figure 119 – The queue of saved settings.

21. The communication between BLOCKBIT UTM and BLOCKBIT GSM will be established and in the Central Manager screen, the Status field will be changed from "Offline" to "Online";

The device registration was completed successfully.

22. Return to BLOCKBIT GSM Web Interface;

Interface Web BLOCKBIT GSM

23. On the Device Manager screen in front of the Device Name field, the online [ ] icon will appear in front of the created device name, informing you that the communication has been established successfully.

Figure 120 – Device Manager – Established communication.


106 © BLOCKBIT

If you want to register other devices, repeat the steps shown above. In our example, at the end of all the necessary registers, we will have an environment similar to this:

Figure 121 – Device Manager – Registered devices.

10.7 Device Manager – Actions Menu – “Delete Device“

Through the Actions Menu, you can delete several devices at the same time. Please follow these steps:

1. Select the devices you want to delete by clicking the select icon [ ], located in the "Actions" columns, on the right side of the trash icon. E.g.: Branch office 1, Cluster Head Office e-Store 1;

Figure 122 – Device Manager – Selected Devices.

2. Click on the Actions Menu [ ];

3. Click on the “Delete Devices” option;


© BLOCKBIT 107

Figure 123 – Device Manager – Actions Menu – Delete Devices

4. The following message will be displayed:

Figure 124 – Device Manager – Remove Devices.

Click on OK [ ].

The devices will be deleted.

10.8 Device Manager – Actions Menu – “Select all Devices” and “Deselect all Devices”


108 © BLOCKBIT

By clicking on "Select all Devices" in the action menu all devices will be selected.

Figure 125 – Device Manager – Select All Devices.

Isso permite que uma alteração que afete todos os grupos, seja facilmente implementada.

A função de “Deselect all Devices” é simplesmente o contrário: Remover todas as seleções feitas previamente.

10.9 Device Manager – Actions Menu – “Reload Status”

Updates the status of all devices registered in GSM. To do this, follow the steps:

1. Click on the Actions Menu;

2. Click on the “Reload Status” option;


© BLOCKBIT 109

Figure 126 – Device Manager – Actions Menu – Reload Status.


Figure 127 - Reload all devices.

4. To update the status of all devices, click on OK[ ], otherwise, click on Cancel

[ ].

10.10 Device Manager – Actions Menu – “Synchronize Devices”

To synchronize information for all devices registered to GSM, follow the steps:


110 © BLOCKBIT

1. Click on the Actions Menu; 2. Click on “Synchronize Devices” option;

Figure 128 – Device Manager – Actions Menu – Synchronize.

All synchronizing have been completed successfully.

10.11 Device Manager – Actions Menu – “Update Devices”

It performs the update of the version of the devices registered in GSM. To do this, follow the steps:

1. Select the devices by clicking on the checkbox [ ] you want to;

2. Click on the Actions Menu;

The BLOCKBIT GSM synchronizes the information of ALL the devices every 30 minutes automatically.


© BLOCKBIT 111

3. Click on “Update Devices” option;

Figure 129 – Device Manager – Actions Menu – Update Devices.


Figure 130 - Update devices.

5. To update the selected devices, click on OK [ ], otherwise, click on Cancel [

].


112 © BLOCKBIT

11 DEVICE COMMUNITIES

This section will demonstrate how to create Virtual Private Network (VPN) communities on BLOCKBIT GSM. These settings allow secure, fast and encrypted communication between devices.

• BLOCKBIT GSM allows you to configure two topology modes to create communities: Full Meshed and Star:

Figure 131 – Device Communities – Topology Full Meshed.

• Star: All devices communicate with a HUB (usually the Enterprise Matrix), and this allows communication between the devices, however, in a controlled manner. Following is the example of Star Topology.


© BLOCKBIT 113

Figure 132 – Device Communities – Topology Star.

To access the Device Communities, just click on “Devices”.

Figure 133 – “Devices”.

Click on the “Device Communities” tab.

Figure 134 – “Device Communities” tab.

The Device Communities screen will appear. It is composed of five columns: "Name", "Description", "Topology", "Devices" and "Actions". In addition to the contextual buttons at the top right of the screen.

Figure 135 – Device Communities.

The following will explain each column:


114 © BLOCKBIT

• Name: Displays the name of the registered Community;

• Description: Displays the description of the registered Community;

• Topology: Displays the type of topology registered;

• Devices: Displays the number of devices within the Community;

• Actions: Provides the following essential actions:

o Edit Button [ ]: allows editing a community;

o Delete Button [ ]: allows removing a community;

o Select Community[ ]: allows selecting a community.






• Actions menu [ ]: displays the following menu

Figure 136 – Device Communities – Actions Menu.

Next, more details about these options.

11.1 Device Communities – Actions Menu

In the action menu, we have: “Add Communities”, “Delete Communities”, “Select All” and

“Deselect All”. To access it, click on the arrow icon [ ].


© BLOCKBIT 115

Figure 137 – Device Communities – Actions Menu.

11.1.1.1 Device Communities – Actions Menu – “Add Community”

To create a Community, follow the steps below:

1. Click on the arrow icon [ ];

2. Click on “Add Communities” option;

Figure 138 – Device Communities – Actions Menu – Add Communities.

3. The "Add Communities" panel will appear. Fill in the information on the screen:

• Name: Device Community’s name. E.g.: VPN – Topology Full Meshed;

• Description: Device Community description. E.g.: FULL MESHED;


116 © BLOCKBIT

Figure 139 – Device Community – Create Community.

Click on Save[ ]. The Settings window will be displayed.

4. On the "General" section, complete the following fields:

• Name: Is the name of the "Community”;

• Description: É It is the description given to "Community" to assist in the organization;

• Shared Key: This is a shared key between devices. This key is used in the

authentication to view the key you have entered, click on the View[ ] icon;

• Topology: Define the topology chosen in the Topology field. E.g.: Full Meshed.

To complete the settings of the General, Encryption and Advanced sections, refer to the BLOCKBIT UTM manual.


© BLOCKBIT 117

Figure 140 – Device Community – General.

5. When completing the settings Click on "Devices" located in the upper left corner of the

"Settings" button. The "Devices" screen will appear;

Figure 141 – Device Communities – Menu Device.

6. Click on the Actions Menu unter “Add Device”;

Figure 142 – Device Communities – Actions Menu – Add Device.

The Add Device screen will be displayed.

7. Fill in the following fields: 8. Device: Select the device you want to add. E.g. Cluster Head office; 9. Local host: The IP address of the selected device used to establish the VPNs are usually

valid Internet IP addresses. E.g.:172.16.102.220;


118 © BLOCKBIT

10. Local ID: The IP address of the selected device used to establish the VPN, usually valid Internet IP addresses. E.g.: 172.16.102.220;

11. Networks: This text field allows the addition of networks in the "Local Networks. Click

on [ ] to add the selected item;

12. Local Networks: Local networks of the selected device that will be accessible to other devices after the establishment of the VPN. If you have chosen the wrong item, select the

item and click on [ ] to remove it. E.g.: Full Meshed: 192.168.220/24 or E.g.: Star: 192.168.192.0/18.

• Role: select between Spoke and HUB. E.g. Full Meshed: Spoke or E.g. Star: Hub;

o Full Mesh: In the Full Meshed topology all devices must be the Role Spoke.

E.g.: Spoke;

o In the Star topology, the center point must be set to HUB and the others as Spoke.

Figure 143 – Device Communities – Add Device.

In case of configuration - Topology Star: a device that will be the HUB or center point of the VPN star, a network address must be configured in the "Local Network" field that contains not only your local network but also all other connected device networks.


© BLOCKBIT 119

Click on Save [ ].

To add other devices, repeat the steps above.

After adding all the devices we will have the following screen:

Figure 144 – Device Communities – Registered Devices.

When completing the registration of all devices, click on "Save" located in the upper right corner of the screen.

Figure 145 – Device Communities – "Save".

After completing this procedure, the “Device Community” will be successfully registered.

11.1.1.2 Device Communities – Actions Menu – “Delete Communities”

To delete a Device Community through the Actions Menu, follow these steps:

1. Select "Device Community". Click the mouse in the field located in front of the

Community Name columns. The selected field will have the selected icon [ ];

Figure 146 – Device Community – Device Communities Selection.

2. Access the Actions Menu and Click on “Delete Communities”;


120 © BLOCKBIT

Figure 147 – Device Communities – Actions Menu – Delete Communities.

3. A screen will appear asking if you want to delete the selected item;

Figure 148 – Device Communities – Remove Communities.

Click on OK [ ].

The Devices Communities will be deleted.

11.1.1.3 Device Communities – Actions Menu – “Select All” and “Deselect All”

By clicking on “Select All” in the actions menu, the communities will be selected.

Figure 149 – Device Communities – Select All.

This allows a change that affects all communities to be easily implemented.


© BLOCKBIT 121


11.2 Device Community – “Edit” button

Through the "Edit" button, you can edit the information of the device Community:

1. Select which device Community you want to edit;

2. Click on Edit[ ]; 3. Edit the information as you please.

Figure 150 – Device Community – “Edit” Button.

If you want to cancel the Edit click on back [ ]located next to the Actions Menu.

To complete the edited changes, click on "Save" by locating in the upper right corner of the screen.

Figure 151 – Device Communities – “Save” Button.

After performing these procedures the device Community has been edited successfully.


122 © BLOCKBIT

11.3 Device Community – “Delete” button

Through the Delete [ ] Button, it is possible to delete the Registered Community:

1. Select the Community you wish to delete;

2. Click on Delete[ ]; 3. A screen will appear asking if you want to delete the selected item:

Figure 152 – Device Community – Delete selected item.


].

The Device Communities will be deleted.

11.4 Device Community – Exploring BLOCKBIT UTM configurations

In this section, we will show you how the Device Community settings are after installing the package on BLOCKBIT UTM devices.

11.4.1.1 Device Community – Topology Star

In this example, we installed the Device Community "VPN - Topology Star" settings on the BLOCKBIT UTM in the device HUB - "Cluster Head Office". To gain access to the IPSEC VPN settings panel on the BLOCKBIT UTM, follow the steps below:

1. Access BLOCKBIT UTM – Cluster Head Office;

2. Click on Service;

3. Click on VPN IPSEC.


© BLOCKBIT 123

Figure 153 – VPN IPSEC – BLOCKBIT UTM HUB – Topology Star.

On the other devices:

Figure 154 – VPN IPSEC – BLOCKBIT UTM SPOKES – Topology Star.

11.4.1.2 Device Community – Topology Full Meshed

In this example we installed the Device Community "VPN - Topology Full Meshed" the settings in the BLOCKBIT UTM in the device "Cluster Head Office". To access the IPSEC VPN settings panel on the BLOCKBIT UTM, follow the steps below:

1. Access BLOCKBIT UTM – Cluster Head Office;

2. Click on Service;

3. Click on VPN IPSEC.


124 © BLOCKBIT

Figure 155 – VPN IPSEC – BLOCKBIT UTM Topology Full Meshed.

On other devices:

Figure 156 – VPN IPSEC – BLOCKBIT UTM Topology Full Meshed and other devices.

11.4.1.3 Device Community – IPSEC Monitor

With the BLOCKBIT UTM, it is possible to monitor if the VPNs have been established. Follow these steps:

1. Click on “Monitor”;

2. Click on “IPSEC Connections”.


© BLOCKBIT 125

Figure 157 – IPsec connections – BLOCKBIT UTM.


126 © BLOCKBIT

12 DEVICE TEMPLATES

This section will demonstrate how to create, clone, and delete Templates. Templates are a set of general BLOCKBIT UTM device configurations. This set consists of "System", "Authentication", "Firewall", "Web Cache", "Web Filter", "Antimalware", "IPS", "ATP", "Traffic Shaping", "SD-WAN", and "DNS", so you can initialize devices with global settings quickly, conveniently and without errors, reducing TCO, maximizing IT team performance and avoiding configuration errors.

To access the screen, simply select the “Devices” Button.

Figure 158 – Button “Devices”.

Click on the “Device Templates” tab.

Figure 159 – Device Templates.

The Device Templates screen will appear. It is made up of the Actions Menu and Columns Template.

Figure 160 – Device Templates – Actions Menu and Template Column.


• Name: Displays the name of the registered Template;

• Description: Displays the description of the registered Template;

• Version: Displays the path in which the Template was created;

• Actions: The "Actions" menu consists of several buttons:

o Edit Button [ ]: Allows you editing a template;


© BLOCKBIT 127

o View Button [ ]: Allows you to view, edit and add more specific Template options;

o Delete Button [ ]: deletes the Template;

o Checkbox[ ]: Selects the Template.


• Displaying results[ ]: It allows you to determine how many results will be

displayed per page, the available options are: 10, 20, 30, 40, 50, 100, 500;


enter tags and perform a search based on these keywords if you click on cancel [ ] all

tags are removed from the search box, clicking outside this search panel will have its


• Calendar[ ]: The calendar allows you to make more precise searches taking into account temporal requirements, the allowed options are Today, Last 7 Days, Last 30 Days, This Month, Last Month (Last Month) and Custom (Custom). The custom mode allows you to choose a search between two periods ("From" to "To"), making this selection or clicking on the text boxes, a calendar will appear allowing the selection of the desired dates. To perform the search, click on "Submit", otherwise click outside the calendar or on "Clear".

In the Actions Menu, the following options are available: "Add Template", "Delete Template", "Clone Template", "Select All" and "Deselect All". To access it, click the actions menu icon

[ ].

Figure 161 – Device Templates – Actions Menu.

Each Action Menu item will be explained and exemplified below.


128 © BLOCKBIT

12.1 Device Templates – Actions Menu – “Add Template”

Through the "Add Template" Button it is possible to create a new Template. To access, follow the steps below:

1. Click on the “Add Template” option;

Figure 162 – Device Templates – Add Template.

2. Fill in the “Add Templates” form:

• Name: Sets the template’s name. E.g.: Devices Store;

• Version: Select the correct version according to the UTM that will be used. It is important to keep in mind that if you select a different version, the template will not work;

• Description: Sets the Template’s description. E.g.: Basic Stores Settings.

Figure 163 – Device Templates – New Template.


© BLOCKBIT 129

3. After registering the template’s name and description, click on detail [ ]. The “Edit Template” screen will be displayed;

Figure 164 – Device Templates – Edit Template.

On the left side there is a column containing a set of eleven settings:

4. "System", "Authentication", "Firewall", "Web Cache", "Web Filter", "Antimalware", "IPS", "ATP", "Traffic Shaping", "SD-WAN" and "DNS". Enter the settings you want, click the button on the description of each configuration. Fill in the information requested, to

activate them click on [ ] that is in front of each description.

For more information on each setting, refer to the BLOCKBIT UTM manual.


130 © BLOCKBIT

Figure 165 – Device Templates – Set of configurations.

If you want to cancel the Edit Click on back [ ] screen. To complete the Template settings registry, click on "Save" by locating in the upper right corner of the screen.

Figure 166 – Device Templates – "Save".

After performing these procedures the "Device Template" was created successfully.

12.2 Device Templates – Actions Menu – “Delete Templates”

Through the "Delete Templates" Button it is possible to delete several Templates at the same time. To delete via the Actions Menu, follow these steps:

1. Select which devices you want to delete. E.g.: Devices Branch Office and Device Branch Office-clone;


© BLOCKBIT 131

Figure 167 – Device Templates – Selection of Templates that will be deleted.

2. Access the Actions Menu and Click on the “Delete Templates” option;

Figure 168 – Device Templates – Delete Templates.

3. The following message will be displayed;

Figure 169 – Device Templates – Delete Template.


].

After completing this procedure, the Devices Templates will be successfully removed;

12.3 Device Templates – Actions Menu – “Clone Template”

Through the Button "Clone Template" it is possible to clone a Template. To access, click on the Actions Menu.


132 © BLOCKBIT

Figure 170 – Device Templates – Actions Menu – Clone Templates.

1. Select the template you wish to clone. E.g.: Devices Branch office;

Figure 171 – Device Templates – Clone Template.

2. On the Actions menu, click on “Clone Template”. The following message will be displayed:

Figure 172 – Clone template.


].

The Device Template screen will appear with the device cloned, as shown by the image below. E.g.: Device branch office–clone.


© BLOCKBIT 133

Figure 173 – Device Templates – Cloned Device Template.

12.4 Device Templates – Actions Menu – “Select All” and “Deselect All”

By clicking on "Select All" in the action menu all templates are selected.

Figure 174 – Device Templates – Select All.

This allows a change that affects all templates to be easily implemented.



134 © BLOCKBIT

13 POLICY PACKAGES

This section will demonstrate how to create policy packages that will later be installed on

devices.

With policy packages, you can manage the following services on BLOCKBIT UTM: "Web Content Filter", "WEB 2.0 Filtering and Application Control", "SSL Intercept", "IPS Inspection", "ATP Inspection", "Routing", "Traffic Shaping", "Traffic Priority and Warranty", "Traffic Quota Control and Time", "File Size Control", "Header Filters and Content", " link "," Multiple services "," NAT "and" Proxy ". To access the screen, simply select the" Policies ".

Figure 175 – Policy Manager – “Policies”.

Click on the “Policy Packages” tab.

Figure 176 – “Policy Packages” tab.

The "Policy Packages" screen will appear. It is made up of columns "Name", "Description", "Type", "Version", "Policies" and "Actions". Also, at the top right of the screen, there are 3 context-related search buttons.

Figure 177 – Policies – Policy Manager.


• Name: Displays the name of the Policy Package registered;

• Description: Displays the description of the Policy Package registered;

• Type: Represents the type of IP. E.g.: “IPv4”;


© BLOCKBIT 135

• Version: Displays the path in which the Policy Package was created. It is extremely important to create Policy Packages of the same version as the UTM, otherwise, the package will not be compatible;

• Policies: Displays the number of policies the package has. E.g.: “100”;

• Actions: The "Actions" column consists of several buttons:

o Edit[ ] button: Edits basic data from the Policy Package;

o View [ ] button: Allows you to view, edit, and add more specific Policy Package options;

o Delete[ ] button: Delete the policy package;

o Checkbox[ ] button: Select the policy package.


• Displaying results [ ]: It allows you to determine how many results will be displayed per page, the available options are: 10, 20, 30, 40, 50, 100, 500;

• Search[ ]: When you click on this Button, a small search box will appear, where you

can enter tags and perform a search based on these keywords if you click on [ ] all tags are removed from the search box, clicking outside this search panel will have its display stopped.

Figure 178 – Policy Manager – Actions Menu.

Each Action Menu item will be explained and exemplified below.

13.1 Policy Packages – Actions Menu – “Create Package”

With the "Create Package" option you can create a new package. To access, click the Actions Menu.

1. Click on the “Create Package” option;


136 © BLOCKBIT

2. The "New Policy Package" screen appears. Fill it out with the following data:

a. Name: sets the package name. E.g.: Devices Policies Store;

b. Description: sets the package description. E.g.: Policies and rules – Store;

c. Type: Select the protocol of the object, between the options: "TCP", "UDP", "IP"

and "ICMP". E.g.: TCP;

3. Version: The version that will be used in the package. Attention: It is important that the package version is the same as the UTM, otherwise they will not be compatible.

Figure 179 – Policy Manager – New Policy Package.

Click on Save [ ].

The package has been created successfully.

13.2 Policy Packages – Actions Menu – “Delete Packages”

Through the "Delete Packages" Button it is possible to delete several packages installed at the same time. To delete by the Actions Menu, follow these steps:

1. Select which package (s) you want to delete by clicking the checkbox [ ] located on the action menu. E.g.: Policies Branch office;


© BLOCKBIT 137

Figure 180 – Policy Manager – Delete Packages.

2. Access the Actions Menu and click on “Delete Packages”.

Figure 181 – Policy Manager – Actions Menu – Delete Packages.


Figure 182 – Policy Manager – Remove Packages?


].

After completing this procedure the packages will be deleted.


138 © BLOCKBIT

13.3 Policy Packages – Actions Menu – “Clone Packages”

Through the "Clone Packages" Button it is possible to clone existing packages. To clone packages follow the steps:

1. Select which package (s) you want to clone by clicking the checkbox [ ] located on the action. E.g.: Policies Branch office;

Figure 183 – Policy Manager – Selection of packages to be cloned.

2. On the Actions menu, click on “Clone Packages”.

Figure 184 – Policy Manager – Actions Menu – Clone Packages.

3. The following message will be displayed.

Figure 185 – Policy Manager – Clone Selected Itens.


© BLOCKBIT 139


].

Figure 186 – Policy Manager – Policie Package Clonada.

After performing these procedures the packages will have been successfully duplicated.

13.4 Policy Packages – Actions Menu – “Select All” and “Deselect All”

By clicking on “Select All” under the actions menu. All policies will be selected.

Figure 187 – Policy Manager – Policie Package “Select All”.

This allows a change that affects all policies to be easily implemented.


13.5 Policy Packages – Viewing and Feeding Policy Packages

The Policy Manager screen displays the Policies you have created, to apply policies within a

package, you must create the package first and then click the List Group Policies [ ] button.


140 © BLOCKBIT

The "List Group Policies" Button has the function of creating the Policy Groups for a particular package.

Figure 188 – Policy packages – “List Group Policies”.

It is important to remember that the policies are ordered by "Priority", and they are applied considering the method "First Match Wins" (which literally means "1st among competitors WINS"). Therefore, the policies located above have priority, while the policies have a lower priority.

To create the Policy Groups, follow the steps:

1. Click on the List Group Policies [ ];

2. The "Policy Manager" interface will appear. The "Action Menu", "Tags" and "Header/Footer" screen at the top of the screen will be the name of the package used. E.g.: Policy Manager Policies Branch office;

Figure 189 – Policy Manager – Policies Branch office.

3. Define how the groups will be positioned: Header or Footer: • Header: All policy groups created in the "Header" when installing in BLOCKBIT UTM

will be installed above the existing BLOCKBIT UTM policy groups, so they have priority over the rules created in the UTM itself;

• Footer: All policy groups created in "Footer" when they are installed in the BLOCKBIT UTM will be installed from the existing groups of policies in the BLOCKBIT UTM, so the rules created in the blockbit UTM have priorities on the applied rules in "Footer".

To set the chosen group, simply click the "Header" or "Footer" button on the screen.

13.5.1.1 Policy Packages – Actions Menu – “Create Policy Group”

The "Create Policy Group" button creates a policy group, so follow the steps:

1. On the Actions Menu, click on the "Create Policy Group" option;


© BLOCKBIT 141

Figure 190 – Policy Manager – Actions Menu – Create Policy Group.

2. The “New Group” form will be displayed, fill in the “Group Name” field and click on Save. E.g.: Access Administrator;

Figure 191 – Policy Manager – Create a Policy Group – New Group.

3. In case you wish to cancel it, click on Close[ ]. To complete it, click on Save[

]; 4. A new blue item will appear on the Policy Manager screen with the description previously

entered (in the case of the example: "Access Administration"). E.g.: Policy Manager – Policies Branch office;


142 © BLOCKBIT

Figure 192 – Policy Manager – Policies Branch office – Administrator Access.

This item contains five action buttons:

Figure 193 – Policy Manager – Access Administration – Action Buttons.

Below is a description of each one from right to left:

• Moves the group order [ ];

• Select the group [ ];

• Edits the group [ ] (basically changes the group name);

• Informs how many policies exist in the group [ ];

• Expands to view the policies created in the group [ ]. The Policy Manager screen will appear one more time with the created group already available.

13.5.1.2 Policy Packages – Actions Menu – “Delete Policy Groups”

The "Delete Policies" button deletes the selected Policy Groups. Attention: When deleting the group, all the policies that are inside it will be deleted as well. To delete, follow the steps:

1. Select the Policy group (s) you wish to delete. To select, click the mouse in the checkbox.

In the selected groups the checkbox will change from gray to blue [ ]. E.g.: Administrator CLI;

Figure 194 – Policy selected to be removed.

2. On the Actions menu, click on “Delete Policy Groups”;


© BLOCKBIT 143

Figure 195 – Policy Manager – Menu Actions – “Delete Policies”.


Figure 196 – Policy Manager – Delete itens policies.

In case you wish to cancel it, click on Cancel[ ]. To complete it, click on OK [].

The group will be successfully removed.

13.5.1.3 Policy Packages – Actions Menu – “Move Policy Groups”

The "Move Policies" button moves the selected policy group from "Footer" to "Header" or vice versa. As mentioned earlier, this determines the ("Header" with higher priority than "footer".) To move a Policy Group, follow the steps:

1. Select the Policy Group you want to move. To select, click the mouse in the checkbox. In

the selected packages the checkbox will change from gray to blue [ ]. E.g.: Access Administrator;


144 © BLOCKBIT

Figure 197 – Selected policy to be moved.

2. No Actions Menu, click on “Move Policy Groups”;

Figure 198 – Policy Manager – Actions Menu – Move Policies.

3. The confirmation message will be displayed.

Figure 199 – Policy Manager – Move Policy.

If you wish to cancel, click on Cancel[ ]. To finish it, click on OK[ ].

The Policy Group has been moved successfully.


© BLOCKBIT 145

13.5.1.4 Policy Packages – Actions Menu – “Import Template”

The "Import Template" button is used to import an existing Template into a specific package, where it can be imported into the "Header" or "Footer" of the selected package. To import a Template, follow these steps:

1. Select the location, which the template will import to “Header” or “Footer”;

2. On the Actions menu, click on “Import Template”;

Figure 200 – Policy Manager – Actions Menu – Import Template.

3. The Import Template will be displayed. Select the Template Name, which will be imported. E.g.: Productivity Loss;

Figure 201 – Policy Manager – Template Name.

If you wish to cancel, click on Close[ ]. To finish it, click on Save[ ]. The imported template will display “_import” in front of its name as exemplified below.


146 © BLOCKBIT

Figure 202 – Group selection – Salve Template.

The Template has been imported successfully.

13.5.1.5 Policy Packages – Actions Menu – “Save Template”

The "Save Template" button is used to save a selected set of selected policies and convert it as Template to be reused later. To save a Template, follow these steps:

1. Select the group you want to save. To select it, click on the checkbox. In the selected

packages the checkbox will change from gray to blue [ ]. E.g.: Access Administrator;

Figure 203 – Group Selection – Save Template.

2. On the Actions menu, click on “Save Template”;


© BLOCKBIT 147

Figure 204 – Policy Manager – Actions Menu – Save Template.


Figure 205 – Message – Successfully.

To finish it, click on OK[ ].

The template has been created successfully.


148 © BLOCKBIT

13.5.1.6 Policy Packages – Actions Menu – “Create Policy”

The "Create Policy" button creates the policies in the policy group by selecting. To create a Policy, follow the steps:

1. On the Actions menu, click on “Create Policy”;

Figure 206 – Policy Manager – Actions Menu – Create Policy.

2. The New Policy will be displayed;


© BLOCKBIT 149

Figure 207 – Policy Manager – New Policy.

3. On Actions Menu, click on “Expand All”. Fill in the fields on the General screen:

• Name: Sets the policy’s name.

• Description: Sets the description of the policy. E.g.: Administrator;

• Tags: Create tags to make it easier to filter the policy search. E.g: admin, access, port_98;

• Action: Determines the action of this policy "Allow", "Deny" and "Reject";

• Policy Group: Select the group in which the policy will be created: E.g. Access Administrator;

• Time: If the checkbox is selected, determines whether the rule will apply on business days ("Business") or "Weekend";

• Schedule: If the checkbox is selected, it allows you to determine whether the rule will apply to a "Period / Date" object;


150 © BLOCKBIT

Figure 208 – Policy Manager – New Policy – General.

4. After setting all configurations, click on “Save”, located at the upper-right corner of the

screen;

Figure 209 – Policy Manager – New Policy – “Save”.

The Policy Manager screen will be displayed once more:

Figure 210 – Policy Manager – Policy Manager Policies Branch office.

After the New Policy created in the group we can see that there are six action buttons created, as shown below:

For more information about filling the screens: Source, Destination, Content, Routing, Controls, and Advanced, refer to the BLOCKBIT UTM manual.


© BLOCKBIT 151

Figure 211 – Policy Manager – Access Administration.

Follows the description of each of these buttons, in the right to left order:

• Moves the policy’s priority within a group [ ];

• Select the Policy [ ];

• Policy button status: gray - disabled OR green – enabled[ ];

• Policy Name: Sets the policy`s name [ ];

• Policy action: The available actions are: Allow, Block, Inspect: ATP, or Inspect: IPS IPS [

];

• “Actions” button: Edit or delete an existing policy .

13.5.1.7 Policy Packages – Actions Menu – “Delete Policies”

The “Delete Policies” button deletes all selected policies. To delete policies, follow the steps below:

1. Select the Policy (s) you wish to delete. To select it, click on the checkbox. In the selected

packages the checkbox will change from gray to blue [ ]. E.g.: Administrator CLI;

Figure 212 – Policy selected to be deleted.

2. On the Actions menu, click on “Delete Policies”;


152 © BLOCKBIT

Figure 213 – Policy Manager – Actions Menu – Delete Policies.

3. The following screen will be displayed. Confirm the item exclusion.

Figure 214 – Policy Manager – Delete itens policies.

In case you wish to cancel, click on Cancel[ ]. Then, click on OK[ ] to finish it.

The policy has been removed successfully.

13.5.1.8 Policy Packages – Actions Menu – “Move Policies”

The "Move Policies" button moves the selected policy from one group to another group. To move a Policy, follow the steps below:


© BLOCKBIT 153

1. Select the Policy you want to move. To select, click the mouse in the checkbox. In the

selected packages the checkbox will change from gray to blue [ ]. E.g.: Access Administrator;

2. On the Actions menu, click on “Move Policies”;

Figure 215 – Policy Manager – Actions Menu – Move Policies.

3. The screen will appear asking which group to move. Select the group. E.g.: Web Access:

Figure 216 – Policy Manager – Move Policy.

In case you wish to cancel, click on Close[ ]. Then, click on Save[ ].

The Policy has been moved successfully.


154 © BLOCKBIT

13.5.1.9 Policy Packages – Actions Menu – “Delete Tag”

The "Delete Tag" option is used to delete existing Tags. To delete Tags, follow these steps:

1. On the Actions Menu, click on “Delete Tag”;

Figure 217 – Policy Manager – Actions Menu – Delete Tag.

2. The delete tags screen will be displayed. Enter the tags you wish to delete. E.g.: Test;

Figure 218 – Policy Manager – Delete Tags.

In case you wish to cancel, click on Close[ ]. Then, click on Save[ ].

The tags have been removed successfully.


© BLOCKBIT 155

13.5.1.10 Policy Packages – Actions Menu – “Valid”

The "Valid" button is intended to validate created policies. To validate policies, follow these steps:

1. On the Actions menu, click on “Valid”;

Figure 219 – Policy Manager – Actions Menu – Valid.

2. If the policy is valid, a certain [ ] will appear in front of the policy name, as shown below;

Figure 220 – Policy Manager – Delete Tags.

The policies have been successfully validated.

13.5.1.11 Policy Packages – Actions Menu – “Collapse All”

The "Collapse All" button collects the policy group. To collect the policy group, follow these steps:

1. On Actions, click on “Collapse All”;


156 © BLOCKBIT

Figure 221 – Policy Manager – Actions Menu – Collapse All.

2. The Policy Manager screen will have its policies collected:

Figure 222 – Policy Manager – Policies collected.

13.5.1.12 Policy Packages – Menu Actions – “Expand All”

The "Expand All" button is intended to expand the policy group. To expand the policy group, follow these steps:

1. On the Actions menu, click on “Expand All”;


© BLOCKBIT 157

Figure 223 – Policy Manager – Actions Menu – Expand All.

2. The Policy Manager screen will have its policy groups expanded.

Figure 224 – Policy Manager – Expanded Policies.


158 © BLOCKBIT

14 POLICIES TEMPLATES

This section will demonstrate how to create Policies Templates that can be reused later for a new policy package

To access the screen, just select the “Policies” button.

Figure 225 – Policy Template – “Policies”.

Click on the “Policy Templates” tab.

Figure 226 – Policy Templates.

The Policy Templates screen will be displayed. It contains the Actions Menu and the created Policies. Here is the description of the columns, from left to right:

• Name: Template name;

• Type: IP type;

• Version: UTM version;

• Actions: A set of essential actions:

o Edit[ ]: By clicking this icon, it is possible to rename the template;

o List[ ]: Shows the template content, allowing to insert or remove tags, create, move and delete policies, validate them and finally search them. This option offers possibilities similar to those available in the Policy Manager, except to determine their location in the "Header" or "Footer";

o Delete[ ]: Remove the template;

o Checkbox[ ]: Select the Template;


© BLOCKBIT 159

Figure 227 – Policies – Policy Templates.

Next, we’ll explain the Actions Menu.

Through the Actions Menu, it is possible to create, clone and delete Templates.

To access it, click on the Actions Menu [ ]

Figure 228 – Policy Templates – Actions Menu.

Next, each item of the Actions Menu will be explained and exemplified.

14.1 Policy Templates – Actions Menu – Add Template

Through the "Add Template" option you can create a new Policy Template. To access it, click on the Actions Menu.

1. Click on the “Add Template” option;

Figure 229 – Policy Templates – Actions Actions.


160 © BLOCKBIT

2. Fill the “New Template” screen:

• Name: Template name. E.g.: Productivity Loss;

• Type: IP type;

• Version: Version in which the template will be made. It is important that the template has the same version as the UTM, otherwise, there will be compatibility failures;

Figure 230 – Policy Template – New Policy Template.

Click on the Save button [ ] button.

Template successfully created.

14.2 Policy Templates – Actions Menu – Delete Templates

Through the "Delete Templates" button you can delete the selected Templates. To do so through the Actions Menu, follow these steps:

1. Select which Template(s) you wish to delete. To select, just click on the checkbox located next to the description of the Template Name. In the selected packages the checkbox will

change from gray to blue [ ]. E.g.: Administrator Access;


© BLOCKBIT 161

Figure 231 – Policy Templates – Selection of Templates to be deleted.

2. Enter the Actions Menu and click on the "Delete Templates" option.

Figure 232 – Policy Templates – Delete Templates.

3. A notification message will appear asking if you really want to delete the selected

Templates:

Figure 233 – Policy Templates – Remove the template message.

If you wish to cancel, click on the Cancel [ ] button. To confirm, click OK [

].

After performing these procedures, the Templates will be successfully deleted.


162 © BLOCKBIT

14.3 Policy Templates – Actions Menu – Clone Templates

Through the "Clone Templates" button you can duplicate an existing Template. To clone Templates, follow these steps:

1. Select which Template(s) you wish to clone. To select, just click on the checkbox located next to the description of the Template Name. In the selected packages the checkbox will

change from gray to blue [ ]. E.g.: Administrator Access;

Figure 234 – Policy Templates – Selection of Templates to be cloned.

2. In the Actions Menu, click on the “Clone Templates” option;

Figure 235 – Policy Templates – Clone Templates.

A message will appear asking if you want to clone the selected item:

Figure 236 – Policy Templates –Clone Template messsage.


© BLOCKBIT 163

If you wish to cancel, click on the Cancel button [ ] button. To confirm, click OK [

].

The Policy Templates screen with the cloned package will appear. Eg: Administrator Access-clone;

Figure 237 – Policy Templates – Cloned Template.

14.4 Policy Templates – Actions Menu – Select All and Deselect All

By clicking “Select All” in the Actions Menu, all templates will be selected.

Figure 238 – Policy Templates – Select All.

This allows for easy implementation of an action that affects all templates.



164 © BLOCKBIT

14.5 Policy Templates – “Edit” Button

Through the “Edit” button it is possible to edit a Template name. To rename a template, follow these steps:

1. Select the Template;

2. In the “Actions” column, click on the Edit [ ] button;

3. A screen to edit the Template name will be displayed;

Figure 239 – Policy Templates – Edit Template.

After renaming the template, if you wish to cancel, click on the Close [ ] button. To

confirm, click on the Save [ ] button.

Next, we’ll analyze the Delete [ ] button (The View [ ] button will be analyzed later on).

14.6 Policy Templates – “Delete” Button

Through the “Delete” button it is possible to delete a Template. To delete a template, follow these steps:


2. In the “Actions” column, click on the Delete [ ] button;


© BLOCKBIT 165

Figure 240 – Policy Templates – “Delete”.

3. A screen will appear asking if you want to delete the Template:

Figure 241 – Policy Templates – Remove Template message.

If you wish to cancel, click on the Cancel [ ] button or the OK [ ] button to confirm. Template successfully deleted.

14.7 Policy Templates – Selection Box

Through the selection box, you can select a Template and apply the available options from the action menu.

To select a Template simply click its selection box [ ], as shown in the image below;


166 © BLOCKBIT

Figure 242 – Policy Templates – Selected.

The Template has been correctly selected and is ready to be manipulated by the user.

Next, we’ll analyze the View [ ] button.

14.8 Policy Templates – “View” Button

Through the "View" button you can view and edit a Template. To edit the Template, follow these steps:


2. In the “Actions” column, click on the View [ ] button;

3. The interface shown in the image below will appear, where you can view and edit the template;

Figure 243 – Policy Templates – View Template.

Next, we’ll analyze the options available in this interface:

14.8.1.1 Policy Templates – View Policy

The policy view screen is composed of the Actions menu and four columns. Here is a brief description of the columns:


© BLOCKBIT 167

• Select[ ]: Allows the selection of all policies. In this column you can also find the

following functions:

o [ ]: This icon is used to change the position of each policy;

o [ ]: This checkbox allows interaction with the options available in the Actions

Menu.

• ID: The unique identification code of the policy. E.g.: 11;

• Policy Name: Defines the name of the policy, whether it is active, and what action it

takes:

o [ ]: This icon determines whether the policy is active or not.;

o Policy Name: Set the policy name. E.g.: Administrator Access;

o Action Icons: Determines the behavior of the policy in question, with the

following possibilities:

▪ Allow [ ]: As the name says, this option is used to allow access;

▪ Deny [ ]: Access is denied;

▪ Reject [ ]: Access is denied, however, a rejection message is

displayed to the user;

• Actions: A set of essential actions:

o Edit [ ]: Allows to edit the settings of the policy registered in the Edit Policy

panel (for more information, see page Erro! Indicador não definido.);

o Delete [ ]: Allows to remove the policy

14.8.1.2 Policy Templates – Back Button

The Back[ ] button is used to return to the “Policies” screen with the “Policy Templates” tab open.

When you click this button, any unsaved settings will be ignored and the previous settings will be restored.

14.8.1.3 Policy Templates – Tags

By clicking the tags [ ] button it is possible to check which it is possible to find out which tags were used when the policies were created. To do so, follow these steps:

1. Click on the tags [ ] button;

2. A window with all tags used in the policies of this template will appear, as shown below;


168 © BLOCKBIT

Figure 244 – Policy Templates – Tags.

3. When selecting any of the tags, only the policies that have been categorized with these

tags will be displayed;

Figure 245 – Policy Templates – Search by Tags.

4. To remove the tag selection, just click on the eraser [ ] icon.

Next, we’ll analyze the search panel.

14.8.1.4 Policy Templates – Search

By clicking this button, a small search box will be displayed, where it is possible to perform a

search based on Keywords. To perform the search, click on the Search button [ ]. If you click

on the "X" button [ ] the search will be terminated.

14.8.1.5 Policy Templates – Actions Menu

To access the Actions Menu, just click on the action menu icon [ ] located at the top right of the screen.


© BLOCKBIT 169

Figure 246 – Policy Templates – Actions Menu.

Next, we’ll describe the Actions Menu options:

14.8.1.5.1 Policy Templates – Actions Menu – Create Policy

The “Create Policy” option creates policies in the selected template. To create a Policy, follow these steps:

1. In the Actions Menu, click on the “Create Policy” option;

Figure 247 – Policy Templates – Actions Menu – Create Policy.

2. The “New Policy” screen will be displayed;


170 © BLOCKBIT

Figure 248 – Policy Templates – New Policy.

3. The policy creation process is the same as described earlier in the chapter about Policy

Packages (see page Erro! Indicador não definido.).

14.8.1.5.2 Policy Templates – Actions Menu – Move Policies

The “Move Policies” button moves the selected policy from a group to another. To move a policy, follow these steps:

1. Select the Policy you want to move. To select it, click on the checkbox. In the selected

packages the checkbox will change from gray to blue [ ]. E.g.: Access Administrator;

2. In the Actions Menu, click on the “Move Policies” option;


© BLOCKBIT 171

Figure 249 – Policy Templates – Actions Menu – Move Policies.

3. A screen will appear asking to which group the policy should be moved. Select the group. Ex: Web Access:

Figure 250 – Policy Templates – Move Policy.

If you want to cancel click on the Close button [ ]. To confirm, click on the Save button

[ ].

The policy was successfully moved.

14.8.1.5.3 Policy Templates – Actions Menu – Delete Policies

The “Delete Policies” option deletes selected Policies. To delete a Policy, follow these steps:

1. Select the Policy (s) you wish to delete. To select, click on the checkbox. In the selected

packages the checkbox will change from gray to blue [ ]. E.g.: Administrator CLI;

Figure 251 – Policy selected to be deleted.


172 © BLOCKBIT

2. In the Actions Menu, click on the “Delete Policies” option;

Figure 252 – Policy Templates – Menu Actions – Delete Policies.

3. The screen will appear asking if you want to delete the items:

Figure 253 – Policy Templates – Delete itens policies.

If you wish to cancel, click on the Cancel button [ ]. To confirm, click on the OK button

[ ].

The policy was successfully removed.

14.8.1.5.4 Policy Templates – Actions Menu – Delete Tag

The "Delete Tag" option is used to delete created Tags. To delete Tags, follow these steps:

1. In the Actions Menu, click on the "Delete Tag" option;


© BLOCKBIT 173

Figure 254 – Policy Templates – Actions Menu – Delete Tag.

2. The Delete Tags screen will appear. Enter the Tag(s) you wish to delete. E.g.: Test.

Figure 255 – Policy Templates – Delete Tags.

If you wish to cancel, click on the Close button [ ]. To confirm, click on the Save button[

].

Tags have been successfully deleted.

14.8.1.5.5 Policy Templates – Actions Menu – Valid

The "Valid" button is intended to validate created policies. To validate policies, follow these steps:

1. In the Actions Menu, click on the "Valid" option;


174 © BLOCKBIT

Figure 256 – Policy Templates – Actions Menu – Valid.

2. If the policy is valid, a correct checkmark [ ] will be shown in front of the policy name,

as illustrated below;

Figure 257 – Policy Templates – Delete Tags.

Policies have been successfully validated.


© BLOCKBIT 175

15 USERS – USERS

This section will demonstrate how to create users. This feature aims to facilitate the definition and administration of compliance policies that will be applied later.

To access the screen, simply select the "Users" menu;

Figure 258 – Users – “Users”.

The Users tab should already be automatically selected, otherwise click on it;

Figure 259 – Users – Users.

The Users Screen will appear. It is composed of the Actions Menu and seven columns. Here is a brief description of the columns:

• Login: User login. E.g.: user_filial1blockbit.com;

• Name: User name. E.g.: user_filial1;

• Email: User email. E.g.: [email protected];

• Device: Shows on which device the user has been registered. E.g.: Branch Office 1;

• Used: Enumerates the number of times this group was used in the Policies Manager;

• Actions: Selects users by ticking the selection box [ ].


176 © BLOCKBIT

Figure 260 – Users main screen.

To access the action menu click on the action menu button [ ].

Figure 261 – Users – Actions.

In the section ahead we will explain in detail the Actions Menu in detail.

15.1 Users – Actions Menu – Add to Group

With the "Add to Group" option you can add a new user to a Group. To access it, follow these steps:

1. Select the user(s) you want to add. To select them, click on the checkbox next to the

"Used" column. For the selected users the checkbox will change from gray to blue [ ]. E.g.: user_filial1blockbit.com and [email protected];


© BLOCKBIT 177

Figure 262 – Users – Selection of users to bea added.

2. In the Actions menu, click on the "Add to group" option;

Figure 263 – Users – Add to group.

3. Define in which group you want to add the user(s). You can select one or more groups to add. E.g.: Administrators;

Figure 264 – Users – Add users to group.


178 © BLOCKBIT

Click on the Save button [ ] to save.

User successfully added to Group.

15.2 Users – Actions Menu – Select All and Deselect All

By clicking "Select All" in the Actions Menu, all users will be selected.

Figure 265 – Users – Select All.

This allows for easy implementation of an action that affects all users.



© BLOCKBIT 179

16 USERS - GROUPS

This section will demonstrate how to create user groups. This feature makes it easy to define and manage compliance policies that will be applied later.

To access the screen, simply select the "Users" button.

Figure 266 – Users.

Click on the “Groups” tab.

Figure 267 – Users – User Groups.

The User Groups screen will appear. It is made up of the Actions Menu and User Groups already created, which will be sorted in 5 columns.

Here is a brief description of the columns:

• Name: Group name;

• Type: IP type; Device Name: Shows in which device the Group was registered;

• Used: Enumerates the number of times this group was used in the Policies Manager;

• Action: Has the "Edit", "Delete" and "Select" buttons:

o Edit[ ]: Edit group;

o Delete[ ]: Remove group;

o Select[ ]: Select Users Groups;

Figure 268 – Users Groups.


180 © BLOCKBIT

We will explain the Actions Menu in detail, and later on the "User Groups”.

16.1 User Groups – Actions Menu – Create Group

Through the "Create Group" button you can create a new Group. To access it, click on the Actions menu.

1. Click on the "Create Group" option;

Figure 269 – User Groups – Menu Actions- Create Group.

2. Complete the Create Group screen;

• Name: Group name. E.g.: Support;

• Description: Group description. E.g.: Group of members of the TI team – Support;

Figure 270 – User Groups – Create Group.

Click on the Save button [ ] to save.


© BLOCKBIT 181

Group successfully created.

16.2 User Groups – Actions Menu – Delete Group

Through the "Delete Group" button it is possible to delete created groups. To access it, click on the Actions menu.

1. Select the Group you want to delete. To select it, click on the checkbox next to the Name

column. For the selected group, the checkbox will change from gray to blue [ ]. E.g.: Administrator and Store Managers;

Figure 271 – User Groups – Groups you want to delete.

2. In the Actions Menu, click on the "Delete Groups" button;

Figure 272 – User Groups – Actions Menu.

3. A message will appear asking if you want to delete the item(s):


182 © BLOCKBIT

Figure 273 – User Groups – Message asking if you wish to delete the user(s).

Click on the Cancel button[ ] to cancel. Click on the OK button [ ] to delete selected users.

The group(s) have been successfully deleted.

16.3 User Groups – Actions Menu – Select All and Deselect All

By clicking "Select All" in the Actions Menu, all user groups will be selected.

Figure 274 – User Groups – Select All.

This allows for easy implementation of an action that affects all user groups.


16.4 User Groups – “Edit” Button

Through the "Edit" button you can edit a created group. To access it, click on the Actions column:

1. Define which Group you want to edit;


© BLOCKBIT 183

2. In the Actions column, click on the Edit button [ ];

3. The User Groups - Settings screen will appear. In this screen, you can edit the Settings information (for the group name and description) and Users (group users). It also consists of an Actions Menu;

Figure 275 – User Groups – Registered users.

4. In the Actions Menu, you can add and delete users from the group;

Figure 276 – User Groups – Add User and Delete Users.

5. To add users, click on the "Add Users" option in the Actions Menu. Select the users you want to add, and just click on the chosen users with your mouse. E.g.: [email protected] and [email protected].


184 © BLOCKBIT

Figure 277 – User Groups – Add Users.

If you want to select all registered users, click on the "All" button. Click on the "Save" button to add users.

The User Groups screen will appear, with the added group users:

Figure 278 – User Groups – Added group users.

In the Actions Menu, you can delete users from the group. To delete, follow these steps:

1. Select the users you want to delete. E.g.: [email protected];


© BLOCKBIT 185

Figure 279 – User Groups – User selected to be deleted.

2. In the Actions Menu, click on the "Delete Users" option;

Figure 280 – User Groups – Delete Users.

3. A confirmation message will appear before deleting the item(s):

Figure 281 – User Groups – Message asking if you wish to delete the user(s).

Click on the Cancel[ ] to cancel. Click on the OK[ ] to delete the selected users.

User(s) successfully deleted.

On the User Groups screen in the Settings field, you can edit:

• Name: Group name. E.g.: Administrator;

• Description: Group description: Administrators;


186 © BLOCKBIT

Figure 282 – User Groups – “Save” Settings.

After you have made all the necessary settings, click on the "Save" button located in the upper right corner of the User Groups screen.

Figure 283 – User Groups – “Save” Button.

The system will update and return to the User Groups main screen.

Figure 284 – User Groups – Main Screen.

16.5 User Groups – “Delete” Button

With the "Delete" button you can delete a registered group. To delete a group, follow these steps:

1. Define the Group you want to delete;

2. In the "Actions" column, click on the Delete button [ ];

3. The confirmation message will appear before deleting the item:


© BLOCKBIT 187

Figure 285 – User Groups – Delete items.

If you wish to cancel, click on the Cancel button [ ]. To confirm, click on the OK button

[ ].

Group successfully deleted.


188 © BLOCKBIT

17 OBJECTS

This section will demonstrate how to create, edit, and delete objects.

The system was developed object-oriented to facilitate the process of adjusting, maintaining and reading rules and configurations.

Objects can be shared between system services and devices.

All changes applied to an object are automatically replicated and applied to all services in use by the respective object.

To access the screen, simply select the "Objects" button;

Figure 286 – Objects.

17.1 Objects – Address

Address Objects are used to identify hosts (machines) or networks.

By default, the system brings some pre-registered objects, for example, objects for invalid network classes: "Class A reserved", "Class B reserved", "Class C reserved".

All of these objects are available for use in the configuration and enabling processes of services.

The GSM BLOCKBIT allows the definition of three ways of identifying Address:

• IP address / Network address: Objects that identify machines and networks through their IP addresses. E.g.: 172.16.102.235 ou 172.16.102.0/24;

• MAC address: Objects that identify the machines through the physical addresses of their network cards. E.g.: 38:59:F9:1F:4E:16;

• FQDN address: Objects that identify the machines through its DNS address. E.g.: gsm.blockbit.com or www.blockbit.com;

To access it, click on the "Addresses" tab:

Figure 287 – Objects – Address.




© BLOCKBIT 189

In the "Addresses" tab you can see the Actions Menu and five columns:

• Name: Object name;

• Description: Object description;

• Type: Object type;

• Used: Enumerates the number of times this object is being used;

• Actions: Allows you to edit, delete and select Objects;

o Edit[ ]: Allows to edit the Object;

o Delete[ ]: Allows to remove the Object;

o Select[ ]: Select desired Objects;

Figure 288 – Objects – Address Objects.

To access the Actions Menu click on the Action Menu button [ ].

Figure 289 – Objects – Menu Actions.

We will explain in detail the Actions Menu and later on the Addresses tab.

17.1.1.1 Objects – Address – Actions Menu – Create Object

Through the "Create Object" button you can create a new Address Object. To access it, follow these steps:


190 © BLOCKBIT

1. In the Actions Menu, click on the "Create Object" option;

Figure 290 – Objects – Object Address – Create Object.

2. Fill in the information on the Create Address Object screen: 3.

• Name Object name. E.g.: DNS Google;

• Type: Type of the connection object, you can choose between IPv4, IPv6, MAC, and FQDN Address;

• Item: Item: Item of the object. Enter the value in the field and click on the [ ] button to add. E.g.: 8.8.8.8;

• List: List of added values. To delete some entered value, select it and click on the [

] button;

• Description: Object description.

Figure 291 – Objects – Create address object.


© BLOCKBIT 191

Click on the Close button [ ] to Cancel, Import button [ ] to import and Save

button [ ] to Save.

Object Address successfully created.

17.1.1.2 Objects – Address – Actions Menu – Delete Object

With the option "Delete Object" it is possible to delete one or more Address Objects. To access it, follow these steps:

1. Select the Object (s) you want to delete. To select them, click on the checkbox next to the

Name column. For the selected groups the checkbox will change from gray to blue [ ]. E.g.: Class A network and Class B network;

Figure 292 – Objects – Address Objects – Objects selected to be deleted.

2. In the Actions Menu, click on the "Delete Objects";

You can import a list of Addresses from a text file with one Address per line.


192 © BLOCKBIT

Figure 293 – Objects – Address Object – Delete Object.

3. A message will appear asking if you want to delete the objects:

Figure 294 – Objects – Message asking if you want to delete objects.

Click on the Cancel button [ ] if you want to Cancel. Click on the OK button [

] to Save.

Address Objects successfully deleted.

17.1.1.3 Objects – Address – Select All and Deselect All

By clicking "Select All" in the Actions Menu all objects will be selected.

Figure 295 – Objects – Select All.


© BLOCKBIT 193

This allows for easy implementation of an action that affects all objects.


17.1.1.4 Objects – Address – “Edit” Button

Through the Edit button [ ] you can edit a created object. To access it, click on the Actions column:

1. Determine the Object you want to edit;


3. The Edit Address Objects screen appears. Edit the desired fields:

Figure 296 – Objects – Edit Address Object.


] to Save.

Address Object successfully edited.

17.1.1.5 Objects – Address – “Delete” Button

Through the Delete button [ ] you can delete a created Address Object. To access it, click on the Actions column:


194 © BLOCKBIT

1. Determine the Object you want to delete;

2. In the Actions column, click on the Delete[ ];

3. A message will appear asking if you want to delete:

Figure 297 – Address Objects – Message asking if you want to delete the selected item.

Click on Cancel [ ] if you want to Cancel. Click on OK [ ] to delete.

Address Object successfully deleted.

17.2 Objects – Services

Objects Services identify protocols and applications based on their TCP, UDP, IP, and ICMP

ports.

In its initial configuration, BLOCKBIT GSM has several registered Service objects. Ex.: "DHCP",

"DNS", "HTTP", "HTTPS".

To access the screen, simply select the "Objects" menu.

Figure 298 – “Objects” button.

Click on the “Services” tab.

Figure 299 – Objects – Services.


© BLOCKBIT 195

The Service Objects screen will appear, consisting of the Actions Menu and four columns:




• Actions: Allows you to edit, select and delete the object:



o Select[ ]: Selects the objects that will be used.

Figure 300 – Service Objects.

To access the Actions Menu click on the Actions Menu button [ ].

Figure 301 – Objects – Actions Menu.

Through examples, we will explain the Actions Menu and later on the Service Objects screen.


196 © BLOCKBIT

17.2.1.1 Objects – Services – Actions Menu – Create Objects

With the "Create Object" option you can create a Service Object. To access it, follow these steps:


Figure 302 – Service Objects – Create Object.

2. The Create Service Objects screen will appear. Fill in the fields:

• Name: Object name. E.g.: HTTP;

• Protocol Types: Select the protocol of the object, between the options: "TCP", "UDP", "IP" and "ICMP". E.g.: TCP;

• List: Lists added ports. To delete some value entered, select it and click on the [ ] button;

• Description: Object description. E.g.: HTTP Protocol.

Figure 303 – Service Objects – Create Service Objects.


© BLOCKBIT 197

Click on the Close [ ] to Cancel. Click on the Save button [ ] to save.

Service Objects successfully created.

17.2.1.2 Objects – Services – Actions Menu – Delete Object

With the "Delete Object" option you can delete one or more Service Objects. To access it, follow these steps:

1. Select the Service Objects you want to delete. To select them, click on the checkbox next to the Name column. For the selected groups the checkbox will change from gray to blue

[ ]. E.g.: AH, AOL;

Figure 304 – Service Objects – Objects selected to be deleted.

2. In the Actions Menu, click on the "Delete Objects" option;

Figure 305 – Service Objects – Delete Object.

3. The message will appear if you want to delete Service Objects:


198 © BLOCKBIT

Figure 306 – Service Objects – Message asking if you want to delete the objects.

Click on the Cancel button [ ] to Cancel. Click on the OK button [ ] to delete.

Service Objects successfully deleted.

17.2.1.3 Objects – Services – Select All and Deselect All





17.2.1.4 Objects – Services – “Edit” Button

Through the Edit button [ ] you can edit Service Objects. To access it, click on the Actions column:


© BLOCKBIT 199

1. Determine which Service Objects you want to edit;


3. The Edit service object screen will appear. Edit the desired fields:

Figure 308 – Service Objects – “Edit” button.

Click on the Close button [ ] to Cancel. Click on the Save button [ ] to Save.

Service Objects successfully edited.

17.2.1.5 Objects – Services – “Delete” Button

Through the Delete button [ ] you can delete created Service Objects. To access it, go to the Actions column:

1. Determine the Service Object you want to delete;

2. In the Actions column, click on the Delete button [ ];

3. A confirmation message will appear for this removal:


200 © BLOCKBIT

Figure 309 – Service Objects – Message asking if you want to delete the selected item.


Service Object successfully deleted.

17.3 Objects – Times

Time Objects are comprised of "days of the week" and "start and end time". Ex .: "Business Hours - start: Monday from 8:00 AM until Friday at 6:00 PM”.

To access the screen, simply select the "Objects" button.


Click on the “Times” tab.

Figure 311 – Objects – Time.

The Time Objects screen will appear. It is composed of the Actions Menu and four columns:





o Edit [ ]: Allows to edit the Object;


© BLOCKBIT 201

o Delete [ ]: Allows to delete the Object;

o Select [ ]: Selects the objects that will be used;

Figure 312 – Time Objects.



Through examples, we'll explain the Actions Menu and later on the Time Objects screen.

17.3.1.1 Objects – Time – Actions Menu – Create Objects

With the "Create Object" option you can create a Time Objects. To access it, follow these steps:



202 © BLOCKBIT

Figure 314 – Objects time – Create Object.

2. The Create Schedule Object screen will appear. Fill in the fields:

• Name: Object name. E.g.: Business;

• Weekday: Allows you to select the days of the week. E.g.: “Monday”, “Tuesday”, “Wednesday”, “Thursday” and “Friday”;

• Start / End time: Sets the time ranges of the object. E.g.: “08:00 – 11:59”;

• List: List of time ranges. To delete some entered value, select it and click on the [] button;

• Description: Object description. E.g.: Business Day/hours.

Figure 315 – Objects Time – Create a schedule object.

Click on the Close button [ ] to Cancel. Click on the Save button [ ] to save.

Time object successfully created.

17.3.1.2 Objects – Time – Actions Menu – Delete Object

With the option "Delete Object" it is possible to delete one or more Time Objects. To access it, follow these steps:


© BLOCKBIT 203

1. Select the Time Object (s) you want to delete. To select it, click on the checkbox next to the Name column. For the selected groups the checkbox will change from gray to blue [

]. E.g.: Business.

Figure 316 – Time Objects – Objects selected to be deleted.


Figure 317 – Time Objects – Delete Objects.

3. Surgirá a mensagem questionando se deseja deletar os Time Objects:

Figure 318 – Time Objects – Mesage if you want to delete objects.


] to delete.

Time Objects successfully deleted.


204 © BLOCKBIT

17.3.1.3 Objects – Time – Select All and Deselect All

By clicking "Select All" in the action menu all objects will be selected.




17.3.1.4 Objects – Time – “Edit” Button

Through the Edit button [ ] you can edit a Time Object. To access it, in the Actions column:

1. Determine the Time object you want to edit;


3. The Edit schedule object screen will appear. Edit the desired fields;


© BLOCKBIT 205

Figure 320 – Time Objects – “Edit” Button.


Time Object successfully edited.

17.3.1.5 Objects – Time – “Delete” Button

Through the Delete button [ ] it is possible to delete a created Time Object. To access it, click on the Actions column:

1. Determine the Time Object you want to delete;


3. The screen will appear with the confirmation question to delete:


206 © BLOCKBIT

Figure 321 – Time Objects – Message asking iuf you want to delete the selected item.


Time Object successfully deleted.

17.4 Objects – Schedules

Schedule Objects are composed of the definitions of a period comprised of "Start date/time" and "End date/time". Ex .: 2017-05-11 8:00 AM through 2017-05-30 5:00 PM.


Figure 322 – “Objects” Button.

Click on the “Schedules” tab.

Figure 323 – Objects – Period/Dates.

The Schedules screen will appear, composed of the Actions Menu and four columns:





o Edit [ ]: Allows to edit the Object;


© BLOCKBIT 207

o Delete [ ]: Allows to delete the Object;

o Select [ ]: Selects the objects that will be used;

Figure 324 – Schedule Objects.



Through examples, we'll explain the Actions Menu and later on the Schedule Objects.

17.4.1.1 Objects – Schedules – Actions Menu – Create Objects

With the "Create Object" option you can create a Schedule Object. To access it, follow these steps:

1. On the Actions Menu click on the "Create Object" option;


208 © BLOCKBIT

Figure 326 – Date Objects – Create Object.

2. The Create Date Objects screen will appear. Fill in the fields:

• Name: Object name. E.g.: Vacations;

• Start / End date: Sets the period that matches "Start date/time" and "End date/time".

To add click [ ]. E.g.: From 2018-07-1 8:30 AM to 2018-07-31 8:30 AM;

• List: Displays a list of added periods. To delete some entered value, select it and click

on the [ ] button;

• Description: Object description. E.g.: “Vacation Days”.

Figure 327 – Schedule Objects – Create Date Objects.


Schedule Object successfully created.


© BLOCKBIT 209

17.4.1.2 Objects - Schedules - Actions Menu – Delete Object

With the "Delete Object" option you can delete one or more Schedule Objects. To access it, follow these steps:

1. Select the object you want to delete;


3. A confirmation question will appear to delete the Schedule Object:

Figure 328 – Date Objects – Message asking if you want to delete objects.

Click on the Cancel button [ ] if you wish to Cancel. Click on the OK button [

] to Delete.

Schedule Objects successfully deleted.

17.4.1.3 Objects – Schedules – Select All and Deselect All





210 © BLOCKBIT


17.4.1.4 Objects – Schedules – “Edit” Button

Through the Edit button [ ] You can edit Schedule Objects. To access it, click on the Actions column:

1. Determine the Schedule Object;


3. The Edit date object screen appears. Edit the desired fields:

Figure 330 – Schedule Objects – “Edit” button.


Schedule Object successfully edited.


© BLOCKBIT 211

17.4.1.5 Objects - Schedules - “Delete” Button

Through the Delete button [ ] you can delete one or more Schedule Objects created. To access it, go to the Actions column:

1. Determine the Schedule Object you want to delete;


3. A screen will appear with a message asking if you want to delete:

Figure 331 – Schedule Objects – Message asking if you want to delete the selected item.


Schedule Object successfully deleted.

17.5 Object – Dictionary

Dictionary Objects are composed of "word lists" or a set of "regular expressions" combinations.

Eg "Alphanumeric", "Email Address", "HTML Link", "URL", etc.



Click on the "Dictionaries" tab.


212 © BLOCKBIT

Figure 333 – Objects – Dictionaries.

The Dictionaries Objects screen will appear. It is composed of the Actions Menu and four columns:







o Select[ ]: Selects the objects that will be used.

Figure 334 – Objects – Dictionary Objects




© BLOCKBIT 213

We will explain in detail the Actions Menu and later on the Dictionary Objects.

17.5.1.1 Objects – Dictionary - Actions Menu – Create Object

Através do botão “Create Object” é possível criar um Dictionary Object. Para acessar, siga os passos:

1. No Menu Actions clique na opção “Create Object”;

Figure 336 – Objects – Dictionary Object – Create Object.

2. The Create Dictionary Object screen will appear. Fill in the fields:

• Name: Object name. E.g.: Alphanumeric;

• Expressions: Includes a list of "regex", which we can combine to build a regular

expression and add to the Keywords list. Select the code and click [ ] to add in the Word field;

• Word: This field defines the regular expression to identify the desired item. To add

click [ ] . E.g.: [a-zA-Z\s0-9]+;

• List Extensions: Displays the list of regular expressions. To delete some entered value,

select it and click on the [ ] button;

• Description: Object description.


214 © BLOCKBIT

Figure 337 – Objects – Create a Dictionary object.

Click on the Close button [ ] to Cancel, the Import button [ ] to import and

the Save button [ ] to Save.

Dictionary Object successfully created.

17.5.1.2 Objects – Dictionary – Actions Menu – Delete Object

Through the “Delete Object” button, it is possible to delete one or more Dictionary Objects. To access it, follow these steps:

1. Select the Object(s) you want to delete. To select them, click on the checkbox next to the

Name column. For the selected groups the checkbox will change from gray to blue [ ]. E.g.: Credit Card and Email Address;


© BLOCKBIT 215

Figure 338 – Objects – Dictionary Objects – Objects selected to be deleted.

3. In the Actions menu, click on the "Delete Objects" option;

Figure 339 – Objects – Dictionary Objects – Delete Object.

4. A confirmation message will appear asking if you really want to delete the Dictionary Objects:

Figure 340 – Objects – Message asking if you want to delete the objects.

Click on the Cancel button [ ] if you wish to Cancel. Click on the OK button [

] to delete.

Dictionary Objects successfully deleted.


216 © BLOCKBIT

17.5.1.3 Objects – Dictionary – Select All and Deselect All

By clicking "Select All" in the action menu all objects will be selected.




17.5.1.4 Objects – Dictionary – “Edit” Button

Through the Edit button [ ] you can edit a Dictionary Object. To access it, click on the Actions column:

1. Select the Object you want to edit;


3. The Edit Dictionary Object screen appears. Edit the desired fields:


© BLOCKBIT 217

Figure 342 – Dictionary Objects – “Edit” Button.

Click on the Close button [ ] to Cancel, the Import button [ ] to Import and

the Save button [ ] to Save.

Dictionary Object successfully deleted.

17.5.1.5 Objects – Dictionary – “Delete” button

Through the Delete button [ ] you can delete a created Dictionary Object. To access it, click on the Actions column:

1. Select the Object you want to delete;




218 © BLOCKBIT

Figure 343 – Dictionary Objects – Message asking if you want to delete the selected item.

Click on the Cancel button [ ] to Cancel. Click on the OK button [ ] to Delete.

Dictionary Object successfully deleted.

17.6 Objects – Content Types

Content Types Objects are composed of clusters of content types based on the type of content

that specify their characteristic. Ex: "ActiveX", "Compressed", "Executables", "Images",

"Javascript", "Multimedia" and "Office".

To access its screen, simply select the "Objects" button.


Click on the “Content Types” tab.

Figure 345 – Objects – Content Types.

The Content Types Objects screen will appear, consisting of the Actions Menu and four columns:






© BLOCKBIT 219



o Select[ ]: Selects the objects that will be used;

Figure 346 – Content Type Objects.

Through examples, we'll explain the Actions Menu and later on the Content-Type Objects Screen.

17.6.1.1 Objects – Content Type – Actions Menu – Create Objects

Through the "Create Object" button you can create a Content-Type Objects. To access it, follow these steps:

1. On the Actions Menu click on the "Create Object" option;

Figure 347 – Content Type Objects – Create Object.

2. The Content-Type Objects screen will appear. Fill in the fields:

• Name: Object name. E.g.: Images;

• Mime-Types: Sets the identifier of the application type or file. To add it, click [ ]. E.g.: “image/bmp”;

• List Mime-Types: Displays the object's mime-types list. To add it, click [ ];


220 © BLOCKBIT

• Extensions: Defines the extensions of the application or file type. To add it, click []. E.g.: “bmp”;

• List Extensions: Displays the list of object extensions. To delete some entered value,

select it and click on the [ ] button;

• Description: Object description. E.g.: “Bitmaps Images and Vector Files”.

Figure 348 – Content Type Objects – Create a mime object.


Mime Content Types Object successfully created.

17.6.1.2 Objects – Content Type – Actions Menu – Delete Object

Using the "Delete Object" button you can delete one or more Content Types Objects. To access it, follow these steps:

1. Select the Content Type Objects you want to delete. To select it, click on the checkbox next to the Name column. For the selected groups the checkbox will change from gray to

blue [ ]. E.g.: Active X and Compressed;


© BLOCKBIT 221

Figure 349 – Content Type Objects – Objects selected to be deleted.


Figure 350 – Content Type Objects – Delete Object.

3. A confirmation message will appear asking if you want to delete the Content Types Objects:

Figure 351 – Content Type Objects – Message asking if you want to delete objects.


] to delete.

Content Types Objects successfully deleted.


222 © BLOCKBIT

17.6.1.3 Objects – Content Type – Select All and Deselect All

By clicking “Select All” in the Actions Menu, all objects are selected.



The "Deselect All" function is simply the opposite: it removes all previously selected selections.

17.6.1.4 Objects – Content Type – “Edit” Button

Through the Edit button [ ] you can edit a Content Types Object. To access it, go to the Column Actions:

1. Select the object you want to edit;


3. The Edit mime object screen will appear. Edit the desired fields:


© BLOCKBIT 223

Figure 353 – Content Type Objects – “Edit” button.


Content Types Object successfully edited.

17.6.1.5 Objects – Content Type – “Delete” Button

Through the Delete button [ ] you can delete created Content Type Objects. To access it, click on the Actions column:

1. Select the object to be deleted;




224 © BLOCKBIT

Figure 354 – Content Types Objects – Message asking if you want to delete the selected item.


Content Types Objects successfully deleted.


© BLOCKBIT 225

18 DEPLOYS PANEL

This section will demonstrate how to track and manage the BLOCKBIT GSM configuration packages installations on managed devices. These packages, when requested to install, are called DEPLOYS.

To access the Deploys Panel, click on the button located at the top right of the screen, next to the user’s menu:

Figure 355 – Botão “Deploys Panel”.

A screen will appear listing the deploy. To access the screen with filters, click on one of the four options: deploy(s) accept, deploy(s) running, deploy(s) pending and deploy(s) with an error. A new tab will open in the browser with the selected filter. If you want to access the screen without a filter, click on the "Deploys Panel" button.

Figure 356 – Deploys Panel – List.

Another way to access Deploys Panel is by clicking the "Deploys" button located on the left menu:

Figure 357 – “Deploys” button.

The Deploys screen will be displayed:


226 © BLOCKBIT

Figure 358 – Deploys.

The Deploys screen consists of a progress panel at the top of the screen, a bar with search tools, and a list of tasks with six columns: "Package", "Auditor", "Scheduled", "Progress", "Status" and "Action". Located at the top of the interface, the Deploys panel contains the information: Accept, Running, Pending, and Error.

18.1 Deploys – Accept, Running, Pending and Error

Deploys Panel's main purpose is to be informative. It consists of four statuses: "Accept", "Running", "Pending" and "Error". Next, we will explain each of them:

• Accept: Deploy(s) that have already been approved by the auditor, however, they’re are awaiting installation;

• Running: Deploy(s) that are in the process of being installed;

• Pending: Deploy(s) that are awaiting the auditor's assessment;

• Error: Deploy(s) that have encountered errors during installation.

Figure 359 – Deploys Panel – Information Panel.

This panel displays the number of deploys that are currently active. Due to its lower priority, Deploys with "Success" status are not mentioned here, because technically it would have already been solved and had a "Canceled" status. After all, it is assumed that this task would have already been revoked. To view these two types of status, just perform a search.

Next, we’ll analyze the search panel in detail:


© BLOCKBIT 227

18.2 Deploys Panel – Search and Filters

To find a specific Deploy, there is a search bar divided into: "Scheduled", "Owner", "Auditor", "Status", "Package Type", "Results Per Page" and the "Search" button.

In this session, we will analyze the operation of the Deploys search system.

Figure 360 – Deploys Panel – Deploys Search.

From left to right, we have:

• Scheduled: Filters by start or end date/time, referring to the date when the Deploy was scheduled;

• Owner: Filters by the user who created the Deploy;

• Auditor: Filtered by the auditor who approved the Deploy;

• Status: Filter by Deploy status, which can be of the following: Success, Accept, Running, Pending, Error or Canceled;

• Package type: Filters by Deploy type, which can be: Policy Package, Device Template or Device Community.

After creating the filter, you can select how many results are displayed per page, with a minimum of 10 and a maximum of 50 items per page.

Para executar a busca, clique no botão de search[ ]. Se desejar limpar as informações, simplesmente clique no botão “Deploys” no menu vertical à esquerda.

Finally, for navigation, the "Switch Pages" buttons allow you to navigate between pages.

Figure 361 – Deploys Panel – Switch Pages.

In the right-hand corner of the page, the "Total" item displays the sum of currently available deploys.

18.3 Deploys Panel – Deploys List

In the deploy list, all the created deploys in the system are displayed.


228 © BLOCKBIT

Figure 362 – Deploys Panel – Deploy List.

The deploys system has a business rule that consists of the following premises:

• The deploy list is always sorted by date of creation and in the descending order;

• The status of a deploy is classified as:

o Pending [ ]: Package awaiting auditor’s opinion;

o Accept [ ]: Package has been accepted and its deploy will start within the specified time;

o Running [ ]: The package is being implemented;

o Success [ ]: Package was successfully implemented;

o Canceled [ ]: Package implementation canceled;

o Error[ ]: Something wrong has occurred (for more information, just click on the error icon).

• All activities within a deploy require a comment. Comments are added to the deploys "Activity" list;

• If you have a device with "Error" status, it will be the main status of the entire deploy.

A seguir segue o fluxo do processo de aprovação dos Deploys:


© BLOCKBIT 229

Figure 363 – Deploys Panel – Deploys Approval Proccess.

In the deploys panel, we have the information columns: Package, Auditor, Scheduled, Progress, Status, and Actions.

18.3.1.1 Deploys Panel – Package column

The Package column displays the name of the package applied in the deploy.

To view details of the Package applied to the deploy, click on the package name. The Deploy Information screen appears:

• “Expand All” button: Expands all installation package information; • “Collapse All” button: Minimizes installation package information; • “Download” button: Allows the download of the package, in JSON, enabling backup or

implementation of this specific Deploy in a GSM.


230 © BLOCKBIT

Figure 364 – Deploys Panel – Deploy Information.

To close the window, click on the Close button [ ].

18.3.1.2 Deploys Panel – Auditor Column

The Auditor column displays the name of the Deploy Owner and the registered auditor, who is responsible for approving it.

Figure 365 – Deploys Panel – Auditor.

18.3.1.3 Deploys Panel – Scheduled Column

The "Scheduled" column displays information regarding the day the deploy was created and the date it’s scheduled to run.

Figure 366 – Deploys Panel – Scheduled.


© BLOCKBIT 231

18.3.1.4 Deploys Panel – Progress Column

The Progress column displays a progress bar that shows you the deploy completion percentage.

Figure 367 – Deploys Panel – Progress.

18.3.1.5 Deploys Panel – Status Column

The "Status" column displays the current status of a particular deploy: Pending, Running, Canceled, Success and Error.

To display detail of the Status of each device that will be applied in a particular deploy, click on the Status name and the "Deploy Information" screen will appear:

Figure 368 – Deploys Panel – Device Status.

The statuses displayed in this column are identical to those already mentioned (see page 227).

In the "Message" column, messages related to any failures are displayed (if the status "error" appears). The image below exemplifies the function of this column:


232 © BLOCKBIT

Figure 369 – Deploys Panel – Error Message.

Next, we will explain the buttons and their respective statuses.

18.4 Deploys Panel – “Activity”, “Accept”, “Cancel” and “Reinstall” Buttons

On the right, under the "Action" column, there are four action buttons: "Accept", "Cancel", "Activity" and "Remove".

The functionality of each button will be shown below.

18.4.1.1 Deploys Panel – “Accept” button

Through the "Accept" button the auditor can approve the installation of the package. It is also possible to leave a comment about the reason that justifies the approval of the Deploy.

To access, click on the "Accept” button.

Figure 370 – “Accept” button.

The Justify screen will appear. Write the desired comment:

Figure 371 – “Accept Package” button.

Click on the Save button [ ] to save or the Close button [ ] to close the screen.


© BLOCKBIT 233

18.4.1.2 Deploys Panel – “Reinstall” button

The "Reinstall" button performs the reinstallation of the packages.

To access it, click on the "Reinstall" button.

Figure 372 – “Reinstall” button.

The Justify screen will appear. In "Apply for", determine whether the reinstallation will be performed on all devices ("All devices") or on all devices that have an error ("All devices with error"). Finally, in the "Comment" field, write the desired comment:

Figure 373 – Reinstall Deploy.


18.4.1.3 Deploys Panel – “Cancel” button

Using the "Cancel" button, the auditor is able to reject the package installation. It is also possible to leave a comment with the reason for rejecting the Deploy.

To access it, click on the “Cancel” button.

Figure 374 – “Cancel” Button.

The Justify screen will be displayed.


234 © BLOCKBIT

Figure 375 – Cancel Package installation.


18.4.1.4 Deploys Panel – “Activity” Button

The "Activity" button displays Deploys activity history.

To access, click on the "Activity” button.

Figure 376 – Deploys Panel Action Buttons – "Activity".

Task Activity screen will appear:

Figure 377 – “Deploy Activity” button.


© BLOCKBIT 235

Click on the Close button [ ] to close the screen.

18.4.1.5 Deploys Panel – “Remove” button

The "Remove" button does exactly what the name says: It revokes the package.

To access it, click on the "Remove" button.

Figure 378 – “Remove” Button.

Figure 379 – Remove Deploy.

Click on the OK button [ ] to save or the Cancel button [ ] to close the screen.


236 © BLOCKBIT

19 INSTALL PACKAGE

Through the "Install Package" button, it is possible to install the configuration package for devices integrated with BLOCKBIT GSM.

Figure 380 – “Install Package” Button.

Clicking on the button will bring up the Install Package screen:

Figure 381 – Install Package.

Below we will analyze the components of the "Install Package" screen:

19.1 What

Determines which operation will be performed, consisting of:


© BLOCKBIT 237

Figure 382 – Install Package – What.

• Package type: This drop-down menu determines the type of package that will be installed, which can be of the following types:

o Policy Package: With this option, you can install the packages created in "Policies", in the "Policy Package" tab (página 134);

o Device Template: With this option, you can install the templates in "Device", in the "Device Template" tab (página 126);

o Device Community: Through this option, it is possible to install the communities in "Device", in the "Device Communities" tab (página 112).

• Package: This drop-down menu specifies the desired Policy, Device or Device Community.

19.2 Where

Determines where the package will be installed, consisting of:


238 © BLOCKBIT

Figure 383 – Install Package – Where.

• Devices & Devices group: Selects the device or group of devices on which the packages

will be installed. Click [ ] to add the selected item. If you have chosen the wrong item,

select it and click [ ] to remove it. You can select multiple groups or devices;

19.3 When

Determines the moment at which the package will be installed, consisting of:


© BLOCKBIT 239

Figure 384 – Install Package – When.

• Date and Time: Sets the desired date and time. If you want to enter the current date and

time, click on the Now checkbox [ ]. For different dates and times, click on the "Date and Time" field and select the desired option. To close the window, click outside the calendar;

19.4 Who

Determines who will be responsible for installing the package, consisting of:


240 © BLOCKBIT

Figure 385 – Install Package – Who.

• Assign To: Defines the Auditor responsible for approving the configuration installation. If you want to be responsible, click on the "Assign to me" button. Ex: Admin;

• Comment: Enter a comment to define the function of these settings, making it easier for the Auditor to understand it;

Click on the Save button [ ] to save the setup package installation request.

After performing these procedures, the Template install request was successfully completed. To apply these settings, see chapter DEPLOYS PANEL (page 225).


© BLOCKBIT 241

20 BLOCKBIT GSM - ANALYZER

The BLOCKBIT GSM - ANALYZER is an advanced reporting and evaluation module, providing a holistic perspective on detection by running real-time network traffic monitoring at multiple points and network segments. The analyzer enables the investigation and execution of actions oriented to fight threats, intrusion attempts and unauthorized use of applications.

BLOCKBIT GSM - ANALYZER acts by receiving the data sent by the UTMs, which BLOCKBIT GSM - MANAGER manages, and generating various types of reports and logs.

The analyzer offers the following features:

• Records of all activities performed by your users;

• Summary of the appliances and loggers performance;

• View potential security threats and intrusion prevention;

• The effectiveness of web filters and policy enforcement;

• And more...

To access the Analyzer, click on the application's icon [ ] at the top of BLOCKBIT GSM and select "Analyzer".

Figure 386 – BLOCKBIT GSM – Acessing the Analyzer.

When you do this, the following screen will be displayed:


242 © BLOCKBIT

Figure 387 – BLOCKBIT GSM – Home Screen.

In this screen, the "Network Traffic" report will be automatically selected.

Now we will analyze each component of "Network Traffic".

20.1 Network Traffic

To access the network traffic reports, click on the "Analysis" icon located on the left side. A drop down menu will be displayed. Select the "Network Traffic" option.

Figure 388 – Network Traffic.


© BLOCKBIT 243

To generate a network traffic report, locate the checkbox that is positioned at the top right of the screen, as shown below:

Figure 389 – Network Traffic – Selection Box.

In this checkbox, all the devices (or groups of devices) previously registered in the Device Manager will be listed (to see how to insert a device, check the Device Manager session in the BLOCKBIT GSM - MANAGER chapter). To create a traffic report, select the desired device.

Figure 390 – Network Traffic –Device Selection.

From the right side of where we have just selected the devices, you can see a selection box for dates. The purpose of this is basically to allow even more accurate filtering of results. This is done by determining a start date "FROM" to end date "TO".


244 © BLOCKBIT

Figure 391 – Network Traffic – Date Selection.

To do so, click this checkbox. A calendar will be displayed. Select the box below "FROM" to determine the start date. Then, click "TO" and set the end date. If you want to clear the selection, click "CLEAR". If you want to close the calendar, simply click outside it. You can also select preset dates using the available buttons: "Today", "Last 7 Days", "Last 30 Days", "This Month", "Last Month" and "Custom" (If you start selecting a date with "FROM" and "TO", this option will be automatically selected). Once you have established the two dates, click on "SUBMIT".


© BLOCKBIT 245

Figure 392 – Network Traffic – Calendar.

Next, we will analyze in detail the components of "Network Traffic”.

20.1.1.1 Geolocation Hits

In "Geolocation Hits", the destinations of the network users’ connections are displayed. The global map shows through a colored legend the number of accesses made by the users. When you mouse over the countries, a total number of hits is displayed, while doing the same with the legend allows you to see the average number. In addition, the country referring to this value is highlighted on the map. Finally, if the user decides to click on one of the countries, he will be redirected to "Events" >> "Log Analysis" using the nation that was clicked as a filter, creating a more specific report and providing a more accurate view regarding access to these countries.


246 © BLOCKBIT

Figure 393 – Network Traffic – Geolocation Hits.

20.1.1.2 Bandwidth

In "Bandwidth", a performance report is displayed with the priority queues that are applied through the Traffic Shaping of the BLOCKBIT UTM. This feature serves to specialize the network by controlling the maximum speed and amount of speed guaranteed by priority level, and also enabling speed control, allowing you to specify the bandwidth or speed downstream (download) and upstream (upload) of each interface. "High", "Very Low", "Very Low", "Low", "High", "High", "Low".


© BLOCKBIT 247

Figure 394 – Network Traffic – Bandwidth.

20.1.1.3 Total Traffic

In "Total Traffic", a sum of the total traffic consumed is displayed in Terabytes.

Figure 395 – Network Traffic – Total Traffic.


248 © BLOCKBIT

20.1.1.4 Zone Traffic

In "Zone Traffic", you have "progress bars" showing the amount of download and upload in Gigabytes. Through a line chart, you can see these amounts displayed over a period of time. By clicking on the type of network used (e.g. "LAN", "WAN", "WIFI" and etc.), the diagram is changed to display the selected option, which allows you to analyze with more detail the Upload and Download according to the selected dates. On the right side of this chart, a download button [

] is available. Its function is to allow you to download an image of this diagram.

Figure 396 – Network Traffic – Zone Traffic.

20.1.1.5 Top Users

In "Top Users", there is a diagram showing by date when there were higher network traffic and a list displaying the IPs of the top ten users sorted by order of use, in Gigabytes. Again, you can

download an image from this diagram by clicking the download button [ ].


© BLOCKBIT 249

Figure 397 – Network Traffic – Zone Users.


250 © BLOCKBIT

20.1.1.6 Top Services

In "Top Services", there is a diagram showing by date when there were higher network traffic and a list showing the top ten types of the most used services, these being classified in order of use in Gigabytes. Again, you can download an image of this diagram by clicking the download

button [ ].

Figure 398 – Network Traffic – Top Services.


© BLOCKBIT 251

20.1.1.7 Top Source

In "Top Source", there is a diagram showing by date when there were higher network traffic and a list showing the IPs of the top ten sources of network traffic sorted in order of use. Again, you

can download an image of this diagram by clicking the download button [ ]. Finally, in case the user decides to click on one of these IPs, he will be redirected to "Events" >> "Log Analysis" using the item that was clicked as a filter, creating a more specific report that provides a more accurate view regarding access to these sources.

Figure 399 – Network Traffic – Top Sources.


252 © BLOCKBIT

20.1.1.8 Top Destination

In "Top Destination", there is a diagram showing by date when there were higher network traffic and a list showing the IPs of the top ten network traffic destinations classified in order of use.

Again, you can download an image of this diagram by clicking the download button [ ]. Finally, in case the user decides to click on one of these IPs, he will be redirected to "Events" >> "Log Analysis" using the item that was clicked as a filter, creating a more specific report, providing a more accurate view regarding access to those destinations.


© BLOCKBIT 253

Figure 400 – Network Traffic – Top Destination.

20.2 Policy Usage

To access the usage policy reports, click on the "Analysis" icon located on the left side of the screen. A drop downmenu will be displayed. Select "Policy Usage".

Figure 401 – Network Traffic – Policy Usage.

As with Network Traffic reports, the analyzer will only generate the Usage Policy reports when the appropriate devices and dates (check the first four paragraphs of the "Network Traffic" session) are selected. For this reason, a tooltip should appear requiring that a device is selected.

Figure 402 – Tooltip – Select a device.

20.2.1.1 Global Tags

In "Global Tags" you can see all the global tags that have been used in relation to "WIFI", "WEB", "SSL", "ATP", "IPS", "APP", "PRX", "LOG" "LAN" and "NAT". By clicking the icon at the top right of the page, you can save an image of this graphic.


254 © BLOCKBIT

Figure 403 – Policy Usage – Global Tags.

20.2.1.2 Top Policies and History Traffic

In "Top Policies" there are the 10 most commonly used Usage Policies, ordered by use.


© BLOCKBIT 255

Figure 404 – Policy Usage – Top Policies.

You can select one of these policies (it will be highlighted in blue). To the right of "Top Policies", in "Traffic History", a history of network traffic is displayed showing the number of bytes per

time of the selected policy. As always, by clicking the download button [ ], you can download an image of this graphic.

Figure 405 – Policy Usage – History Traffic.


256 © BLOCKBIT

20.2.1.3 Top Users

In "Top Users" there is a list showing who had the highest number of hits, showing the emails of the top ten users ranked in order of highest amount of hits. Again, you can download an image

of this diagram by clicking the download button [ ]. Finally, in case the user decides to click on one of these emails, he will be redirected to "Events" >> "Log Analysis" using the item that was clicked as a filter, creating a more specific report and providing more precise information about the accesses executed by these users.

Figure 406 – Policy Usage – Top Users.

20.2.1.4 Top Source

In "Top Source", there is a list showing the IPs of the top ten sources with the highest network traffic, ranked by the highest amount of hits. Again, you can download an image of this diagram

by clicking the download button [ ]. Finally, in case the user decides to click on one of these IPs, he will be redirected to "Events" >> "Log Analysis" using the item that was clicked as a filter, creating a more specific report and providing a more accurate view regarding access to these sources.


© BLOCKBIT 257

Figure 407 – Policy Usage – Top Source.


In "Top Destination" there is a list showing the IPs of the top ten destinations with the highest network traffic, ranked by the highest amount of hits. Again, you can download an image of this

diagram by clicking the download button [ ]. Finally, in case the user decides to click on one of these IPs, he will be redirected to "Events" >> "Log Analysis" using the item that was clicked as a filter, creating a more specific report and providing a more accurate view regarding access to those destinations.


258 © BLOCKBIT

Figure 408 – Policy Usage – Top Destination.

Next, we will analyze each component of the "Web Filter":

20.3 Web Filter

To access the web filter reports, click on the "Analysis" icon located on the left side, a drop downmenu will be displayed, select the "Web Filter".


© BLOCKBIT 259

Figure 409 – Web Filter.

As with the Network Traffic and Policy Usage reports, the analyzer will only generate the Web Filter reports when the appropriate devices and dates (check the first four paragraphs of the "Network Traffic" session) are selected. Because of this, a tooltip should appear requiring that a device is selected.

20.3.1.1 Traffic and History

The "Traffic" panel demonstrates a total traffic value in Gigabytes. Below, the history is displayed on a bar graph showing the number of Gigabytes trafficked per day.


260 © BLOCKBIT

Figure 410 – Web Filter – Traffic.

20.3.1.2 Sites Allowed and History

The "Allowed Sites" panel displays a total of pages that have had their authorized access because of the policies. Below, history is shown on a bar graph with the number of hits per day.


© BLOCKBIT 261

Figure 411 – Web Filter – Sites Allowed.

20.3.1.3 Sites Denied and History

The "Sites Denied" panel shows a sum of all pages that have been denied access because of the policies. Below, the history is shown in a bar graph with the number of hits per day.


262 © BLOCKBIT

Figure 412 – Web Filter – Denied Sites.

20.3.1.4 Users – Total Traffic and Total Hits

Just below the panels described above, on the left side of the screen, we have the graph set in "Users" which displays information specifically related to the users consumption of the network: In it, we have "Total Traffic" where the total network traffic is displayed in Gigabytes per day, and "Total Hits" that shows the total hits for each of the surveyed days. By clicking on each of these captions, the chart will be automatically modified to illustrate the relevant information.

Finally, by clicking the download icon [ ], you can download an image of this diagram.


© BLOCKBIT 263

Figure 413 – Web Filter – Users – Total Hits.

Figure 414 – Web Filter – Users – Total Hits.


264 © BLOCKBIT

20.3.1.5 Top Users

Just like the other "Top Users" lists, in WebFilter we have an email list of the top ten users ranked by the highest amount of accesses and their respective use in Gigabytes. Again, you can generate

an image by clicking the download button [ ] and when selecting one of the users' emails, you are redirected to "Events" >> "Log Analysis" using the item that was clicked as a filter, allowing a more accurate analysis of the accesses made by these users.

Figure 415 – Web Filter – Top Users.

20.3.1.6 Policies – Total Traffic and Total Hits

In "Policies", we have a graph that displays information specifically related to Network Policies. Its function is to demonstrate when any policy was applied during access. In this area, we have "Total Traffic" which shows the total network traffic in Gigabytes per day, and "Total Hits" that shows the total number of accesses for each of the surveyed days. By clicking on each of these captions, the chart will automatically be modified to illustrate the relevant information. Finally,

by clicking on the download icon [ ], you can download an image of this diagram.


© BLOCKBIT 265

Figure 416 – Web Filter – Policies – Total Traffic.

Figure 417 – Web Filter – Policies – Total Hits.


266 © BLOCKBIT

20.3.1.7 Top Policies

As previously seen in the other "Top Policies" lists, we have a list of the names of the top ten policies sorted by highest number of accesses and their respective use in Gigabytes. Again, you

can download an image by clicking the download button [ ] and when selecting one of the users' emails, you are redirected to "Events" >> "Log Analysis" using the item that was clicked as a filter, allowing a more precise analysis of the accesses where these policies were applied.

Figure 418 – Web Filter – Top Policies.

20.3.1.8 Categories – Total Traffic and Total Hits

In "Categories", we have a graph that displays information specifically related to Network Categories. Its function is to demonstrate when any category was applied in one of the accesses. In this area, we have "Total Traffic" which shows the total network traffic in Gigabytes per day, and "Total Hits" that shows the total number of accesses for each of the surveyed days. By clicking on each of these captions, the chart will automatically be modified to illustrate the

relevant information. Finally, by clicking on the download icon [ ], you can download an image of this diagram.


© BLOCKBIT 267

Figure 419 – Web Filter – Categories – Total Traffic.


268 © BLOCKBIT

Figure 420 – Web Filter – Categories – Total Hits.

20.3.1.9 Top Categories

In the "Top Categories" list, we have a list of the names of the ten categories sorted by order of highest number of accesses and their respective use in Gigabytes. Again, you can download an

image by clicking the download button [ ] and selecting one of the users' emails will redirect you to "Events" >> "Log Analysis" using the item that was clicked as a filter, allowing a more accurate analysis of the accesses in which these categories were applied.


© BLOCKBIT 269

Figure 421 – Web Filter – Top categories.

20.3.1.10 Sites – Total Traffic and Total Hits

In "Sites", we have a graph that displays information specifically related to access to specific sites. Its function is to demonstrate when any site was accessed. In this area, we have "Total Traffic" which shows the total network traffic in Gigabytes per day, and "Total Hits" that shows the total number of accesses for each of the surveyed days. By clicking on each of these captions, the chart will automatically be modified to illustrate the relevant information. Finally, by clicking the

download icon [ ], you can download an image of this diagram.


© BLOCKBIT 271

20.3.1.11 Top Sites

In the "Top Sites" list, we have a list of the URLs of the top ten most accessed sites, sorted by the highest amount of accesses and their respective use in Gigabytes. Again, you can download an

image by clicking the download button [ ] and by selecting one of the users' emails, you are redirected to "Events" >> "Log Analysis" using the item that was clicked as a filter, allowing a more precise analysis of the accesses to these specific sites.

Figure 424 – Web Filter – Top Sites.

20.3.1.12 Content Types – Total Traffic and Total Hits

In "Content-Type", we have a graph whose function is to demonstrate when some type of content has been accessed. In this area, we have "Total Traffic" which shows the total network traffic in Gigabytes per day, and "Total Hits" that shows the total number of accesses for each of the surveyed days. By clicking on each of these captions, the chart will automatically be modified

to illustrate the relevant information. Finally, by clicking on the download icon [ ], you can download an image of this diagram.


272 © BLOCKBIT

Figure 425 – Web Filter – Content Type – Total Traffic.

Figure 426 – Web Filter – Content Type – Total Hits.


© BLOCKBIT 273

20.3.1.13 Top Content Type

In the "Top Content-Type" list, we have a list of the names of the top ten most accessed content types sorted by the highest number of accesses and their respective use in Gigabytes. Again, you

can download an image by clicking the download button [ ] and selecting one of the contents, the redirection is done for "Events" >> "Log Analysis" using the item that was clicked as a filter, allowing more accurate analysis of the accesses to these specific content types.

Figure 427– Top Content Type.

20.4 Application Control

To access Application Control reports, click on the "Analysis" icon located on the left side of the screen. A drop downmenu will be displayed. Select "Application Control".


274 © BLOCKBIT

Figure 428 – Application Control.

As with the previously mentioned reports, the analyzer will only generate Application Control reports when the appropriate devices and dates (check the first four paragraphs of the Network Traffic session) are selected. For this reason, a tooltip should appear requiring that a device is selected.

20.4.1.1 Application Allowed

In "Application Allowed", it is displayed a total of applications that had authorized access.

Figure 429 – Application Control – Application Allowed.

20.4.1.2 Application Denied

In "Application Denied", it shows a sum of the applications that had their accesses denied.


© BLOCKBIT 275

Figure 430 – Application Control – Application Denied.

20.4.1.3 History

On the right side, you can see the "History" graph which displays a history of all the applications that have had their access allowed and denied, having as references to their axes the number of accesses in relation to the previously searched dates.

Figure 431 – Application Control – History.

Label items are interactive and you can change the display of the graph through them so that the graph displays the applications that were allowed and denied by date. You can save the

graphics image by clicking the download icon [ ].

Figure 432 – Application Control – History - Allowed.


276 © BLOCKBIT

Figure 433 – Application Control – History - Denied.

20.4.1.4 Top Categories Allowed

In the "Top Categories Allowed" diagram, we have a visual representation of the 10 most applied allowed categories in user accesses. This session serves to represent, in a pragmatic way, the number of pages accessed that apply to each of these categorizations. The sizes of the rectangles represent the amounts already mentioned, so the larger its area, the more voluminous the number of accesses. By moving the mouse over one of them it is possible to see a total of times a certain category has been applied.

Figure 434 – Application Control – Top Categories Allowed.


© BLOCKBIT 277

Clicking on any of these rectangles allows you to center it and bring it closer to the screen to see it better. If you prefer to go back to the previous view, just click "Return View". As always, just

click on the download button [ ], to download an image of this graphic.

Figure 435 – Application Control – Top Categories Allowed – Zoom.

20.4.1.5 Top Categories Denied

In the "Top Categories Denied" diagram, we have a visual representation of the top 10 most used rejected categories in user accesses. This session serves to represent, in a pragmatic way, the number of pages accessed that fell in each of these refusal categories. The sizes of the rectangles represent the amounts already mentioned, so the larger their areas, the more voluminous the number of accesses. By moving the mouse over one of them it is possible to see a total of times a certain category has been applied.


278 © BLOCKBIT

Figure 436 – Application Control – Top Categories Denied.

Clicking on any of these squares allows you to center it and bring it closer to the screen to see it better. If you prefer to go back to the previous view, just click "Return View". As always, just click

on the download button [ ], to download an image of this graphic.

Figure 437 – Application Control – Top Categories Denied – Zoom.


© BLOCKBIT 279

20.4.1.6 Top Applications Allowed

In "Top Application Allowed" there is a graph representing the top ten applications that had their authorized access in relation to the period of time previously specified. Below this graph, we have a list of the names of these ten applications classified by order of a greater amount of

accesses and their respective categories. Clicking the download button [ ] allows you to download the graphics image, and by selecting one of the application names you are redirected to "Events" >> "Log Analysis" using the item that was clicked as a filter, allowing a more precise analysis of the applications that were allowed to be accessed.

Figure 438 – Application Control – Top Applications Allowed.


280 © BLOCKBIT

20.4.1.7 Top Applications Denied

In the "Top Application Denied" panel we have the exact opposite of the previous session: A graph representing the top ten applications that had their access denied in relation to the period of time previously specified. Below this graph, we have a list of the names of these ten applications sorted by the highest number of accesses and their respective categories. Clicking

the download button [ ] allows you to download an image and selecting one of the application names redirects you to "Events" >> "Log Analysis" using the item that was clicked as a filter, allowing a more precise analysis of the applications that had their accesses denied.

Figure 439 – Application Control – Top Applications Denied.


© BLOCKBIT 281

20.5 Intrusion Prevention

To access the Intrusion Prevention reports, click on the "Analysis" icon located on the left side. A drop downmenu will be displayed. Select the "Intrusion Prevention" option.

Figure 440 – Intrusion Prevention.

As with the previously mentioned reports, it will be necessary to select the appropriate dates and devices (check the first four paragraphs of the "Network Traffic" session in case of doubt). As in the previous panels, a tooltip appears requesting that a device is selected.

20.5.1.1 Alerted, Blocked and History

The Alerted panel displays a total number of intrusion alerts.

In Blocked, a number of total blocked intrusion attempts is displayed.

Below, is a summary of alerts and locks are shown in a line chart with the amount of intrusion-related events within the previously selected time period. By selecting one of the captions ("Alerted" or "Blocked") at the top of the chart, you can determine that only one of these are displayed in the chart.


282 © BLOCKBIT

Figure 441 – Alerted, Blocked and History.

20.5.1.2 Alerts by Geolocation

In "Alerts by Geolocation", you can find the origin of the intrusions by geolocation. The global map shows through a colored caption the number of accesses made by the users. When you mouse over the countries, a total number of alerts is displayed, doing the same with the caption allows you to view an average. In addition, the country related to this value is highlighted on the map. Finally, if the user decides to click on one of the countries, he will be redirected to "Events" >> "Log Analysis" using the nation that was clicked as a filter, creating a more specific report in and providing a more accurate view concerning alerts related to those countries.


© BLOCKBIT 283

Figure 442 – Alerts by Geolocation.

20.5.1.3 Impact - High

In "Impact - High" we have a donut graph showing the percentage of high-impact intrusion threats, followed by a column diagram showing how many of these occurred within the previously selected timeframe compared to the day's network traffic. In addition, a list is displayed with the 10 most recurring high-impact threats, displaying their name and listing them

by the number of recurrences. You can download an image by clicking the download icon [ ] and access "Events" >> "Log Analysis" by clicking on the name of one of these threats in order to use it as a filter for a more specific report, allowing you to be more precise about high-impact threats.


284 © BLOCKBIT

Figure 443 – Impact - High.

20.5.1.4 Impact - Medium

In "Impact - Medium", we have a donut graph showing the percentage of intrusion threats of medium impact, followed by a column diagram showing how many of these occurred within the previously selected timeframe compared to the network traffic of the current day. In addition, a list is displayed with the 10 most recurring medium-impact threats, displaying their names and listing them by the number of recurrences. You can download an image by clicking the download

icon [ ] and access "Events" >> "Log Analysis" by clicking on the name of one of these threats in order to use it as a filter for a more specific report, allowing you to be more precise about the medium-impact threats.


© BLOCKBIT 285

Figure 444 – Impact - Medium.

20.5.1.5 Impact - Low

In "Impact - Low", we have a donut graph showing the percentage of intrusion threats of low impact, followed by a column diagram showing how many of these occurred within the previously selected timeframe compared to the network traffic of the current day. In addition, a list is displayed with the 10 most recurring medium-impact threats, displaying their names and listing them by the number of recurrences. You can download an image by clicking the download

icon [ ] and access "Events" >> "Log Analysis" by clicking on the name of one of these threats in order to use it as a filter for a more specific report, allowing you to be more precise about the low-impact threats.


286 © BLOCKBIT

Figure 445 – Impact - Low.

20.5.1.6 Layer 3 Intrusion Protection

In "Layer 3 Intrusion Protection" we have a donut graph showing the ten most detected categories of intrusion alerts in layer 3 of the IPS (Intrusion Prevention System). By hovering over each part of the graph or its corresponding text, it will highlight it and will display a number with the number of intrusion alerts and their corresponding percentage in relation to the other categories. Just below the graph, we have a list of the ten IPs that more accessed these categories

ordered by the number of hits. You can download an image by clicking the download icon [ ] and access Events >> Log Analysis by clicking on the name of one of these categories or one of the IPs to use them as a filter for a more specific report, allowing you to be more precise about which categories have suffered intrusion alerts or of the IPs that accessed these categories.


288 © BLOCKBIT

20.5.1.7 Intrusion Classification

In "Intrusion Classification", we have a graph representing the ten most recurrent intrusion alert classes over the previously specified time period. By hovering over the graph it will show the date and the number of hits in the highest class of the current day. Below the graph, we have a list of the names of the ten classifications in sorted by the highest amount of hits. Again, you can

download an image by clicking the download button [ ] and selecting one of these classifications redirects you to "Events" >> "Log Analysis" using the item that was clicked as a filter, allowing more accurate analysis of the occurrence of these intrusion alert classes.

Figure 447 – Intrusion Classification.


© BLOCKBIT 289

20.5.1.8 Top Source

"Top Source" displays a line chart representing the ten most recurring intrusion alert sources over the previously specified time period. By hovering over the graph it will show the date and amount of hits to those sources in general. Below, there is a list showing the IPs of the same ten previously mentioned sources, which are classified by the highest amount of hits. Again, you can

download an image from this diagram by clicking the download button [ ]. Finally, in case the user decides to click on one of these IPs, he will be redirected to "Events" >> "Log Analysis" using the item that was clicked as a filter, creating a more specific report and providing a more accurate view regarding access to these sources.

Figure 448 – Top Source.


290 © BLOCKBIT


In "Top Destination", there is a line chart displaying the top ten most recurring intrusion alert destinations in relation to the previously specified time period. By hovering over the graph it will show the date and amount of accesses to those sources. Below, there is a list showing the IPs of the ten destinations with the highest amount of hits. Again, you can download an image from

this diagram by clicking the download button [ ]. Finally, in case the user decides to click on one of these IPs, he will be redirected to "Events" >> "Log Analysis" using the item that was clicked as a filter, creating a more specific report and providing a more accurate view regarding access to those destinations.

Figure 449 – Top Destination.


© BLOCKBIT 291

20.6 Threat Protection

To access the Threat Protection reports, click on the "Analysis" icon located on the left side. A drop downmenu will be displayed. Select the "Threat Protection” option.

Figure 450 – Threat Protection.

As with the previously mentioned reports, it will be necessary to select the appropriate dates and devices (check the first four paragraphs of the "Network Traffic" session in case of doubt). As in the previous panels, a tooltip appears requesting that a device is selected.

20.6.1.1 Threats and History

The Threats panel displays a total of detected threats. Below, there is the history in a line graph showing the number of threats detected per day.


292 © BLOCKBIT

Figure 451 – Threat Protection - Threats.

20.6.1.2 Malwares and History

In "Malware", a number is displayed totaling the amount of detected malware. Below, the history is displayed on a bar graph showing the number of threats detected per day.


© BLOCKBIT 293

Figure 452 – Threat Protection - Malware.

20.6.1.3 Threats by Geolocation

In "Threats by Geolocation", the origin of the threats is displayed by geolocation. The global map shows through a colored caption the risk level. When you mouse over the countries, the total number of threats is displayed. Doing the same with the caption allows you to visualize an average. In addition, the country related to this value is highlighted on the map. Finally, if the user decides to click on one of the countries, he will be redirected to "Events" >> "Log Analysis" using the nation that was clicked as a filter, creating a more specific report and providing a more accurate view regarding threats from those countries.


294 © BLOCKBIT

Figure 453 – Threat Protection – Threat by Geolocation.

20.6.1.4 Impact - High

In "Impact - High", we have a donut graph showing the percentage of high-impact threats followed by a column diagram showing how many of these occurred within the previously selected timeframe compared to the current day 's network traffic. In addition, a list is displayed with the 10 most recurring high-impact threats, displaying their names and listing them by the

number of recurrences. You can download an image by clicking the download icon [ ] and access "Events" >> "Log Analysis". By clicking on the name of one of these threats you can use it as a filter for a more specific report, allowing you to have a more accurate report of the high impact threats.


© BLOCKBIT 295

Figure 454 – Threat Protection – Impact High.

20.6.1.5 Impact - Medium

In "Impact - Medium", we have a donut graph showing the percentage of medium-impact threats followed by a column diagram showing how many of these occurred within the previously selected timeframe compared to the current day 's network traffic. In addition, a list is displayed with the 10 most recurring medium-impact threats, displaying their names and listing them by

the number of recurrences. You can download an image by clicking the download icon [ ] and access "Events" >> "Log Analysis". By clicking on the name of one of these threats you can use it as a filter for a more specific report, allowing you to have a more accurate report of the medium impact threats.


296 © BLOCKBIT

Figure 455 – Threat Protection – Impact Medium.

20.6.1.6 Impact - Low

In "Impact - High", we have a donut graph showing the percentage of low-impact threats followed by a column diagram showing how many of these occurred within the previously selected timeframe compared to the current day 's network traffic. In addition, a list is displayed with the 10 most recurring low-impact threats, displaying their names and listing them by the

number of recurrences. You can download an image by clicking the download icon [ ] and access "Events" >> "Log Analysis". By clicking on the name of one of these threats you can use it as a filter for a more specific report, allowing you to have a more accurate report of the low-impact threats.


© BLOCKBIT 297

Figure 456 – Threat Protection – Impact Low.

20.6.1.7 Malicious IP Classification

In "Malicious IP Classification" we have a donut graph displaying the top ten categories of most detected Malicious IP alerts on the network. By hovering over each part of the graph or its corresponding text, it will highlight it and display a number with the number of accesses to this IP category and its corresponding percentage in relation to other categories. Just below the graph, we have a list of the top ten IPs that most accessed these categories, sorted by the number of hits. You can download an image by clicking the download icon [


298 © BLOCKBIT

] and access Events >> Log Analysis by clicking the name of one of these categories or one of the IPs to use them as a filter for a more specific report, allowing you to create a more precise report on the categories that have seen intrusion alerts or the IPs that accessed these categories.

Figure 457 – Threat Protection – Malicious IP Classification.

20.6.1.8 Top Threat Types

In "Top Threat Types" a bar graph representing the most recurring types of threats is displayed in relation to the number of times they were detected. By hovering over the graph, it will show

the exact amount of detections. By clicking the download button [ ], you can download an image of this graphic.


© BLOCKBIT 299

Figure 458 – Threat Protection – Top Threat Types.

20.6.1.9 Top Users by Threats

In "Top Users by Threats", we have a line chart displaying the number of threats per day. By hovering over each part of the graph, it will highlight it and display a number with the number of threats of the selected day. Just below the graph, we have a list of the top ten users who were most affected by these threats, ranked by the number of hits. You can generate an image by

clicking download [ ] and access "Events" >> "Log Analysis" by clicking on the name of one of these users (or the IP, if the user has not been named), which will be used as a filter for a more specific report, allowing you to create a report with greater precision regarding the user in question.


300 © BLOCKBIT

Figure 459 – Threat Protection – Top Users by Threats.

20.6.1.10 Top Users by Malware

In "Top Users by Malware" we have a line graph displaying the number of malware alerts per day. Hovering over each part of the graph will highlight it and display a number of the number of threats of the selected day. Just below the chart, we have a list of the top ten most affected by malware users sorted by the number of detections. You can generate an image by clicking

download [ ] and by clicking on the name of one of these users (or the IP if the user has not been named), it is possible to access "Events" >> "Log Analysis" using the name as a filter to generate a more specific report, allowing you to have more precision regarding the user in question.


© BLOCKBIT 301

Figure 460 – Threat Protection – Top Users by Threats.

20.6.1.11 Top Malware

In "Top Malware", we have a line graph showing the amount of malware detected per day. Hovering over each part of the graph will highlight it and display a number with the number of detections on the selected day. Just below the chart, we have a list of the top ten most recurring malware, sorted by the number of probes. You can download an image by clicking the download

icon [ ] and clicking on the name of one of these malware allows you to access "Events" >> "Log Analysis" using the name as a filter for a more specific report, providing more precision regarding the malware in question.


© BLOCKBIT 303

20.6.1.12 Top Infected Sites

Under "Top Infected Sites", we have a line chart displaying the number of infected sites detected per day. Hovering over each part of the graph will highlight it and display a number with the number of detections on the selected day. Just below the chart, we have a list of the top ten most recurring sites sorted by the number of detections. You can download an image by clicking

the download icon [ ] and clicking on the address of one of these sites you can access "Events" >> "Log Analysis" using the address as a filter for a more specific report, providing more accuracy for the site in question.

Figure 462 – Threat Protection – Top Infected Sites.


304 © BLOCKBIT

20.6.1.13 Top Source

In "Top Source", a line graph representing the top ten most recurring threat sources is displayed relative to the previously specified time period. Hovering over the graph will show the date and amount of accesses to those sources. Below, there is a list showing the IPs of the same ten previously mentioned sources, which are ranked by the highest amount of hits. Again, you can

download an image from this diagram by clicking the download button [ ]. Finally, in case the user decides to click on one of these IPs, he will be redirected to "Events" >> "Log Analysis" using the item that was clicked as a filter, creating a more specific report and providing a more accurate view regarding access to these sources.

Figure 463 – Threat Protection – Top Source.


© BLOCKBIT 305


In "Top Source", a line graph representing the top ten most recurring threat destinations is displayed relative to the previously specified time period. Hovering over the graph will show the date and amount of accesses to those destinations. Below, there is a list showing the IPs of the same ten previously mentioned destinations, which are ranked by the highest amount of hits.

Again, you can download an image from this diagram by clicking the download button [ ]. Finally, in case the user decides to click on one of these IPs, he will be redirected to "Events" >> "Log Analysis" using the item that was clicked as a filter, creating a more specific report and providing a more accurate view regarding access to these destinations.

Figure 464 – Threat Protection – Top Destination.


306 © BLOCKBIT

20.7 User Behavior

To access the reports available under "User Behavior", click on the "Analysis" icon located on the left side. A drop downmenu will be displayed. Select the "User Behavior" option.

Figure 465 – User Behavior.

In the three checkboxes located at the top of the screen, you will need to select the desired device, then the user you want to analyze (you can type a specific name in the search bar at the top of the checkbox) and lastly, determine a date. After selecting these three options, the reports will be generated.

Exactly next to the title of this "User Behavior" window, the name (or IP) of the user that was selected will be displayed.


© BLOCKBIT 307

Figure 466 – User Behavior.

The "User Behavior" report is a summary of a device user's behavior within a specific time period. The reports are a summary of the information already mentioned but are specifically applied to this user.

Next, we will analyze each of these reports in detail.

20.7.1.1 History Traffic

In "Traffic History", a vertical bar graph is displayed demonstrating the traffic consumption in Kilobytes in relation to the preselected days. The arrow in the middle of the graph represents the average user consumption. Hovering over one of the graph columns displays the exact amount of traffic in Kilobytes for each day.


308 © BLOCKBIT

20.7.1.2 Geolocation Information

In Hits by Geolocation, the destination of that user's specific connections is displayed. The global map shows through a colored caption the number of hits made by users for each country. When you mouse over the countries, a total number of hits is displayed, while doing the same with the caption displays the average. In addition, the country referring to this value is highlighted on the map. Finally, if the user decides to click on one of the countries, he will be redirected to "Events" >> "Log Analysis" using the nation that was clicked as a filter, creating a more specific report and providing a more accurate view regarding access to these countries.

20.7.1.3 Analysis Panel

In the "Analysis Panel", we have a summary of various information cited in the previously analyzed reports, but this time, they are specifically applied to the user in question.

20.7.1.4 Network Traffic

Below "Network Traffic" we have:

"Total Traffic", displaying the total traffic of the user in Kilobytes. In "Top Services", a list with

the 10 services most used by the user in question is displayed. "Top source" demonstrates the

user's greatest sources of access and "Top Destination" shows a list of IPs of the destinations

most accessed by the user.

20.7.1.5 Policy Usage

In Policy Usage we have:

“Policy Tags” which demonstrates which policy tags have been most applied to this user, and under "Top Policies" we have the policies most applied to that particular user.


© BLOCKBIT 309

20.7.1.6 Application Usage

In "Application Usage" we have:

"Total Applications" mentions the total number of applications used by the user, and "Total Application" serves to demonstrate the applications most used by the user and the number of accesses made to them.

20.7.1.7 Web Usage

In "Web Usage" we have:

"Total Traffic" showing a total of the user's network traffic, "Sites Allowed" showing the total number of accesses to allowed sites made by the user, "Denied Sites" showing total access to rejected sites, "Top Categories" with a list of user accesses by category and finally, in "Top destination", a list of user accesses by destination displaying the IP and amount of accesses to that same destination.

20.7.1.8 Threat Protection

In "Web Usage" we have:

"Total Traffic" showing a total of the user's network traffic, "Sites Allowed" showing the total number of accesses to allowed sites made by the user, "Denied Sites" showing total access to rejected sites, "Top Categories" with a list of user accesses by category and finally, in "Top destination", a list of user accesses by destination displaying the IP and amount of accesses to that same destination.

20.7.1.9 Intrusion Prevention

In "Intrusion Prevention" we have:

"Total Alerts" showing total alerts for this user, "Impacts" showing the levels of impact of the previously mentioned alerts, "Intrusion Protection" displaying a donut graph where you can see the types of invasions detected by the system and finally, in "Top Alerts" we have a list of the 5 alerts regarding this user and how many times they occurred.


310 © BLOCKBIT

20.8 Reports

To access and manage automatic report creation, click on the "Reports" icon located on the left side:

Figure 467 – Reports.

The reports screen will be displayed. This list is divided into six columns: Name, Scheduled, Owner, Period, Status and Actions. In addition, there are two search buttons and an action menu button. In the action menu, there are 4 options: "Add Report", "Delete Report", "Select All" and "Deselect All".

Figure 468 – Reports – Actions Menu.

Below we will analyze the function of each column:

• Name: Displays the name of the report that can be registered in the action menu. Just below the name is the description registered in the same menu;

• Scheduled: Displays the schedule for when the report will run, just below that date is the date when this process was created;

• Owner: The name of the user responsible for creating this schedule;


© BLOCKBIT 311

• Period: It is where the period of when data will be extracted from the system is recorded;

• Status: The current state of report output is displayed. It is also possible to view it or download it in PDF format after the report has been generated. Eg Pending;

• Actions: Buttons with key functions for interacting with reports:

o View button [ ]: View and edit the selected report;

o Delete button [ ]: Deletes the selected report;

o Selection box [ ]: Selects reports.

At the top right of the screen, we have the contextual buttons:

• Results display [ ]: Allows you to determine how many results are displayed per page. The possibilities are: 10, 20, 30, 40, 50, 100, 500;

• Search [ ]: By clicking this button a small search box will appear where it is possible to type tags and perform a search based on these Keywords. If you click on the Cancel

button [ ], all tags will be removed from the search box, and by clicking outside the

same panel will stop displaying it. To perform a search, click search [ ];

• Action Menu [ ]: By clicking this button, the analyze menu below is displayed:

Figure 469 – Reports – Action Menu.

We will now analyze the function of each option in this menu.

20.8.1.1 Add Report


312 © BLOCKBIT

To create an automatic report click on "Add Report". The following screen will be displayed, with the "Settings" side tab preselected:

Figure 470 – Reports – Add Report - Settings.

We will now analyze each field in this panel:

• Name: Report name. E.g.: Store 1 report;

• Description: Report description. E.g.: Network traffic analysis on Store 1;

• Type: This drop downmenu determines the options that will be available in the "Datasets" tab. We have the following options:

o Analysis: Allows you to create the following reports in the Datasets tab: ▪ Network Traffic; ▪ Policy Usage; ▪ Web Filter;


© BLOCKBIT 313

▪ Application Control; ▪ Intrusion Prevention; ▪ Threat Protection; ▪ User Behavior.

o Top Hits: It generates a report of Top Hits, being that in the Datasets tab it is determined the number of hits to be showed and the filters to be used;

o Top Bytes: It generates a report of Top Bytes, being that in the Datasets tab it is determined the number of bytes to be showed and the filters to be used;

o Log: Allows you to create custom reports. In Datasets, it is possible to use Custom Queries and determine the filters to be used.

• Schedule: Displays the scheduled date for when this report will run;

• Period: Determines the time period when the data will be analyzed by the logger in the UTMs. Ex.: When selecting from September 1, 2018, to October 24, 2018, all data that exists outside this period will not be displayed in the "Report";

• Devices: The device from which the data is analyzed to generate the report is selected.

The "Datasets" tab determines the type of chart that will be generated. As previously mentioned, its components are determined by the "Type" selection box of the "Settings" tab.


314 © BLOCKBIT

Figure 471 – Reports – Add Report - Datasets.

In the "Custom" tab it is possible to determine the text that will be in the "Footer" and customize the "Logo" that will appear in the report.


© BLOCKBIT 315

Figure 472 – Reports – Add Report - Custom.

By clicking Save [ ] the report will be scheduled. If you want to issue it immediately configure it to run on today's date.

20.8.1.2 Delete Report

When you click on "Delete Report", the selected reports will be removed (if any report is not selected, an error message will appear telling you that).


316 © BLOCKBIT

20.8.1.3 Select All and Deselect All

By clicking "Select All" all reports will be selected.

Figure 473 – Reports – Select All.

By clicking "Deselect All" all selected reports will have their selection removed.

20.9 Events

To access the events screen, click on the "Events" icon located on the left side:

Figure 474 – Events.

Once you have access to "Events", a checkbox is displayed in the center of the screen. To view the Events you need to select the desired device in this selection panel. After selecting the desired option, click on "Search".

The function of the tools displayed in "Events" is to allow a more detailed in-depth analysis and to show all the events occurred in the selected device.


© BLOCKBIT 317

20.9.1.1 Top Hits

In "Top Hits" we have a set of options. When selecting one of them, a graphic is displayed detailing the selected option and displaying the 5 bigger items divided by the amount of accesses related to the selected option. The options are:

Table 2 – Top Hits Selection Box Options in Events.

Selection Detailing

app_category Most used application categories.

app_name Most Used application Names.

client_ip IPs of customers with the highest number of accesses.

client_user Users with the highest number of accesses.

client_mac MAC address with the highest number of accesses.

dport A number of the most active destination ports and the amount of access to each of them.

dst Destination port with the highest number of accesses.

devin Input Device with the highest number of accesses.

devout Device with the highest number of accesses.

geoip_dst GeoIP destinations with the highest number of accesses.

geoip_src The origins of GeoIP with the greatest number of accesses.

logtype Most generated log types according to the highest number of accesses.

malware_file Type of malware files most detected according to the highest number of accesses.

malware_name Name of most detected malware according to the highest number of accesses.

malware_md5 MD5 of the most detected malware according to the highest number of accesses.


318 © BLOCKBIT

malware_status The most detected malware statuses according to the highest number of accesses.

protocol The protocols with the greatest number of accesses.

rule_name The name of the rules with the greatest number of accesses.

service The services with the greatest number of accesses.

sport The source port with the highest number of accesses.

src The source IPs with the highest number of accesses.

threat_impact The impact of threats according to the highest number of accesses.

threat_sid The SID with the highest number of accesses.

threat_dump The threats dump with the greatest number of hits.

threat_name The name of the threats with the highest number of accesses.

threat_classification The classification of the threats with the highest number of accesses.

threat_category The threat categories with the highest number of accesses.

web_category Web categories with the highest number of hits.

web_mime The MIME-Types with the highest number of accesses.

web_browser Browsers with the highest number of accesses.

web_site The sites with the highest number of accesses.

web_method The HTTP methods with the highest number of accesses.

zonein The entry zones with the highest number of accesses.

zoneout The exit zones with the highest number of accesses.


© BLOCKBIT 319

20.9.1.2 History

In "history" we have a graph of vertical columns showing the history of accesses by time. The line crossing the middle of the graph shows the accesses average. Above the columns, we have a balloon showing the value of greater access and the smaller one. Hovering over the graph shows the exact value of the accesses represented by the selected column. By clicking the

download button [ ] you can download an image of this graphic.

20.9.1.3 Log Events

Finally, in "Log Events" we have a record of all the events detected on the selected device.

Figure 475 – Events – Log Events.

This panel consists of a label with the event type and 4 columns:

• Date: The exact date and time for this event;

• Source: The source of this event, an IP address;

• Destination: The destination of this event, another IP address;

• Service: The service attached to this event.

Next, to the event type marker, we have an arrow icon [ ] which when selected will expand the selection and display more information about that particular event.


320 © BLOCKBIT

Figure 476 – Events – Log Events – Expanded.

20.10 Loggers

To access the event screen, click on the "Loggers" icon located on the left side:

Figure 477 – Loggers.

The function of these panels is to register the loggers that will be used to capture information from the BLOCKBIT UTM and create reports on the GSM BLOCKBIT.

20.10.1.1 Logger Setup

This section will introduce the step-by-step installation of a logger on the GSM BLOCKBIT.


© BLOCKBIT 321

We will demonstrate the installation using the VMware vSphere Client software as an example. Procedures already performed in the step-by-step procedures quoted in chapter 4 INSTALLATION – BLOCKBIT GSM will not be redone. In case of doubt, check the appropriate session (page 32).

To install the logger on BLOCKBIT GSM follow the guidelines below

First, start VMware and browse its directory structure to the desired virtual machine, as exemplified below:

Figure 478 – Logger Setup – Virtual Machine.

In order to have disk storage space for the Logger installation, we will insert an HD into the virtual interface. Right-click on the desired machine and select the "Edit Settings ..." option as shown by the image below:

Figure 479 – Virtual Machine – Edit Settings.


322 © BLOCKBIT

A screen displaying the hardware settings of your virtual machine will be displayed, as shown by the image below:

Figure 480 – Virtual Machine – Add.

Click on the "Add ..." button located at the top of the screen, on the right side of the "Show All Devices" checkbox.

A screen requesting the desired device type will appear:


© BLOCKBIT 323

Figure 481 – Virtual Machine – Device Type.

Select the "Hard Disk" option by clicking on the icon in the listing in the middle ad screen. Once you do this, click on the "Next" button to proceed to the next step. As shown by the image below, in the next window you will be asked what kind of disk to create:


324 © BLOCKBIT

Figure 482 – Virtual Machine – Select Disk.

Select "Create a new virtual disk" if this option is not previously selected. Click on the "Next" button.


© BLOCKBIT 325

Figure 483 – Virtual Machine – Create a Disk.

In this new window, set the desired disk size in "Disk Size" and select the "Thin Provision" option in "Disk Provision". After that, click "Next", ignore the options that will appear in the "Advanced Options" window and click "Next".


© BLOCKBIT 327

Figure 485 – Virtual Machine – Ready to Complete.

If all the settings are according to intended, click "Finish", otherwise click "Cancel" to cancel the process.


328 © BLOCKBIT

Figure 486 – Virtual Machine – Adding virtual Disk. The machine will begin the process of adding the disk, click "OK" to exit this screen. If the virtual machine is not connected, right click on it and select the option "Power" and "Power On". The selection of this can be seen in the image below:

Figure 487 – Virtual Machine – Power On.


© BLOCKBIT 329

After this step, when the machine finishes being connected click on the "Console" tab (that can be seen in the image below) or access the IP of the machine through SSH.

Figure 488 – Virtual Machine – Console Tab.

After logging in, enter the CLI command "logger-config" to start the logger installation wizard (for more information, see page 359). As an example, this guide will perform the installation of an integrated logger, as shown in the image below:

Standalone

In this mode of operation, the server is exclusively for remote logging, its not possible to use it for any other function, thus making it necessary to use the BLOCKBIT firmware.

Integrated

In this mode of operation it is possible to use the local GSM itself where the manager is installed as a logger server. However, it is necessary to devote an entire disk only for this function, regardless of whether it is virtual or physical.

As an example, this guide will perform the installation of an integrated logger, as can be seen in the image below:

Figure 489 – Logger – logger-config.


330 © BLOCKBIT

After selecting the "integrated" option, the system will recognize all the disks installed in the machine (physical or virtual) and will request that one of them is selected for the installation of the logger. However, it is important to note that the entire disk will be used for that, thus any data stored in it will be removed during installation. This is shown in the image below:

Figure 490 – Logger – Entire device, not just one partition.

To continue, you need to confirm by typing "y" and pressing "enter". Once this is done, the wizard will begin to create the logger, as shown by the image below:

Figure 491 – Logger – Criando Logger.

After these steps, the system will ask if you want the secret key to be generated. It is recommended to confirm with "y", copy this information and store it in a safe place. The only way to recover this key is to use the "logger-key" command in the CLI (for more information see page 364). The image below demonstrates the process of creating a secret key:

Figure 492 – Logger – Secret Key.

After this step, as shown by the wizard's own message, the Logger is already installed in GSM.


© BLOCKBIT 331

Figure 493 – Logger – Completed.

The step using the CLI was successfully completed. The next step will be in the GSM administrative interface, so you need to login via the browser.

Figure 494 – GSM – Login.

To access the Analyzer, click on the applications icon [ ] on the top of BLOCKBIT GSM and select "Analyzer".

Figure 495 – GSM – Analyzer.

Select the "Loggers" button in the vertical menu on the left.


332 © BLOCKBIT

Figure 496 – Loggers.

Add a logger by clicking the add button [ ]. The following screen will be displayed:

Figure 497 – Loggers – Create Logger Device.

Complete the fields by default (for more information see the page 337):

Figure 498 – Loggers – Create Logger Device – Completed fields.


© BLOCKBIT 333

In "Devices & Devices Group" it is important to select in which devices the logger will generate reports (In our example, we chose the "Stores" group).

After that step, click on the save button [ ].

Logger successfully installed.

The next step is to connect the Logger to the device. To do so, access the applications icon [ ] on the top of the GSM BLOCKBIT and select "Manager".

Figure 499 – GSM – Analyzer.

In this example, the Logger will be applied to Store 1, 2, and 3 UTMs.

Figure 500 – GSM – Stores.

Select the desired UTM and click on the edit button [ ]. The following screen will be displayed:


334 © BLOCKBIT

Figure 501 – GSM – Edit Device.

Select the appropriate logger and click on the save button [ ] to confirm the editing.

Repeat this procedure for all devices that will use the same logger.

After you complete this process, click on the Access Web Interface icon [ ] to access the desired UTM.

If necessary, make the login.

Go to "System" and click on the "Administration" option as exemplified by the image below:


© BLOCKBIT 335

Figure 502 – UTM – System - Administration.

Access the “Central Management” tab:

Figure 503 – UTM – Central Management.

Click on the "Enable Analyzer" checkbox. In "Analyzer Address", type the GSM IP (or the Analyzer IP if it is a Standalone), and in "Logger Service" type the logger service. Once this is done, click on the save icon

[ ] and access the tasks queue by clicking the Saved Settings Queue icon [ ] and apply the settings. If everything happens correctly, the "Status" (on the right side of "Analyzer Address") will change to "Online".


336 © BLOCKBIT

Returning to GSM, access again the application's icon [ ]at the top of the screen, click on "Analyzer" again, in the vertical menu on the left select "Loggers". It is now possible to see the Logger acting normally, as shown below.

Figure 504 – Logger Devices.

Logger successfully connected to devices.

In the following, we will thoroughly analyze each component of the "Loggers" panel.

20.10.1.2 Actions Menu

By clicking the actions menu button [ ] at the top of this box you can edit the logger or remove it.

Figure 505 – Loggers – Loggers Action Menu.


© BLOCKBIT 337

At the top of the logger screen, next to the previously mentioned button, it is possible to search if the user has several different loggers.

Figure 506 – Loggers – Search Box.

20.10.1.3 Create Logger Device

To register a logger, click on the Add button [ ] in the upper right corner of the screen. The following form will be displayed:

Figure 507 – Loggers – Create Logger Device.

Under "Create Logger Device", fill the form according to the following instructions:


338 © BLOCKBIT

• Name: Determines the name of the Logger be registered. E.g.: Logger 1;

• Address: Determines the IP address in order to access this logger. E.g.: 10.0.0.1;

• Devices & Devices Group: It is a checkbox that allows the location of the devices or

device groups that the logger will use to create reports. Click [ ] to add or [ ] to

remove them;

• Secret Key: Determines the secret key issued by the UTM. It needs to be pasted completely for the Logger to work;

• Description: The description of the logger, basically for organizational purposes.

To finish creating the logger, click Save [ ]. If you want to cancel the process, click Cancel

[ ].

20.10.1.4 Loggers Performance

After creating the Logger, a box with more information should appear in the initial screen of the "Loggers" function. There will be a graph displayed, representing the CPU, memory and disk usage, their consumption percentages and the total capacity of each one (described in the amount of processing cores and Gigabytes). Next, to the name of the logger at the top of this box, you can see an icon representing the state of the logger.


340 © BLOCKBIT

21 INTERFACE BLOCKBIT GSM CLI – COMMAND LINE

The BLOCKBIT GSM provides a Command Line Interface (CLI) console feature that enables the administrator to execute administration and troubleshooting commands for the main system services.

To run the configuration you need an SSH client and console. The recommended minimum applications are:

• PUTTY; or

• Cygwin; or

• Mobaxterm.

Here's how to access the BLOCKBIT GSM CLI console, step by step:

1. Verify that the access device has a recommended SSH client already installed. Let's exemplify the process using the "PUTTY" application;

2. Access the SSH console. Fill in the fields:

• Host Name (or IP Address): Enter the IP address of the GSM BLOCKBIT. E.g.: 172.16.102.235;

• Click "Open".

Figure 509 – PuTTY Configuration.


© BLOCKBIT 341

3. The console will be displayed prompting for user and password;

The image below shows the commands of the main system services.

Figure 510 – BLOCKBIT GSM – Command Line Interface.

Next, we will present each command.

21.1 [arp]

Used to map the network address (for example, an IPv4 address) to a physical address (also called a MAC address), such as an Ethernet address. Displays and modifies the Internet Address to Ethernet addresses relations table. ARP has been implemented with many combinations of network technologies and the data link layer. IPv4 is the most common case.

Use this command to identify a network communication problem or to identify connected IP events and statuses.

How to use:

In "login as:" Enter the admin user and press "Enter".

After “password:” enter the admin password and press “Enter”.


342 © BLOCKBIT

Figure 511 – Command Line Interface – arp.

Example: Display the table of IP addresses and physical hosts (devices) addresses on the network:

Figure 512 – Command Line Interface – arp – Example.


© BLOCKBIT 343

21.2 [arping]

Used to discover and identify connected hosts using ARP table associated with the analog response to ping using the ICMP protocol.

How to use:

Figure 513 – Command Line Interface – arping.

Example: Find out the MAC address of a given IP:

Figure 514 – Command Line Interface – arping - Example.

21.3 [date]

Used to list and change the current date and time.

How to use:


344 © BLOCKBIT

Figure 515 – Command Line Interface – date.

Example 1: List the current date and time:

Figure 516 – Command Line Interface – date – Example 1.

Example 2: Update date and time based on America / São Paulo time zone:

Figure 517 – Command Line Interface – date – Example 2.


© BLOCKBIT 345

21.4 [debug-deployer]

Used to monitor deployer settings and package installation on devices.

How to use:

Figure 518 – Command Line Interface – debug-deployer.

21.5 [debug-sync]

Used to monitor the communication between the BLOCKBIT GSM and devices. Displays updates and device status.

How to use:

Figure 519 – Command Line Interface – debug-sync.

21.6 [enable-root]

Enable root access to the system, it will be necessary to enter the password compatible with the key that will appear on the screen.

How to use:


346 © BLOCKBIT

Figure 520 – Command Line Interface – enable-root.

21.7 [ethtool]

Used to display and detail information regarding network interfaces, check online and offline interfaces, change speed, change negotiation form and verify which interface is physically located.

How to use:

Figure 521 – Command Line Interface – ethtool.

Example: Identify a specific network interface:


© BLOCKBIT 347

Figure 522 – Command Line Interface – ethtool - Example.

21.8 [exit]

Used to exit the session.

How to use:

Figure 523 – Command Line Interface – exit.

21.9 [fdisk]

Used for managing hard disk partitions. You can list and identify HDD-SSD storage devices, create physical partitions, logical partitions, delete, display information, and so on.

How to use:


© BLOCKBIT 349

Figure 525 – Command Line Interface – fdisk – Example.

21.10 [free]

Used to check memory size and usage on the server.

How to use:


350 © BLOCKBIT

Figure 526 – Command Line Interface – free.

Example: Check memory consumption:

Figure 527 – Command Line Interface – free – Example.

21.11 [fsck]

Used to check and correct errors on disks and file systems.

How to use:


© BLOCKBIT 351

Figure 528 – Command Line Interface – fsck.

Example: Check for possible errors on a particular partition:

Figure 529 – Command Line Interface – fsck - Example.

21.12 [help]

Used to display a list of all commands available in the interface.

How to use:


352 © BLOCKBIT

Figure 530 – Command Line Interface – help.

21.13 [history]

When using this command, a history of all recently used commands is displayed.

How to use:

Figure 531 – Command Line Interface – history.


© BLOCKBIT 353

21.14 [Hostname]

Used to view or change the hostname of your BLOCKBIT UTM device.

How to use:

Figure 532 – Command Line Interface – hostname.

Example: Use the command to display the current name of your BLOCKBIT UTM device:

Figure 533 – Command Line Interface – hostname - Example.


354 © BLOCKBIT

21.15 [ifconfig]

Used to configure and manage interface settings. You can enable, disable, and list the status of each of the interfaces. Can also be used to optimize the system configuration.

How to use:

Figure 534 – Command Line Interface – ifconfig.

Example: View information about all network interfaces, active and disabled:


© BLOCKBIT 355

Figure 535 – Command Line Interface – ifconfig - Example.

21.16 [ifstat]

Used to view network traffic statistics.

How to use:


356 © BLOCKBIT

Figure 536 – Command Line Interface – ifstat.

Example: List overall traffic statistics of all network interfaces:

Figure 537 – Command Line Interface – ifstat - Example.

21.17 [iotest]

Used to perform an input / output (I / O) write test on the "file system" partition structure of the BLOCKBIT UTM disk.

How to use:


© BLOCKBIT 357

Figure 538 – Command Line Interface – iotest - Example.

21.18 [ip]

Through this command, you can perform the display, manipulation, and routing of devices, interfaces and network tunnels.

How to use:

Figure 539 – Command Line Interface – ip.

21.19 [ipcalc]

Used for IPv4 and IPv6 network mask/subnet mask calculation. It has options to identify the prefix (mask), the network address and the broadcast address.

How to use:


358 © BLOCKBIT

Figure 540 – Command Line Interface – ipcalc.

Example: Calculate a subnet, its network, and broadcast addresses:

Figure 541 – Command Line Interface – ipcalc – Example.

21.20 [less]

Used to paginate files or standard inputs. It is possible to direct the output of another command using the pipe "|".

How to use: Use the less command as output from another command that returns a very extensive amount of information.


© BLOCKBIT 359

Figure 542 – Command Line Interface – less.

21.21 [logger-config]

This command enables a Configuration Wizard for the installation of a logger server. There are two operation modes available: Standalone or Integrated, the difference between these being:

Standalone

In this operation mode, the server is used exclusively for remote logging, it cannot be used for any other function. It is mandatory to use the BLOCKBIT firmware.

Integrated

This operation mode allows you to use the local GSM itself where the manager is installed as a logger server. However, it is necessary to devote an entire disk only to this function, regardless of whether it is virtual or physical.

How to use:

Example 1: For the installation of a standalone logger it is necessary to choose this mode of operation when requested in "Enter the logger operating mode", next we will analyze each of the options that appear in the wizard:


360 © BLOCKBIT

Figure 543 – Command Line Interface – logger-config – Example 1.

• Interface: GSM interface type. E.g.: eth0;

• IP address: GSM IP address. E.g.: 172.31.102.236;

• Mask: GSM network mask. E.g.: 255.255.0.0;

• Gateway: Determines the GSM gateway. E.g.:172.31.0.1;

• DNS: Determines the GSM DNS. E.g.:172.16.102.148;

• Timezone: Determines the time zone with which GSM has been configured. E.g.: America

/ Sao_Paulo;

• Timezone: Determines the time zone with which GSM has been configured. E.g.: America

/ Sao_Paulo;

• Generate Key: To generate the secret key, type "y" and press "enter". It is important to

save this sequence because it will be used during the creation of the Logger in the GSM

Analyzer visual interface (page 340).

At the end of the wizard you should see results similar to those shown by the image below:


© BLOCKBIT 361

Figure 544 – Command Line Interface – logger-config – Standalone.

Example 2: For the installation of an integrated logger it is necessary to opt for this mode of operation when requested in "Enter the logger operating mode". Next, we will analyze each of the options that appear in the wizard:

Figure 545 – Command Line Interface – logger-config – Example 2.

• Disk: Determines the disk in which the logger will be installed. You will see a summary of

the disks that make up the appliance, and their status (for example, "Available"

represents an available disk and "System" a disk used by the system). You must enter the

directory of the disk that will be used. After this step, a message warning that the entire

disk will be used and not just a partition will appear, to proceed, type "y" and press

"enter". Ex: / dev / sdb;

• Generate Key: To generate the secret key, type "y" and press "enter". It is important to


362 © BLOCKBIT

save this sequence because it will be used during the creation of the Logger in the GSM

Analyzer visual interface (page 340).

At the end of the wizard you should see results similar to those shown by the image below:

Figure 546 – Command Line Interface – logger-config – Integrated.

21.22 [logger-devices-add]

Used to add devices to the logger, it is necessary to pass the device path in order to execute the addition.

How to use:

Figure 547 – Command Line Interface – logger-devices-add.


© BLOCKBIT 363

21.23 [logger-devices-list]

This command is used to display a list of devices used by the logger.

How to use:

Figure 548 – Command Line Interface – logger-devices-list.

21.24 [logger-disable]

Command to disable the logger in the pool.

How to use:

Figure 549 – Command Line Interface – logger-disable.

21.25 [logger-enable]

Command to enable the logger in the pool.

How to use:

Figure 550 – Command Line Interface – logger-enable.


364 © BLOCKBIT

21.26 [logger-key]

Used to display the secret key of the logger, it is used during the creation of the Logger in the GSM Analyzer visual interface (page 337). When passing the parameter "-c" the command generates keys.

How to use:


21.27 [lscpu]

Used to display information about the CPU architecture.

How to use:

Figure 552 – Command Line Interface – lscpu.


© BLOCKBIT 365

21.28 [mkfs]

Used to perform formatting. You will need to determine which device will be formatted. Ex: mkfs -t ext4 / dev / sdb;

How to use:

Figure 553 – Command Line Interface – mkfs.

21.29 [more]

Used to paginate files or standard inputs. It is possible to direct the output of another command using the pipe "|".

How to use: Use the “more” command as output from another command that returns a very extensive amount of information.


366 © BLOCKBIT

Figure 554 – Command Line Interface – more.

Example: Routing test for a specific destination.

21.30 [netstat]

Used to display listening ports on the server.

How to use:


© BLOCKBIT 367

Figure 555 – Command Line Interface – netstat.

21.31 [ntpdate]

Used to set your device's date and local time by querying network NTP (Network Time Protocol) servers available on the network.

How to use:

Figure 556 – Command Line Interface – ntpdate.

Example: Update the date and time with public NTP servers:

Figure 557 – Command Line Interface – ntpdate – Example.

21.32 [passwd]

Used to set or change the default admin password for the user.


368 © BLOCKBIT

How to use:

Figure 558 – Command Line Interface – passwd.

21.33 [ping]

Used to test connectivity between devices on the network. Uses the ICMP protocol datagram.

How to use:

Figure 559 – Command Line Interface – ping.

21.34 [reboot]

Used to reboot the system.

How to use: [Standard command output]:


© BLOCKBIT 369

Figure 560 – Command Line Interface – reboot.

21.35 [reset]

Used to reset the system.

How to use:

Figure 561 – Command Line Interface – reset.

21.36 [reset-admin-blocks]

Used to release blocked sessions for the WEB interface "admin" user.


Figure 562 – Command Line Interface – reset-admin-blocks – Example.

21.37 [reset-admin-password]

Used to apply a reset of the WEB interface "admin" user password. Automatically prompted to create a new password.



370 © BLOCKBIT

Figure 563 – Command Line Interface – reset-admin-password.

21.38 [reset-admin-sessions]

Used to remove "Active" sessions from the WEB interface admin user.


Figure 564 – Command Line Interface – reset-admin-sessions.

21.39 [reset-logs]

Delete all logs from the analyzer.

How to use:



© BLOCKBIT 371

21.40 [rewizard]

Used to apply a reset in the BLOCKBIT GSM device settings. This command should only be used in cases of real need for total system reconfiguration.


Figure 566 – Command Line Interface – rewizard.

21.41 [route]

Utilizado para exibir e manipular a tabela de roteamento de endereços IP.

How to use:

Figure 567 – Command Line Interface – route.


372 © BLOCKBIT

Example 1.: [Standard command output]:

Figure 568 – Command Line Interface – route – Example 1.

Example 2: Configuring static routing for an extended network:

Figure 569 – Command Line Interface – route – Example 2.

21.42 [sar]

Used to display system activity reports.

How to use:

Static routes added through the CLI console (command line) are not saved and are not loaded after booting.


© BLOCKBIT 373

Figure 570 – Command Line Interface – sar.

21.43 [set-network-dns]

Configures the DNS address on the server.

How to use:


374 © BLOCKBIT


21.44 [set-network-gateway]

Used to set the network gateway.

How to use:

Figure 572 – Command Line Interface – set-network-gateway.

21.45 [set-network-interface]

Configures the logger's network interface.

How to use:


© BLOCKBIT 375


21.46 [set-network-timezone]

Used to determine network timezone.

How to use:

Figure 574 – Command Line Interface – set-network-timezone.

21.47 [show-devices]

Displays a listing with the names and IDs of all devices registered in the GSM.

How to use:


376 © BLOCKBIT

Figure 575 – Command Line Interface – show-devices.

21.48 [show-uuid]

Used to display the BLOCKBIT GSM identification number. This ID is used for identifying the

hardware for validation of the use license.


Figure 576 – Command Line Interface – show-uuid.

21.49 [shutdown]

Used to turn off the system.


Figure 577 – Command Line Interface – shutdown.

21.50 [tcpdump]

Used to monitor, capture, and analyze packets being transmitted over the network. Thus, it allows the administrator to analyze the behavior of the network, aiding in the identification of problems, infected stations, malicious traffic, bottlenecks, etc.

How to use:


© BLOCKBIT 377

Figure 578 – Command Line Interface – tcpdump.

Example: Monitor all local network interface traffic - Eth0 interface:

Figure 579 – Command Line Interface – tcpdump – Example.

21.51 [tcptop]

Used to extract and display traffic information from network interfaces, such as total packets captured, total packets received total packets blocked by the kernel, and total packets trafficked by the TOP 10 IP addresses.

How to use:

Figure 580 – Command Line Interface – tcptop.

Exemplo: Exibir informações de tráfego top 10 da interface eth1:


378 © BLOCKBIT

Figure 581 – Command Line Interface – tcptop – Example.

21.52 [telnet]

Used for remote access and simulation tests of a terminal. Can be used for connection response testing of service and even sending tests of an email message.

How to use:

Figure 582 – Command Line Interface – telnet.

Example: [Standard command output]:


© BLOCKBIT 379

Figure 583 – Command Line Interface – telnet – Example.

Example 1: Connection Tests with a Remote Service Ts (Terminal Service) on a Specific Port:

Figure 584 – Command Line Interface – telnet – Example 1.

Example 2: Connection tests with a remote service on a specific port with the connection failure response:

Figure 585 – Command Line Interface – telnet – Example 2.

21.53 [tracepath]

Used to plot a path to a designated network address, reporting the "lifetime" or TTL lag and the maximum transmission unit (MTU) along the path.

How to use:


380 © BLOCKBIT

Figure 586 – Command Line Interface – tracepath.

Example: Test to trace the route or path to the address www.google.com specifying TCP / 80 port (HTTP).

21.54 [traceroute]

Used to map a path to a designated network address. The "traceroute" command supports some advanced parameters that differentiate it from "tracepath", including the selection of protocols, such as TCP, UDP, ICMP or others.


382 © BLOCKBIT



Example: Tests to trace the routing or path to the Google DNS IP address, IP 8.8.8.8 in the UDP protocol (17):


© BLOCKBIT 383

Figure 590 – Command Line Interface – traceroute – Example 1.

21.55 [update-gsm]

Used to check, download and install GSM BLOCKBIT update packages.


Figure 591 – Command Line Interface – update-gsm.

21.56 [uptime]

Displays for how long the server is running.

How to use:

Figure 592 – Command Line Interface – uptime.


384 © BLOCKBIT

21.57 [vmstat]

Used to report information about processes, memory, paging, I / O blocks, and CPU activities.

How to use:

Figure 593 – Command Line Interface – vmstat.

Example: Standard command output:

Figure 594 – Command Line Interface – vmstat - Example.

21.58 [whois]

Used to query information about an Internet domain.

blockbit gsm administrator guide€¦ · 6.3 installation process .....44 7 network environments 47...

Documents