AirLive IAR-5000 инструкция обслуживания

. IA R -5000 Inter net Activity R ecor de r Use r ’ s Manual[...]

Copyright and Disclaim er AirLive IAR-500 0 User ’ s Manual Copyright & Disclaimer No part of this publication may be reproduc ed in any form or by any means, whether electronic, mechanical, photocopying, or record ing without the written consent of OvisLink Corp. OvisLink Corp. has made the best effort to ens ure the accuracy of the informat[...]

T able of C ontents i AirLive IAR-5000 User ’ s Manual Table of Contents 1. Introduction ................................................................................................ 1 1.1 Overview .............................................................................................. 1 1.2 Firmware Upgrade and T ech Support ...........[...]

T able of C ontents AirLive IAR-5000 User ’ s Manual ii 6.1 Settings .............................................................................................. 46 6.2 Auth User ........................................................................................... 48 6.3 RADIUS .............................................................[...]

T able of C ontents iii AirLive IAR-5000 User ’ s Manual 1 1.5 Accessing Emails Sent via W eb-Based Email Service ................... 146 1 1.6 Accessing Emails Received via Web-Based Email Service ........... 147 1 1.7 Accessing Files T ransferred via FTP Protocol ................................ 149 1 1.8 Accessing Details of Sessions Establish[...]

1. Introduction 1 A irLive IAR-5000 User ’ s Manual 1 1. Introduction 1.1 Overview Instead to restrict the access right of communication software, the AirLive brings you a brand new model of Internet Activity Recor der, IAR-5000. It can record the defined service packets in its hard disk, and provide the log to administrator for moni toring. With[...]

1. Introduction AirLive IAR-5000 User ’ s Manual 2 1.3 Features  Sniffer and Bridge mode  SMTP, POP3/IMAP, HTTP, IM, Web SMTP , Web POP3, FTP, and Telnet Content Record  IM, P2P, Web mail si gnature pattern update  IM Management  Application Management for Peer-to-Peer Sharing, Multimedia Streaming, Online Gaming, VPN Tunneling, an[...]

2. Install the IAR-5000 3 AirLive IAR-5000 User ’ s Manual 2 2. Inst alling the IAR-5000 This section describes the har dware features and the hardwar e installation procedure for the IAR-5000. For software configuration, please go to chapter 3 for more details. 2.1 Before You Start It is important to read through this section before you install [...]

2. Install the IAR-5000 AirLive IAR-5000 User ’ s Manual 4 2.3 Knowing your IAR-5000 Below are descriptions and diagrams of the product: No Port Description 1 Console Port 9-pin serial port connecto r for checking setting and restore to the factory setting 2 Port 1 Use this port to connect to a router , DSL router , or Cable modem router 3 Port 2[...]

2. Install the IAR-5000 5 AirLive IAR-5000 User ’ s Manual 2.4 LED Table IAR-5000: No LED Color St atus Description 1 POWER Green On Power on the device 2 Hard Disk Green Blinking Data reading / accessing Port1 (L) Orange Blinking Sending / Receiving 3 Port1 (R) Green On 100 Mbps Port2 (L) Orange Blinking Sending / Receiving 4 Port2 (R) Green On [...]

2. Install the IAR-5000 AirLive IAR-5000 User ’ s Manual 6 2.5 Hardware Installation  Bridge Mode: Connect the Port 1 to the firewall or gat eway and Port 2 to a LAN hub or switch.[...]

2. Install the IAR-5000 7 AirLive IAR-5000 User ’ s Manual  Sniffer Mode: Connect the Port 1 to the mirror port of a core switch or any port available on a LAN hub and Port 2 to t he network adaptor of the management PC. Sniffer Mode Bridge Mode Deployment Connect Port1 to hub or switch’ s mirror port Between LAN and firewall Router Anomaly [...]

2. Install the IAR-5000 AirLive IAR-5000 User ’ s Manual 8 2.6 Restore Settings to Default If you have forgotten your IAR-5000s IP address, you can restore your IAR-5000 to the default settings by console. Please see diagram below for details. 1. Connect 9-pin RS-232 cable to PC and IAR-5000 console port. 2. Open Hyper Terminal program and config[...]

2. Install the IAR-5000 9 AirLive IAR-5000 User ’ s Manual 5. Fill in Port Setting as following value and click OK to save the setting 6. Press “Enter” and input Login name “admin” and password “airlive”.[...]

2. Install the IAR-5000 AirLive IAR-5000 User ’ s Manual 10 7. T ype “ls” to display the command list 8. Type “reset” to reset the device as default.[...]

3. Configuring th e IAR-5000 11 AirLive IAR-5000 User ’ s Manual You can configure through standard web browse r (http), secured web (https) management. In this chapter, we will explain IAR-5000’s availa ble management interfaces and how to get into them. Then, we will provide the introduction on Web Management and recommended initial settings.[...]

3. Configuring th e IAR-5000 AirLive IAR-5000 User ’ s Manual 12 You are ready now to configure the IAR-5000 using your PC. 3.3 Management Interface The IAR-5000 can be configured using one the management interfaces below:  W eb Management (HTTP): Y ou can manage your IAR-5000 by simply typing its IP address in the web browser . Most func tion[...]

3. Configuring th e IAR-5000 13 AirLive IAR-5000 User ’ s Manual  Secured W eb Management (HTTPS): HTTPS is also using web browser for configuration. But all t he data transactions are securely encrypted using SSL encryption. Therefore, it is a sa fe and easy way to manage your IAR-5000. We highly recommend the Internet service provider to use[...]

3. Configuring th e IAR-5000 AirLive IAR-5000 User ’ s Manual 14 Normal Web Management (HTTP) T o get into the Normal Web Management, simply type in the IAR-5000’s IP address (default IP is 192.168.1.1) into the web browser ’s address field. Secured Web Management (HTTPS) T o get into the Secured Web Management, just type “http s://192.168.[...]

3. Configuring th e IAR-5000 15 AirLive IAR-5000 User ’ s Manual  Firefox: 1. Select “or you can add an exception” 2. Click on “Add Exception” 3. Click on “Get Certificate”. Then, pl ease enter IAR-5000’ s IP address. Finally , please click on “Confirm Security Exception.” 2 1[...]

3. Configuring th e IAR-5000 AirLive IAR-5000 User ’ s Manual 16 3.5 Initial Configurations We recommend users to browse through IAR-5000 ’s web management interface to get an overall picture of the functions and interface. Below are the recommended initial configurations for first time login: Step1. Connecting the administrator’s PC and IAR-[...]

3. Configuring th e IAR-5000 17 AirLive IAR-5000 User ’ s Manual Step3. You will be br ought to the Installation Wizard screen during your first login. It will guide you through the settings. Step4. Select the language and character encodi ng for your management interface. Default character encoding will be used on emails with unspecified charact[...]

3. Configuring th e IAR-5000 AirLive IAR-5000 User ’ s Manual 18 Step6. Select an operating mode based on how the device is deployed. Step7. Choose the basis for recordi ng users’ online activities.[...]

3. Configuring th e IAR-5000 19 AirLive IAR-5000 User ’ s Manual Step8. Configure the related interface addresses.  T ype a valid IP address from the LAN subnet in the IP Address field and configure its netmask, default gatew ay and DNS address accordingly .  T o use VLAN, tick Enable VLAN over Port 1 or 2 based on your case and also assign[...]

3. Configuring th e IAR-5000 AirLive IAR-5000 User ’ s Manual 20 Step9. Configure the device to record the online activities of specific departments or groups by specifying its subnet and mask address. Step10. Click on Finish . Step11. Navigate to User List Æ Settings , and then give each department or group a friendly name.[...]

3. Configuring th e IAR-5000 21 AirLive IAR-5000 User ’ s Manual Step12. Under User List Æ Logged , users within the same subnet as the management address will be included in the same subnet category. In another word, IAR-5000 classifies users by the identity of subnet. Also, the device allows system administrator to customize user lists for use[...]

4. System AirLive IAR-5000 User ’ s Manual 22 The so-called system administration refers the competency to manage the IAR-5000. In this Chapter it will be defined to the Admin, In terface IP, Setting, Date/Time, Permitted IPs, Language, Logout and So ftware Update. The IAR-5000 is managed by the main system administrator. The main system administ[...]

4. System 23 AirLive IAR-5000 User ’ s Manual Group Monitoring:  The group administrator can di vide the internal network in to several groups. And he can appoint the specific admin istrator to view the gro up but can not view across groups. Add New Group-Admin: Step1. In admin setting window , click the New-Group Admin . Step2. In add new gro[...]

4. System AirLive IAR-5000 User ’ s Manual 24 Figure 4-2 T o change the ad min pass word 4.2 Interface Interface Address:  The administrator can set the IP login information in IAR-5000. Ping:  Enable the function, the user can send Ping (ICMP) p ackets to Interface. HTTP:  Enable this function, the user can logi n IAR-5000 W eb UI throu[...]

4. System 25 AirLive IAR-5000 User ’ s Manual Figure 4-3 The interface IP setting Please do not cancel HTTP and HTTPS before setting the Interfac e , because it will let the system admini strator could not enter the W ebUI of IAR-5000. 4.3 Settings System Settings:  The system administrator can import or export the system se ttings, or they ca[...]

4. System AirLive IAR-5000 User ’ s Manual 26  Sniffer mode operates as: Port 1 serves as a p acket receiver connected to the mirror port of a core switch whereas port 2 connected to any other port available on that core switch acting as a management use for system administrator . Management over Web Browser:  Management port enables the de[...]

4. System 27 AirLive IAR-5000 User ’ s Manual Import the configured file Step1. In System Æ Setting Æ System Setting s , select Import System Settings , then click Browse button at right place. Step2. In Choose File window , choose the directory of former saved file in IAR-5000, and choose the correct setting, then click Open. (Figure 4-5) Step[...]

4. System AirLive IAR-5000 User ’ s Manual 28 Reset Factory Default Step1. In System Æ Settings Æ System Settings , select Reset Factory Setting an d Format Hard Disk . Step2. Click the OK in the lower right, it will restore to the factory se tting of IAR-5000 and format the disk at the same time. (Figure 4-7) Figure 4-7 Select Reset Fact ory S[...]

4. System 29 AirLive IAR-5000 User ’ s Manual Figure 4-8 Enable the instant mail message alarm of IAR-5000 Select Enable SMTP authentication and enter the username and password, then click Mail T est button to test Notification Address 1 and Notification Address 2, to s ee if the e-mail sending address can receive the current caution message. Dev[...]

4. System AirLive IAR-5000 User ’ s Manual 30 4.4 Date/Time System Clock Settings  The date and time settings can be configured by either syncing to an Internet time server or syncing to the computer ’s clock. GMT  The short form for Greenwich Mean T ime. It is the international standard time. Daylight Saving T ime  Daylight saving tim[...]

4. System 31 AirLive IAR-5000 User ’ s Manual If the local area executes t he daylight saving time, then enable the daylight saving time setting. 4.5 Permitted IPs Creating a Permitted IP Address Step1. In System Æ Permitted IPS Æ New Entry , add the new setting: (Figure 4-1 1)  Name enters master .  IP Address enters 172.16.0.2.  Netm[...]

4. System AirLive IAR-5000 User ’ s Manual 32 4.6 Logout Logging out the Management Interface Step1. Click the Logout icon in the up right of Web UI, it can let the system administrator to log out fr om the system admin anytime, and also prevent other person change the settings of IAR-5000. (Figure 4-13) Figure 4-13 Confirm to lo gout Step2. Clic[...]

4. System 33 AirLive IAR-5000 User ’ s Manual Figure 4-15 Software update It needs 3 minutes to update the software, and will reboot af ter updated the system. Please do not turn it of f, off line and exit the web page during the update, or it will caus e the error in IAR-5000. (It is recommended using the LAN to update.)[...]

5. User List AirLive IAR-5000 User ’ s Manual 34 This chapter is about the user s can be monitored by the IAR- 5000. It can automatic search and add the new users, and the system administrator can add the list s by himself. User List Configuration ：  Administrator can export t he monitor user list and some related settings to the PC or impor[...]

5. User List 35 AirLive IAR-5000 User ’ s Manual Figure 5-2 Click search new user button Figure 5-3 Starting to search new user Figure 5-4 Select the new user to add[...]

5. User List AirLive IAR-5000 User ’ s Manual 36 Figure 5-5 Complete to add the new user The subnet in which management address resided is set to be the first subnet on user list. Users from t hat subnet will be shown under User List Æ Logged . A user will be automatically added on Logged list once the device detects his / her accessing the Inte[...]

5. User List 37 AirLive IAR-5000 User ’ s Manual Step3. Modify the user in user list ：  Click User Name of JACKY  User Name, enter Jacky_PC.  Dep artment / Group, select Laboratory .  Click OK . (Figure 5-6, 5-7, 5-8)  Click User Name of OCT1005.  User Name , enter Gateway .  Dep artment / Group , select Device_Room.  Se[...]

5. User List AirLive IAR-5000 User ’ s Manual 38 Figure 5-9 Select the user t o modify Figure 5-10 Enter the user in formation to modify Figure 5 -1 1 Move the user to ig nored user list[...]

5. User List 39 AirLive IAR-5000 User ’ s Manual Figure 5-12 Complete to modify the user list In Ignored user list , the system administrator can also select the user to move to logged user list. Step4. In User List Æ Logged , add the new subnet:  Click Add.  Subnet , enter 192.168.139.1.  Netmask , enter 255.255.255.0.  Add a New us[...]

5. User List AirLive IAR-5000 User ’ s Manual 40 Change the user list by import the u ser list configuration (excel list) Step1. In User List Æ Setting Æ User List Configuration Æ Export User List to Client PC Æ click . Step2. When it appears File Download , click Sa ve , choose the position to save the download file, then click Save again. T[...]

5. User List 41 AirLive IAR-5000 User ’ s Manual Figure 5-15 Editing the Use r List in Excel Step4. Change the information of Dep artment / Group.  Change the 8th Department / Group information, and the original Customer_Service will change into Support.  Add the 12th Department /Gro up information, and change Group_12 into R.D._2 . (Figure[...]

5. User List AirLive IAR-5000 User ’ s Manual 42 Figure5 -16 Change the Departme nt / Group information from excel Step5. T o add and modify the user informati on in the first subnet. (Figure 5-17)  Change 192.168.1.2 （ Jacky ） Department / Group information, and change the 1 th Dep artment / Group into 9 th Dep artment / Group.  Insert[...]

5. User List 43 AirLive IAR-5000 User ’ s Manual Step6. Add the third subnet and user ’s information. (Figure 5-18)  Please enter the third subnet basic information under the second subnet user list . （ the range of IP , Netmask, and Default Group ） .  Please enter the basic user in formation under the third subnet. （ User IP , User[...]

5. User List AirLive IAR-5000 User ’ s Manual 44 ! Figure 5-19 Selecting the Edited User Li st to Import Step10. Click the lower right OK , the user list setting files will im port into IAR-5000. Modify the Information of the desirable user: Step1. Click on the desirable user to change it s user information. (Figure 5-20) Step2. T ype a proper us[...]

5. User List 45 AirLive IAR-5000 User ’ s Manual Figure 5-21 Modify ing the User Information System administrator c an record or ignore the online activities of a specific internal user simply by se lecting the user on the user list and then click on Logged or Ignored button on the top of the first list. Add a new subnet: Step1. Navigate to User [...]

6. Authenticatio n AirLive IAR-5000 User ’ s Manual 46 The device supports four types of authentic ation: RADIUS, POP3, LDAP and the device’s inbuilt user authenticati on. The IT administrator may regulat e users’ Internet access using these authentication mechanisms. 6.1 Settings Authentication Settings:  Authentication Port: The port num[...]

6. Authenticatio n 47 AirLive IAR-5000 User ’ s Manual  Surf any webpage, user will see: (Figure 6-2) Figure 6-2 The Logi n Screen for A uthentication Mechanism  The designated web site will show up afte r passing authentication. (Figure 6-3) Figure 6-3 The Des ignated Web Site for Authentication Login The device’s authentication me chani[...]

6. Authenticatio n AirLive IAR-5000 User ’ s Manual 48 6.2 Auth User Auth Name:  The authentication name for a user . Password:  The p assword for t he authentication. Confirm New Password:  The confirmation of the p assword. Regulate Users’ Internet Access: Step1. Under Authentication Æ Auth User , create as many authenticated users [...]

6. Authenticatio n 49 AirLive IAR-5000 User ’ s Manual Step3. T o log out of the authenticated session, click on Logout in the Authentication Logout window . If the window has been clos ed, please enter http://device’s management address:authentication port/logout.html (ex. http://192.168.1.1:82 ) in the Address field of a web browser to re-ope[...]

6. Authenticatio n AirLive IAR-5000 User ’ s Manual 50 Step3. Select Internet Authentication Services . (Figure 6-8) Figure 6-8 A d ding Internet Authenti cation Services from the Subcomponents Step4. Navigate to Star t Æ Control Panel Æ Administrative T ools and then select Internet Authentication Service . (Figure 6-9) Figure 6-9 Selecting th[...]

6. Authenticatio n 51 AirLive IAR-5000 User ’ s Manual Step5. Right-click on RADIUS Client s and then select New RADIUS Client . (Figure 6-10) Figure 6-10 Adding a Ne w RADIUS Client Step6. T ype a name and the client address (the device’s management address) respectively in the corresponding fields. (Figure 6-1 1)[...]

6. Authenticatio n AirLive IAR-5000 User ’ s Manual 52 Figure 6-1 1 Configuring the Ne w RADIUS Client Step7. Select RADIUS S tandard for th e Client-V endor , enter the shared secret and then confirm it. (Note: The shared se cret must be identical with the one specified for IAR-5000.) (Figure 6-12) Figure 6-12 Selecting the Client-V endor and En[...]

6. Authenticatio n 53 AirLive IAR-5000 User ’ s Manual Step8. Right-click on Remote Access Polices and then select New Remote Access Policy . (Figure 6-13) Figure 6-13 Creating a New Remote A ccess Policy Step9. Select a policy configuration method and then type a policy name. (Figure 6-14) Figure 6-14 Sele cting a Policy Configurati on Method an[...]

6. Authenticatio n AirLive IAR-5000 User ’ s Manual 54 Step10. Select Ethernet for the access method. (Figure 6-15) Figure 6-15 Selec ting Ethernet for the Access Method Step11. Grant access based on User . (Figure 6-16) Figure 6-16 Granting Access Based on User[...]

6. Authenticatio n 55 AirLive IAR-5000 User ’ s Manual Step12. Select MD5-Challenge for EAP type . (Figure 6-17) Figure 6-17 Selecting MD5-Challen ge for EAP T ype Step13. Right-click on the newly added policy and then select Properties . (Figure 6-18) Figure 6-18 Configurin g the Properties of the Ne w ly Added Policy[...]

6. Authenticatio n AirLive IAR-5000 User ’ s Manual 56 Step14. Choose Grant remote access permission , remove the existing policy conditions and then click on Add . (Figure 6-19) Figure 6-19 Configurin g the Properties of the Policy Step15. Select Service-T ype from the attribute types. (Figure 6-20) Figure 6-20 Adding a New Attribute T ype[...]

6. Authenticatio n 57 AirLive IAR-5000 User ’ s Manual Step16. Select Authenticate Onl y from available types and then click on Add . (Figure 6-21) Figure 6-21 Adding a Service T ype Step17. Click on Edit Profile button and then Authentication tab. Next, select Unencrypted authentication (P AP , SP AP) as the method. (Figure 6-22) Figure 6-22 Sel[...]

6. Authenticatio n AirLive IAR-5000 User ’ s Manual 58 Step18. Navigate to Star t Æ Control Panel Æ Administrative T ools and then select Computer Management . (Figure 6-23) Figure 6-23 The Loca tion of Computer Management on the St art Menu Step19. On Local User and Groups , right-click on Users and then select New User . (Figure 6-24) Figure [...]

6. Authenticatio n 59 AirLive IAR-5000 User ’ s Manual Step20. The RADIUS server setup is completed. Step21. Under Authentication Æ RADIUS , type the IP addre ss, port number and shared secret respectively in the corresponding fields. (Figure 6-25) Figure 6-25 Configuring the RADIUS Server Settings Click on T est connection to test the connectio[...]

6. Authenticatio n AirLive IAR-5000 User ’ s Manual 60 6.4 POP3 Using a POP3 Server to Regulate Users’ Internet Access: Step1. Under Authentication Æ POP3 , type the IP address (or domain name) and port number respectively in the co rresponding fields. (Figure 6-27) Figure 6-27 Configurin g the POP3 Server Settings Click on T est connection to[...]

6. Authenticatio n 61 AirLive IAR-5000 User ’ s Manual 6.5 LDAP LDAP Search Distinguished Name:  The distinguished name for the LDAP authentication. LDAP Filter:  The criteria to use in selecting elements within scope. User ’ s Distinguished Name:  The distinguished name for the LDAP authentication. Configuring LDAP Server on Windows S[...]

6. Authenticatio n AirLive IAR-5000 User ’ s Manual 62 Step3. Click Next . (Figure 6-30) Figure 6-30 Serv er Configuration Wizard Step4. Select Active Directory then clic k Next . (Figure 6-31) Figure 6-31 Server Role[...]

6. Authenticatio n 63 AirLive IAR-5000 User ’ s Manual Step5. Click Next. (Figure 6-32) Figure 6-32 Summary of Selections Step6. Click Next . (Figure 6-33) Figure 6-33 Installation Wizard[...]

6. Authenticatio n AirLive IAR-5000 User ’ s Manual 64 Step7. Click Next . (Figure 6-34) Figure 6-34 Installation Wizard Step8. Select Domain Controller for a new Domain then click Next . (Figure 6-35) Figure 6-35 Domain Controller T ype[...]

6. Authenticatio n 65 AirLive IAR-5000 User ’ s Manual Step9. Select Domain in a new forest then click Next . (Figure 6-36) Figure 6-36 Create N ew Domain Step10. T ype the DNS name for the domain then click Next . (Figure 6-37) Figure 6-37 New Do main Name[...]

6. Authenticatio n AirLive IAR-5000 User ’ s Manual 66 Step11. Enter the NetBIOS domain name then click Next . (Figure 6-38) Figure 6-38 NetBIOS Domain Name Step12. Enter the Domain NetBIOS name then click Next . (Figure 6-39) Figure 6-39 Data base and Log Folder s[...]

6. Authenticatio n 67 AirLive IAR-5000 User ’ s Manual Step13. Enter the folder location then click Next . (Figure 6-40) Figure 6-40 Shared S ystem Volume Step14. Select I will correct the problem late r by configuring DNS manually . (Figure 6-41) Figure 6-41 DNS Registrati on Diagnostics[...]

6. Authenticatio n AirLive IAR-5000 User ’ s Manual 68 Step15. Select Permissions compatible only with Windows 2000 or Windows Server 2003 operating systems . (Figure 6-42) Figure 6-42 Permissions Step16. Enter a restore mode password and retype it in the Confirm p assword field . (Figure 6-43) Figure 6-43 Director y Services Restore Mod e Admini[...]

6. Authenticatio n 69 AirLive IAR-5000 User ’ s Manual Step17. Click Next . (Figure 6-44) Figure 6-44 Summary Step18. Settings complete (Figure 6-45). Figure 6-45 Activ e Directory Settings Complete[...]

6. Authenticatio n AirLive IAR-5000 User ’ s Manual 70 Step19. Go to Star t Æ Administrativ e T ools Æ Active Directory Users and Computers . (Figure 6-46) Figure 6-46 Activ e Directory Settings Complete Step20. In the Active Directory Users and Computers window , right click on Users and create a new user . (Figure 6-47)[...]

6. Authenticatio n 71 AirLive IAR-5000 User ’ s Manual Figure 6-47 Creating a New User Step21. Enter in the user ’s data, then click Next . (Figure 6-48) Figure 6-48 Creating a New User[...]

6. Authenticatio n AirLive IAR-5000 User ’ s Manual 72 Step22. Enter in a password and click Next . (Figure 6-49) Figure 6-49 Creating a New User Step23. Settings Complete. (Figure 6-50) Figure 6-50 Settings Complete[...]

6. Authenticatio n 73 AirLive IAR-5000 User ’ s Manual Step24. Go to Authentication Æ LDAP and enter the settings. (Figure 6-51) Figure 6-51 LDAP Serv er Sett ings Clicking on T est connection provides a connectivity test to the LDAP server . Step25. When the user attempts to access the In ternet though a browser , the following screen will appe[...]

7. IM M anagement AirLive IAR-5000 User ’ s Manual 74 IM management provides system administrator with th e flexibility and the fa cility to manage IM access. IAR-5000 can be confi gured to grant or deny IM a ccess based on account or IM application. IM Management comprises three major settings: 1. Login Notice: System administrator may compos e [...]

7. IM M anagement 75 AirLive IAR-5000 User ’ s Manual 7.1 Login Notice When a user successfully logs on to his / her IM account, he /she shall receive the login notice via a NetBIOS broadcast, or receive the alert notification from IAR-5000 presented in a conversation window of the IM application. Following are the conf iguration example: Step1. [...]

7. IM M anagement AirLive IAR-5000 User ’ s Manual 76 Figure 7-3 Login Notice Shown in a MSN Conversation W indow Figure 7-4 Login Notice Shown in an ICQ Conve rsation Window[...]

7. IM M anagement 77 AirLive IAR-5000 User ’ s Manual Figure 7-5 Login Notice Shown in a Y ahoo Conv ersation Windo w[...]

7. IM M anagement AirLive IAR-5000 User ’ s Manual 78 7.2 Default Rule MIS engineer can make the default IM rule fo r MSN, Y ahoo, ICQ, QQ and else IM software. IAR-5000 will follow the Default Rule setting to assign the access right for new account. Import / Export Settings of IM Account Rule  The account rule can be exported as a file for ar[...]

7. IM M anagement 79 AirLive IAR-5000 User ’ s Manual 7.3 Account Rule Default … Accounts (Rule S t atus)  Account s resided in this category are subject to default rule. Accepted … Accounts  Account s resided in this category are granted with IM access. Accepted … Accoun t s (No File T ransfer)  Account s resided in this category [...]

7. IM M anagement AirLive IAR-5000 User ’ s Manual 80 7.4 Configuration Example Configuring the Default Rule for IM Access Navigate to IM Management Æ Rule Æ Default Rule , and then set as below: (Figure 7-6)  Select Accept: Ever yone for MSN, Y ahoo, ICQ / AIM, Skype, Gadu-Gadu and Google T alk as the default rule.  Select Accept: Authen[...]

7. IM M anagement 81 AirLive IAR-5000 User ’ s Manual Figure 7-6 Configuring the Default Rule for IM Access[...]

7. IM M anagement AirLive IAR-5000 User ’ s Manual 82 Step1. T o record Skype conversations, it require s installing the plug-in (IR_Plugin.exe) onto clients’ PCs. (Please refer to chapter 9 for advanced configuration) Step2. T o access QQ messenger , users must verify their account by logging on to the management address appended with “/qq?[...]

7. IM M anagement 83 AirLive IAR-5000 User ’ s Manual When the QQ password has been changed, please go to the management address appended with “/qq”, such as http://192.168.1.1/qq , to modify the original password. Step4. Users merely have the access to MSN Web Messenger . Access to other Web-based messengers will be denied. The IAR-5000 is c[...]

7. IM M anagement AirLive IAR-5000 User ’ s Manual 84  Modify the IP and MAC addresses. (Figure 7-13)  Create a new Y ahoo account: Insert a bl ank row right beneath the last row of MSN accounts and type all necessary information. (Figure 7-14)  After edited, click on File Æ Save on the menu bar and save the file as “IM_Rule_List.csv?[...]

7. IM M anagement 85 AirLive IAR-5000 User ’ s Manual Figure 7-13 IP and MAC A d dresses Chan ged Figure 7-14 Ne w Y ahoo A ccount Whether an account is purposely or accidentally deleted during editing, it does not affect the exis ting account rule on IAR-5000 af ter imported the edited file. Only newly added account(s) or account(s) had been mod[...]

7. IM M anagement AirLive IAR-5000 User ’ s Manual 86 Figure 7-16 Confirming to Import the Account Rule Step7. Navigate to IM Management Æ Rule Æ Account Rule , and then follow the steps below:  On the Default … Account s (Rule St atus) list, grant IM access to the specific accounts by ticking them.  Click on To the accepted and then cl[...]

7. IM M anagement 87 AirLive IAR-5000 User ’ s Manual Figure 7-18 Block ing File T ransfer of S pecific Account s Figure 7-19 Denying IM Access to S pecific A ccounts Figure 7-20 Denying IM Access to S pecific A ccounts Figure 7-21 Denying IM Access to S pecific A ccounts[...]

7. IM M anagement AirLive IAR-5000 User ’ s Manual 88 Figure 7-22 Confirming to Remove an Ac count Figure 7-23 Modificatio n Completed IAR-5000 will use default rule (see Rule S tatus) on newly added IM accounts.[...]

8. Appli cation Managem ent 89 AirLive IAR-5000 User ’ s Manual Application Management determines the users’ right to access applications (peer-to-peer sharing, multimedia streami ng, online gaming, VPN tunneling and remote controlling). System administrator may grant or deny access to applicati ons based on which application is used or who the[...]

8. Appli cation Managem ent AirLive IAR-5000 User ’ s Manual 90 Configuring the Default Ru le for Application Access Step1. Navigate to Application Management Æ Default Rule , and then set as below: (Figure 8-1)  Select Drop for all Peer-to-Peer sharing applications. Figure 8-1 Configuring the Default Rule for Applic ation A ccess Step2. Afte[...]

8. Appli cation Managem ent 91 AirLive IAR-5000 User ’ s Manual 8.2 Custom Rule … Users under Default Rule (Rule St atus)  Users resided in this categor y are subject to default rule. Accepted … Account  Account s resided in this category are granted with application access. Dropped … Account  Account s resided in this categor y ar[...]

8. Appli cation Managem ent AirLive IAR-5000 User ’ s Manual 92 Figure 8-4 Deny ing P2P Access to S pecific A ccounts Figure 8-5 Modification Comp leted IAR-5000 will use default rule (see Ru le S tatus) on newly added P2P accounts.[...]

9. Record: Se ttings 93 AirLive IAR-5000 User ’ s Manual IAR-5000 can record the user’s internet acti vities, and administrator easy to manage all of the information by clearly group / department di vision. And assure the data transmission security and monitor the employee‘s internet activities. In other words, IAR-5000 can prevent the employ[...]

9. Record: Se ttings AirLive IAR-5000 User ’ s Manual 94 Plug-In for Binding Username to AD Ser ver and Recording Skype Conversations (T ext & V oice)  Plug-In inst allation location:  AD Server: z The user ’s computer wil l automatically install and run the plug-in when the user logs on to the AD server . Skype text and conversation [...]

9. Record: Se ttings 95 AirLive IAR-5000 User ’ s Manual The IAR-5000 automatically modifies the plug-in file to suite the currently attached network. Thus, it is import ant to download the plug-in only once the net work has been deployed. LAN to LAN Activity Recording: IAR-5000 is capable of recording the dat a transmission among LANs. Supposing[...]

9. Record: Se ttings AirLive IAR-5000 User ’ s Manual 96 9.2 Settings Example Binding User Names to IP Addresses: Step1. Navigate to Record Æ Settings Æ Settings , and then set as below: (Figure 9-1) Figure 9-1 Record Analysis Settings Step2. Under User List Æ Logged , you will see: (Figure 9-2)  Users are identified by co mputer name or DN[...]

9. Record: Se ttings 97 AirLive IAR-5000 User ’ s Manual Binding User Names to MAC Addresses: Step1. Navigate to Record Æ Settings Æ Settings , and then set as below: (Figure 9-4) Figure 9-4 Record Analysis Settings Step2. Under User List Æ Logged , you will see: (Figure 9-5)  Users are identified by co mputer name or DNS name.  MAC addr[...]

9. Record: Se ttings AirLive IAR-5000 User ’ s Manual 98 Binding User Names to AD Server: Step1. Navigate to Record Æ Settings Æ Settings , and then set as below: (Figure 9-7) Figure 9-7 Record Analysis Settings Step2. Right-click on your domain, point to New , and then click on Organizational Unit . Next, create as many users as desirable in t[...]

9. Record: Se ttings 99 AirLive IAR-5000 User ’ s Manual 1. Each AD object has a unique iden tifier known as a Distinguished Name (DN). DNs are used to uniquely identify entries in an LDAP directory . The following string-type attributes represent the set of standardized attribute types for a ccessing an LDAP directory .  DC - DomainCompone nt[...]

9. Record: Se ttings AirLive IAR-5000 User ’ s Manual 100 Figure 9-10 Searchin g for Users Inside Containers Figure 9-1 1 Searching for Users Inside Organi zations Units[...]

9. Record: Se ttings 101 AirLive IAR-5000 User ’ s Manual Step3. Under User List Æ Logged , you will see: (Figure 9-12)  Users are displayed by the given name from the Organizational Unit in the AD server .  IP address is used for user identificat ion if the plug-in has not been inst alled onto the client’ s computer or user itself has n[...]

9. Record: Se ttings AirLive IAR-5000 User ’ s Manual 102 Step5. Download the plug-in and instal led it onto the AD server:  Navigate to Star t Æ All Programs Æ Administrative T ools Æ Active Directory Users and Computers , and then right-click on the domain and choose Properties . (Figure 9-15)  Select the Default Domain Policy and then[...]

9. Record: Se ttings 103 AirLive IAR-5000 User ’ s Manual Figure 9-16 Domain Prop erties Figure 9-17 Group P olicy Object Editor[...]

9. Record: Se ttings AirLive IAR-5000 User ’ s Manual 104 Figure 9-18 Logon Properti es Figure 9-19 Editing Logon Script[...]

9. Record: Se ttings 105 AirLive IAR-5000 User ’ s Manual Figure 9-20 Logon Script C onfiguration Complete d Step6. A user logs on to Windows using Active Directory authentication. (Figure 9-21) Figure 9-21 Logging on to an AD Domain[...]

9. Record: Se ttings AirLive IAR-5000 User ’ s Manual 106 For non-AD client users, you may download the plug-i n yourself and install it onto your computer . The device will then be able to use your user name, namely the name you us e to log on to Windows, as a basis for recording online acti vities. (Figure 9-22, 23, 24) Figure 9-22 Use r Using [...]

9. Record: Se ttings 107 AirLive IAR-5000 User ’ s Manual Figure 9-24 Inst alling the Plug-In onto Clie nt PC Step7. User name helps track and control user ’ s online activities. Eight kinds of IP service logs are available under Record Æ Service. (Figure 9-25) Figure 9-25 User ’s Online Activ ities Binding User Names to Authentication Names[...]

9. Record: Se ttings AirLive IAR-5000 User ’ s Manual 108 Step2. Under User List Æ Logged , you will see: (Figure 9-27)  Users are identified by authentication name.  IP address is used for user identification if no information (e.g., user name, DNS name, etc.) is available for displaying. Figure 9-27 User Names Bin ding to A u thenticatio[...]

10. Record: User and Service 109 AirLive IAR-5000 User ’ s Manual The AirLive IAR-5000 classifies the most frequent ly seen online activities into 8 services. By monitoring 8 services of each user , s ystem administrator may easily secure the corporate information assets and also avoid network bandwid th from being abused for private purposes. T [...]

10. Record: User and Service AirLive IAR-5000 User ’ s Manual 11 0 Figure 10-1 Search ing for a Specific Log Figure 10-2 The Search Re sult s of SMTP Att ached to an Email[...]

10. Record: User and Service 111 AirLive IAR-5000 User ’ s Manual Figure 10-3 The Search Re sult s of SMTP Click on a desirable message subj ect to read its contents Figure 10-4 Dow nloading the Search Results as a “.txt” File[...]

10. Record: User and Service AirLive IAR-5000 User ’ s Manual 11 2 Figure 10-5 Exporting the Search Results as a “.mbx” File How to open a “.mbx” file on your local computer:  Convert the “.mbx” file into a “. eml” file with a mbx2eml application (e.g., IMAPSize) and then run Outlook Express to open the “.eml” file.  Run[...]

10. Record: User and Service 1 13 AirLive IAR-5000 User ’ s Manual Figure 10-6 Naviga ting to T ools Æ Mbox2eml on the Menu Bar Figure 10-7 Specifying the “.mbx” File to be Con verted[...]

10. Record: User and Service AirLive IAR-5000 User ’ s Manual 11 4 Figure 10-8 Converting the “.mbx” File into a “.eml” File Figure 10-9 File Conv ersion Completed[...]

10. Record: User and Service 1 15 AirLive IAR-5000 User ’ s Manual Figure 10-10 Click oning and Dragging the “.eml” File into Outlook Express to Open It 10.2 HTTP Search V isited Webp ages via HTTP:  Records are available if searched by crit eria, such as Web site address, content, session direction, transmission directi on and date, as ke[...]

10. Record: User and Service AirLive IAR-5000 User ’ s Manual 11 6 Figure 10-1 1 Searching for a Specific Log Figure 10-12 The Search Re sult s of HTTP Att ached to an Email[...]

10. Record: User and Service 1 17 AirLive IAR-5000 User ’ s Manual Figure 10-13 The Search Re sult s of HTTP Click on a desirable Web site log to view the visited p age. Figure 10-14 Downlo ading the Search Results as a “.txt” File[...]

10. Record: User and Service AirLive IAR-5000 User ’ s Manual 11 8 10.3 IM Search IM Conversations:  Records are available if searched by criter ia, such as type, session direction, user account, particip ants, content, file nam e, auth name and date, as keyword or pattern.  Under System Æ Settings , tick Enable email notification and conf[...]

10. Record: User and Service 1 19 AirLive IAR-5000 User ’ s Manual Figure 10-16 The Search Re sult s of IM A ttached to an Email Figure 10-17 The Search Re sult s of IM 1 Click on the frequency number of a conversation to view its conversation[...]

10. Record: User and Service AirLive IAR-5000 User ’ s Manual 120 Figure 10-18 Dow nloading the Search Results as a “.txt” File 10.4 Web SMTP Search Emails Sent via Web-Based Email Services:  Records are available if searched by cr iteria, such as reci pient, sender , subject, content, session direction, no attached file, atta ched file an[...]

10. Record: User and Service 121 AirLive IAR-5000 User ’ s Manual Figure 10-19 Sear ching for a Specific Log Figure 10-20 Th e Search Results of Web SMTP Attached to an Email[...]

10. Record: User and Service AirLive IAR-5000 User ’ s Manual 122 Figure 10-21 Th e Search Results of Web SMTP Click on a desirable message subj ect to read its contents. Figure 10-22 Dow nloading the Search Results as a “.txt” File[...]

10. Record: User and Service 123 AirLive IAR-5000 User ’ s Manual Figure 10-23 Expo rting the Search Results as a “.mbx” F ile T o open the exported “.mbx” file, pl ease refer to Figure 10-6 to 10-10. 10.5 Web POP3 Search Emails Received via Web-Based Email Services:  Records are available if searched by criteria, such as recipi ent, s[...]

10. Record: User and Service AirLive IAR-5000 User ’ s Manual 124 Figure 10-24 Sear ching for a Specific Log Figure 10-25 Th e Search Results of Web POP3 Attached to an Email[...]

10. Record: User and Service 125 AirLive IAR-5000 User ’ s Manual Figure 10-26 Th e Search Results of Web POP3 Click on a desirable message subj ect to read its contents. Figure 10-27 Dow nloading the Search Results as a “.txt” File[...]

10. Record: User and Service AirLive IAR-5000 User ’ s Manual 126 Figure 10-28 Expo rting the Search Results as a “.mbx” F ile T o open the exported “.mbx” file, pl ease refer to Figure 10-6 to 10-10. 10.6 FTP Search Files T ransferred via FTP:  Records are available if searched by crit eria, such as file name, host name, user name, si[...]

10. Record: User and Service 127 AirLive IAR-5000 User ’ s Manual Figure 10-29 Sear ching for a Specific Log Figure 10-30 Th e Search Results of FTP Attached to an Email[...]

10. Record: User and Service AirLive IAR-5000 User ’ s Manual 128 Figure 10-31 Th e Search Results of FTP Click on a file name to download it onto your local computer Figure 10-32 Dow nloading the Search Results as a “.txt” File[...]

10. Record: User and Service 129 AirLive IAR-5000 User ’ s Manual 10.7 Telnet Search Sessions Est ablished via TELNET :  Records are available if searched by cr iteria, such as user name, host name, session direction and date, as keyword or pattern.  Under System Æ Settings , tick Enable email notification and configure it s related settin[...]

10. Record: User and Service AirLive IAR-5000 User ’ s Manual 130 Figure 10-34 Th e Search Results of TELNET Attached to an Email Figure 10-35 Th e Search Results of TELNET Click on the detail symbol "©" to view the capt ured image of a TELNET session.[...]

10. Record: User and Service 131 AirLive IAR-5000 User ’ s Manual Figure 10-36 Dow nloading the Search Results as a “.txt” File 10.8 Custom Log  The recording of a user ’s online activiti es via SMTP , POP3/ IMAP , HTTP , IM (MSN, Y ahoo Messenger , QQ, ICQ, AIM, Skype, Gadu-Gadu), Web SMTP , Web POP3, FTP and T elnet for a specified dat[...]

10. Record: User and Service AirLive IAR-5000 User ’ s Manual 132 Figure 10-37 Custom Lo g Figure 10-38 Search ing for Specific Records[...]

10. Record: User and Service 133 AirLive IAR-5000 User ’ s Manual Figure 10-39 Recei ving the Searching Results Figure 10-40 Custom Sear ching Results[...]

10. Record: User and Service AirLive IAR-5000 User ’ s Manual 134 Figure 10-41 Dow nloading the Records[...]

1 1. Record: Access Record 135 AirLive IAR-5000 User ’ s Manual 11.1 Accessing Emails Sent via SMTP Protocol Navigate to Record Æ Service Æ SMTP to obtain the det ails of user ’s using SMTP protocol.  T o view an archived email, click on the desirable email subject. (Figure 1 1-1)  Then it displays the content of the email. (Figure 1 1-[...]

1 1. Record: Access Record AirLive IAR-5000 User ’ s Manual 136 Figure 1 1-2 An Archived Email This window offers users not only a vi ew of email content but also the function to forward the email or to save the attachment. Figure 1 1-3 Configuring to Retriev e the Archived Email[...]

1 1. Record: Access Record 137 AirLive IAR-5000 User ’ s Manual Figure 1 1-4 Confirming to Remo ve the Selected Email Figure 1 1-5 Confirming the date of log del etion ranges T o import emails from MS Outlook (including Outlook Express) or other email applications:  Click on to import the emails. (Figure 1 1-6)  In the Email Import Settings[...]

1 1. Record: Access Record AirLive IAR-5000 User ’ s Manual 138 Figure 1 1-7 Importing a Messages File Figure 1 1-8 Imported Email Messages Figure 1 1-9 Reading the Impo rted Email[...]

1 1. Record: Access Record 139 AirLive IAR-5000 User ’ s Manual 11.2 Accessing Emails Sent via POP3/IMAP Protocol Navigate to Record Æ Service Æ POP3/IMAP to obtain the det ails of user ’s using POP3/IMAP protocol.  T o view an archived email, click on the desirable email subject. (Figure 1 1-10)  Then it displays the content of the ema[...]

1 1. Record: Access Record AirLive IAR-5000 User ’ s Manual 140 Figure 1 1-1 1 An A rchived Email This window offers users not only a vi ew of email content but also the function to forward the email or to save the attachment. Figure 1 1-12 Configuring to Retrieve the Archived Email[...]

1 1. Record: Access Record 141 AirLive IAR-5000 User ’ s Manual Figure 1 1-13 Confirming to Remove the Selected Email Figure 1 1-14 Confirming the date of log de letion ranges 11.3 Accessing Visited Webpages via HTTP Protocol Navigate to Record Æ Service Æ HTTP to obtain the details of user ’ s using HTTP protocol.  T o view a visited page[...]

1 1. Record: Access Record AirLive IAR-5000 User ’ s Manual 142 Figure 1 1-16 An Archived Page Figure 1 1-17 Confirming to Remove the Selected Page s[...]

1 1. Record: Access Record 143 AirLive IAR-5000 User ’ s Manual Figure 1 1-18 Confirming the date of log de letion ranges 11.4 Accessing Details of an IM Conversation Navigate to Record Æ Service Æ IM to obtain the det ails of user ’s using inst ant messaging applications.  Click on the corresponding total message entries on the right to a[...]

1 1. Record: Access Record AirLive IAR-5000 User ’ s Manual 144 Figure 1 1-20 History Messages Figure 1 1-21 Confirming to Remove the Selected Con versations Figure 1 1-22 Confirming the date of log de letion ranges[...]

1 1. Record: Access Record 145 AirLive IAR-5000 User ’ s Manual Checking Skype voice conversations: 1. The symbol indicates a voice conversation. (Figure 1 1-23) 2. The voice conversation can be played online or downloaded onto a local PC. (Figure 1 1-24, 25) Figure 1 1-23 Skype Voice Con versations Figure 1 1-24 Playing the Voice Co nversation F[...]

1 1. Record: Access Record AirLive IAR-5000 User ’ s Manual 146 11.5 Accessing Emails Sent via Web-Based Email Service Navigate to Record Æ Service Æ W eb SMTP to obt ain the details of user ’s using Web SMTP protocol.  T o view an archived email, click on the desirable email subject. (Figure 1 1-26)  Then it displays the content of the[...]

1 1. Record: Access Record 147 AirLive IAR-5000 User ’ s Manual This window offers users not only a vi ew of email content but also the function to forward the email or to save the attachment. Figure 1 1-28 Confirming to Remove the Selected Email s Figure 1 1-29 Cleaning up A rchived Emails (Web SMTP Logs) 11.6 Accessing Emails Received via Web-B[...]

1 1. Record: Access Record AirLive IAR-5000 User ’ s Manual 148 Figure 1 1-30 Click on the Desirable Email to View Figure 1 1-31 An Archived Email This window offers users not only a vi ew of email content but also the function to forward the email or to save the attachment. The attachment, if any , will not be ar chived, provided that it had not[...]

1 1. Record: Access Record 149 AirLive IAR-5000 User ’ s Manual Figure 1 1-32 Confirming to Remove the Selected Email s Figure 1 1-33 Cleaning up Archived Emails (Web POP3 Logs) 11.7 Accessing Files Transferred via FTP Protocol Navigate to Record Æ Service Æ FTP to obt ain the details of user ’s using FTP protocol.  T o open or download a [...]

1 1. Record: Access Record AirLive IAR-5000 User ’ s Manual 150 Figure 1 1-34 Click on the File Name to Access the File Figure 1 1-35 Saving the Archived File Figure 1 1-36 Confirming to Remove the Selected Files[...]

1 1. Record: Access Record 151 AirLive IAR-5000 User ’ s Manual Figure 1 1-37 Cleaning up A rchived Files (FTP Logs) 11.8 Accessing Details of Sessions Established via TELNET Protocol Navigate to Record Æ Service Æ Te l n e t to obtain the details of user ’s using T elnet protocol.  T o view the details of a session, click on the Det ails [...]

1 1. Record: Access Record AirLive IAR-5000 User ’ s Manual 152 Figure 1 1-39 Session Log Figure 1 1-40 Confirming to Remove the Selected Session Log Figure 1 1-41 Cleaning up Sess ion Logs (TELNET Logs)[...]

12. Content Auditing 153 AirLive IAR-5000 User ’ s Manual Internet services can be regul ated through specifying inspecti on criteria for SMTP, POP3, HTTP, IM, Web SMTP, Web POP3, FTP and TELNET respectively; IAR-5000 allows system administrator to determine whether a service is subject to company policies. Name:  The name for audit rule. Serv[...]

12. Content Auditing AirLive IAR-5000 User ’ s Manual 154 Everyday at 00:30 a.m., the device aut omatically searches for logs of the previous day that meet audit criteria, and then sends a summary report to the designated recipient. Apart from existing criteria, you may use Perl-comp atible regular expressions to search for more det ailed informa[...]

12. Content Auditing 155 AirLive IAR-5000 User ’ s Manual | Matches either the expression before or the expression after the operator . E.g., abc|def matches "abc" or "def". ( ) Allows the regular expression in the pa rentheses to be treated as a single unit. E.g., severity:(1|2) matches the p a ttern severity:1 or severity:2.[...]

12. Content Auditing AirLive IAR-5000 User ’ s Manual 156 Figure 12-2 The A udit Rule Created for SMTP Service Figure 12-3 The A udit Report of SMTP Service Figure 12-4 The A udit Result of SMTP Service Step2. Under Content Auditing Æ Setti ngs , create an audit rule for POP3 service: (Figure 12-5)  Click on New Entry .  T ype “POP3_Audi[...]

12. Content Auditing 157 AirLive IAR-5000 User ’ s Manual  Select “No” for Att achment .  Select “All” for Dep artment / Group .  S pecify a recipient in the Send Audit Report to field.  Click on OK to complete the audit rule. (Figure 12-6)  The device automatically searches for logs according to the criteria and generates [...]

12. Content Auditing AirLive IAR-5000 User ’ s Manual 158 Figure 12-8 The Audit Result of POP3 Service Step3. Under Content Auditing Æ Settings , create an audit rule for HTTP service: (Figure 12-9)  Click on New Entry .  T ype “HTTP_Audit” in the Name field.  Select “HTTP” for Service .  T ype “(yahoo|google).com” in the[...]

12. Content Auditing 159 AirLive IAR-5000 User ’ s Manual Figure 12-1 1 The Audit Report of HTTP Ser vice Figure 12-12 The A udit Result of HTTP Service Step4. Under Content Auditing Æ Settings , create an audit rule for IM service: (Figure 12-13)  Click on New Entry .  T ype “IM_Audit” in the Name field.  Select “IM” for Servic[...]

12. Content Auditing AirLive IAR-5000 User ’ s Manual 160  Select “All” for Dep artment / Group .  S pecify a recipient in the Send Audit Report to field.  Click on OK to complete the audit rule. (Figure 12-14)  The device automatically searches for logs according to the criteria and generates a corresponding report. Designated re[...]

12. Content Auditing 161 AirLive IAR-5000 User ’ s Manual Figure 12-16 The A udit Result of IM Serv ice Step5. Under Content Auditing Æ Settings , create an audit rule for Web SMTP service: (Figure 12-17)  Click on New Entry .  T ype “WebSMTP_Audit” in the Name field.  Select “W eb SMTP” for Service .  T ype “[A-Z][0-9]” [...]

12. Content Auditing AirLive IAR-5000 User ’ s Manual 162 Figure 12-19 The A udit Report of Web SMTP Service Figure 12-20 The A udit Result of Web SMTP Se rvice Step6. Under Content Auditing Æ Settings , create an audit rule for Web POP3 service: (Figure 12-21)  Click on New Entry .  T ype “WebPOP3_Audit” in the Name field.  Select [...]

12. Content Auditing 163 AirLive IAR-5000 User ’ s Manual  Select “No” for Att achment .  Select “All” for Dep artment / Group .  S pecify a recipient in the Send Audit Report to field.  Click on OK to complete the audit rule. (Figure 12-22)  The device automatically searches for logs according to the criteria and generates[...]

12. Content Auditing AirLive IAR-5000 User ’ s Manual 164 Figure 12-23 The A udit Report of Web POP3 Serv ice Figure 12-24 The A udit Result of Web POP3 Serv ice Step7. Under Content Auditing Æ Settings , create an audit rule for FTP serv ice: (Figure 12-25)  Click on New Entry .  T ype “FTP_Audit” in the Name field.  Select “FTP?[...]

12. Content Auditing 165 AirLive IAR-5000 User ’ s Manual Figure 12-25 Creating an Audit Rule for FTP Serv ice Figure 12-26 The A udit Rule Created for FTP Serv ice Figure 12-27 The A udit Report of FTP Service[...]

12. Content Auditing AirLive IAR-5000 User ’ s Manual 166 Figure 12-28 The A udit Report of FTP Service Step8. Under Content Auditing Æ Settings , create an audit rule for TELNET service: (Figure 12-29)  Click on New Entry .  T ype “T elnet_Audit” in the Name field.  Select “TELNET” for Service .  Select “All” for Dep art[...]

12. Content Auditing 167 AirLive IAR-5000 User ’ s Manual Figure 12-31 The A udit Report of TELNET Service Figure 12-32 The A udit Report of TELNET Service[...]

13. Anom aly Flow IP AirLive IAR-5000 User ’ s Manual 168 When the corporate network is under an attack (w hich causes excessive network traffic), IAR-5000 will take action to against it. Besides, by joining forces with an IDP-enabled switch, you can defend various threats from the Internet, avoiding losing revenue opportunities as a result of th[...]

13. Anom aly Flow IP 169 AirLive IAR-5000 User ’ s Manual Figure 13-1 Anomaly Flow IP Settings T o block intrusion packets, enable co-defense system to notify the designated switch to act against the attack. Safe IP Addresses can be used for excluding specific IP fro m detection. Step2. When a DDoS attack occurs, IAR-5000 will warn about the anom[...]

13. Anom aly Flow IP AirLive IAR-5000 User ’ s Manual 170 Figure 13-3 NetBIOS Broadcast Shown to the Victim User Figure 13-4 NetBIOS Broadcast Shown to the System Admini strator Step3. The figure below shows the system administr ator receives the alert notification through an email message. (Figure 13-5)[...]

13. Anom aly Flow IP 171 AirLive IAR-5000 User ’ s Manual Figure 13-5 The Alert Notification Sent through an Email Message Step4. When a DDoS attack occurs, IAR-5000 will warn about the anomaly flow under Anomaly Flow IP Æ Intrusion IP or alert the intruder and the system administrator about it through a NetB IOS broadcast. (Figure 13-6,7, 8) Fi[...]

13. Anom aly Flow IP AirLive IAR-5000 User ’ s Manual 172 Figure 13-7 A NetBIOS Broad cast Shown to the Intrud er Figure 13-8 A NetBIOS Broadcast Sh own to the System Administrator Step5. The figure below shows the system administr ator receives the alert notification through an email message. (Figure 13-9)[...]

13. Anom aly Flow IP 173 AirLive IAR-5000 User ’ s Manual Figure 13-9 The Alert Notification Sent through an Email Message[...]

14. Local Disk AirLive IAR-5000 User ’ s Manual 174 The records of online activities ar e stored in the built-in hard disk. Local Disk has a utilization summary of each service accordi ng to which system administrator may decide the storage time for records of every kind separatel y. This helps optimize the use of built-in hard disk, avoiding ins[...]

14. Local Disk 175 AirLive IAR-5000 User ’ s Manual Configuring the Storage T i me Based on the T raffic of Each Service: Navigate to Local Disk Æ Sto r ag e Ti m e and then configure accordingly . (Figure 14-1) 14-1 Configuring the Storage Time for Each Serv ice 14.2 Disk Space Hard Disk Utilization:  The indicative bar uses dif ferent color[...]

14. Local Disk AirLive IAR-5000 User ’ s Manual 176 V iew ing the Used Storage S p ace a nd T op 10 Users of Each Service: Under Local Disk Æ Disk Sp ace , there it shows the details of built-in hard disk usage. (Figure 14-2) 14-2 Viewing the Details o f Hard Disk Usage[...]

15. Remote Backup 177 AirLive IAR-5000 User ’ s Manual Running a storage is always a disaster espec ially when calling fo r archiving valuable information for a long-term storage. Accordingly, IAR-5000 features Remote Backup which helps resolve the storage quandary by periodically duplicating on line activity records to a remote storage device, s[...]

15. Remote Backup AirLive IAR-5000 User ’ s Manual 178 15-1 Backup Settings[...]

15. Remote Backup 179 AirLive IAR-5000 User ’ s Manual Step2. View the storage location and ut ilization: (Figure 15-2) 15-2 Viewing the Utilization of Backup Storage[...]

15. Remote Backup AirLive IAR-5000 User ’ s Manual 180 System administrator may backup logs of a specific period of time. (Figure 15-3) 15-3 Immediate Backup Settings 15.2 Browse Settings Connection St atus of Backup Storage Device:  Displays the status of the connection to the remote storage, and the access privilege (e.g., read / write) of b[...]

15. Remote Backup 181 AirLive IAR-5000 User ’ s Manual Configuring IAR-5000 to Ga in Access to Archives: Step1. Navigate to Remote Backup Æ Settings Æ Browse Settings , and then configure as below: (Figure 15-4) 15-4 Browse Settin gs Step2. View the connection st atus and the access privilege of remote storage. (Figure 15-5) 15-5 Viewing the Co[...]

16. Reporting AirLive IAR-5000 User ’ s Manual 182 Reporting delivers system administrat or a quick insight to network traffic and storage space utilization with graphical c harts, enhancing the management on a corporate network. In this chapter, it will be discussing the functionality and application of Reporting . Periodic Report Scheduling Set[...]

16. Reporting 183 AirLive IAR-5000 User ’ s Manual 16-1 Periodic Report Scheduling Se ttings 16-2 Daily Report Sent thro ugh an Email Message[...]

16. Reporting AirLive IAR-5000 User ’ s Manual 184 16-3 Daily Report[...]

16. Reporting 185 AirLive IAR-5000 User ’ s Manual 16-4 History Report Retrie ving Settings 16-5 Weekly History Report Sent th rough an Email Message[...]

16. Reporting AirLive IAR-5000 User ’ s Manual 186 16-6 Weekly Report[...]

16. Reporting 187 AirLive IAR-5000 User ’ s Manual Step1. Under Reporting Æ Storage Report , bar chart s indicate the disk space utilization of each service. Step2. In the upper left corner , click on a time unit from which the bar charts are derived. Click on Day for bar chart s derived from daily operation; click on Wee k for bar charts derive[...]

17. St atus AirLive IAR-5000 User ’ s Manual 188 Status presents system administrat or with the system performance, authentication, current sessions and event logs. 17.1 System Info System Info:  The usage of CPU, hard disk, memory a nd RAM d isk are illustrated separately in different histogram s. (Figure 17-1) Under Stat us Æ System Info , [...]

17. St atus 189 AirLive IAR-5000 User ’ s Manual 17-1 System Info[...]

17. St atus AirLive IAR-5000 User ’ s Manual 190 17.2 Authentication Authentication:  The related information of User A uthentication, such as client’s IP address, login name, login time, and the remove se lection for administrator . 17-2 Authentication Info 17.3 Current Session Current Session:  Shows the traffic and amount of sessions c[...]

17. St atus 191 AirLive IAR-5000 User ’ s Manual Step1. Under Stat us Æ Current Session , there it shows the sessions created by each service. (Figure 17-4) 17-4 Current Sessions – Overall Information Step2. Click on To t a l to view the used port number and traffic of each service session. (Figure 17-5) 17-4 Current Sessions – Specific Deta[...]

17. St atus AirLive IAR-5000 User ’ s Manual 192 17-6 Searching for a Specific Log 17.5 Even Log Event Log:  Records all modifications on IAR- 5000, such as deleting a setting. Search Event Logs:  Records are available if s earched by criteria, such as event and date, as keyword or pattern.  Refer to the steps below to st art a search: 1[...]

17. St atus 193 AirLive IAR-5000 User ’ s Manual 17-7 Searching for a Specific Event 17-8 Downloadin g the Search Result[...]

17. St atus AirLive IAR-5000 User ’ s Manual 194 17-9 Details of an Event Log[...]

18. Specifications 195 AirLive IAR-5000 User ’ s Manual The specification of IAR-5000 is subject to change without notice. Please use the information with caution. Category Configuration Name Function Chapter Admin Used for creating and modifying system administration accounts. Interface Used for setting the interface’ s IP address, subnet mask[...]

18. Specifications AirLive IAR-5000 User ’ s Manual 196 Auth User S pecifies the authentication name accounts. RADIUS Used for enabling a Radius server to manage authentication. POP3 Used for enabling a POP3 server to enable authentication. LDAP Used for enabling an LDAP server to manage authentication. Settings Settings Provides settings for: si[...]

18. Specifications 197 AirLive IAR-5000 User ’ s Manual S torage T ime Provides individual storage time settings for each of the recorded services based upon their importance. Local Disk Disk S pace Provides hard disk utilization statistics based upon the service, user and group. 14 Backup Settings Settings Browse Settings SMTP POP3 / IMAP HTTP I[...]