User Guide: AMF Security version 2.4.0 for VST-VRT

# Controlling Devices with AMF Application Proxy

Configuring AMF Application Proxy
Configuration
Information on each product
Configuring AMF Master
Configuring AMF Members
Configuring AR Router
Configuring AT-VST-VRT
Configuring AMF Security
AMF Master Configuration
AMF Member Configuration
AR Router Configuration
Configuration example using Tag
AMF Master, AMF Member, AR Router, AT-VST-VRT setting procedure
Configuring AMF Security

## Configuring AMF Application Proxy

In this section, this is an example of setting the AMF Application Pproxy.
In this section, this is an example of setting the AW+ AMF Application Proxy Whitelist and AMF Application Proxy Blacklist.
Applications linked with the AMF Application Proxy Blacklist use the UTM (Unified Threat Management) related functions of the AT-AR3050S/AR4050S of the AR router, and set the action to drop packets.

> Note

> > A separate license is required to use each function. Required licenses differ depending on the product, so check our website.

> Note

> > Refer to Appendix/Configuring AT-AR3050S/AT-AR4050S for the AR router UTM-related functions that can be linked with AMF Security.

> Note

> > In order to keep the recording date and time of logs etc. accurate and to operate various functions properly, it is recommended to set the system time of each product accurately.
> > AMF Security obtains and uses the AT-VST-VRT system time. The AMF Security timezone is set in AMF Security, but the NTP synchronization destination is set in AT-VST-VRT.

### Configuration

This setting example assumes the following configuration.

> Note

> > AT-Vista Manager EX (including Plug-ins) of AT-VST-VRT is not explained in this setting example. Refer to the AT-Vista Manager EX document for settings.

> Note

> > The AMF Master in this configuration uses a separate device instead of the AMF Cloud on AT-VST-VRT, but you can also use the AMF Cloud on AT-VST-VRT.

> Note

> > For details on AT-VST-VRT basic settings (IP Address, static route settings, etc.), refer to the AT-VST-VRT document posted on our website.

> Note

> > For details on AMF Security basic settings (application settings) performed with AT-VST-VRT, refer to the AT-VST-VRT document posted on our website.

### Information on each product

◼ AMF Master Configuration

Table 1: Sample Configuration Data
Item Name | Value
--- | ---
Username | manager
Password | friend
Hostname | AMF-Master
AMF Network Name | AMF001
IP Address | 192.168.1.254
AMF Security IP Address | 192.168.1.10
Pre-shared key (between AMF Security and AMF Master) | password

◼ AMF Member Configuration

Table 2: Sample Configuration Data
Item Name | Value
--- | ---
Username | manager
Password | friend
Hostname | AMF-Member
AMF Network Name | AMF001
AMF Actions | Drop Packets

◼ AT-AR4050S information

Table 3: AT-AR4050S Information
Item Name | Information
--- | ---
Username | manager
Password | friend
Hostname | awplus-UTM-Router
AMF Network Name | AMF001
Username for ISP connection | user@isp
Password for ISP connection | isppasswd
PPPoE service name | unspecified
WAN IP Address | Dynamic allocation (IPCP)
DNS server | Automatic acquisition (IPCP)
Log output destination for UTM-related functions | 192.168.1.10
Source IPv4 Address when sending syslog messages | IP Address of vlan1 interface (192.168.1.1)

> Note

> > When linking the UTM-related functions of the AR Router with AMF Security, the host name of the AR Router must start with "awplus".

◼ AT-VST-VRT information

Table 4: AT-VST-VRT Information
Item Name | Information
--- | ---
IP Address | 192.168.1.100
Static route (Gateway) | 192.168.1.254

◼ AMF Security Information

Table 5: AMF Security Information
Item Name | Information
--- | ---
IPv4 address | 192.168.1.10
AMF Master IP Address | 192.168.1.254
AMF Master Username | manager
AMF Master Password | friend
Pre-shared key (between AMF Security and AMF Master) | password

> Note

> > In this setting example, the AMF Master account (Username and Password) uses the default “manager and friend”. However, it is recommended that you create a user account with a privilege level of 15 on AMF Master and AMF Member and separate it from the user account used for console connection.

◼ Device (terminal) authentication information to be registered with AMF Security

Table 6: Device (terminal) authentication information to be registered with AMF Security
Terminal 1
Item Name | Information
--- | ---
Device ID | Device1
MAC Address | 00:00:00:00:00:01
Network (VLAN) | VLAN100
Terminal 2
Item Name | Information
Device ID | Device2
MAC Address | 00:00:00:00:00:02
Network (VLAN) | VLAN101

### Configuring AMF Master

> Note

> > Depending on the product, some features that are enabled during the procedure are enabled by default.

1. Disable Spanning Tree Protocol (RSTP), which is enabled by default.
   awplus(config)# no spanning-tree rstp enable ↓
2. Set the time zone to Japan Standard Time.
   awplus(config)# clock timezone JST plus 9:00 ↓
3. Configure the hostname.
   awplus(config)# hostname AMF-Master ↓
4. Configure the AMF network name.
   AMF-Master(config)# atmf network-name AMF001 ↓
5. Enable AMF Master functionality.
   AMF-Master(config)# atmf master ↓
6. Enable AMF Application Proxy.
   AMF-Master(config)# service atmf-application-proxy ↓
7. Enable web server function.
   AMF-Master(config)# service http ↓
8. Enable GUI support function for AMF Security.
   AMF-Master(config)# atmf topology-gui enable ↓
9. Set the IP Address and pre-shared key of AMF Security linked with the AMF Application Proxy Whitelist.
   AMF-Master(config)# application-proxy whitelist server 192.168.1.10 key password ↓
10. Create the following VLANs.
    - vlan10 connecting with AMF Member
    - vlan100 and vlan101 used for terminal packet transfer
    AMF-Master(config)# vlan database ↓
    AMF-Master(config-vlan)# vlan 10,100-101 ↓
11. Set IP Addresses for the following VLANs.
    - vlan1 connected with AR Router
    - vlan10 connecting with AMF Member
    - vlan100 and vlan101 connected with terminal
    AMF-Master(config-vlan)# interface vlan1 ↓
    AMF-Master(config-if)# ip address 192.168.1.254/24 ↓
    ↓
    AMF-Master(config-if)# interface vlan10 ↓
    AMF-Master(config-if)# ip address 192.168.10.254/24 ↓
    ↓
    AMF-Master(config-if)# interface vlan100 ↓
    AMF-Master(config-if)# ip address 192.168.100.254/24 ↓
    ↓
    AMF-Master(config-if)# interface vlan101 ↓
    AMF-Master(config-if)# ip address 192.168.101.254/24 ↓
    Assign the VLANs to a port and configure it as an AMF link to the AR Router.
    AMF-Master(config-if)# interface port1.0.1 ↓
    AMF-Master(config-if)# switchport mode trunk ↓
    AMF-Master(config-if)# switchport trunk allowed vlan add 1 ↓
    AMF-Master(config-if)# switchport atmf-link ↓

    > Note

    > > When the above settings are made, the following is automatically set.
    > > switchport trunk native vlan none

12. Assign the VLANs to a port1.0.3 and configure it as an AMF link to the AMF Member.
    AMF-Master(config-if)# interface port1.0.3 ↓
    AMF-Master(config-if)# switchport mode trunk ↓
    AMF-Master(config-if)# switchport trunk allowed vlan add 10,100-101 ↓
    AMF-Master(config-if)# switchport atmf-link ↓
13. Set the default route.
    AMF-Master(config)# ip route 0.0.0.0/0 192.168.1.1 ↓

AMF Master configuration is done.
To save the current settings as a startup-config, do the following:

AMF-Master(config)# end ↓
AMF-Master# copy running-config startup-config ↓

### Configuring AMF Members

> Note

> > Depending on the product, some features that are enabled during the procedure are enabled by default.

1. Disable Spanning Tree Protocol (RSTP), which is enabled by default.
   awplus(config)# no spanning-tree rstp enable ↓
2. Set the time zone to Japan Standard Time.
   awplus(config)# clock timezone JST plus 9:00 ↓
3. Configure the hostname.
   awplus(config)# hostname AMF-Member ↓
4. Configure the AMF network name.
   AMF-Member(config)# atmf network-name AMF001 ↓
5. Enable AMF Application Proxy.
   AMF-Member(config)# service atmf-application-proxy ↓
6. Enable web server function.
   AMF-Member(config)# service http ↓
7. Create the following VLANs.
   - vlan10 connecting with AMF Master
   - vlan100 and vlan101 used for terminal packet transfer
   AMF-Member(config)# vlan database ↓
   AMF-Member(config-vlan)# vlan 10,100-101 ↓
8. Set IP Addresses for the following VLANs.
   - vlan10 connecting with AMF Master
   AMF-Member(config-vlan)# interface vlan10 ↓
   AMF-Member(config-if)# ip address 192.168.10.10/24 ↓
9. Set the default route.
   AMF-Member(config-if)# ip route 0.0.0.0/0 192.168.10.254 ↓
10. Assign the VLANs to a port1.0.1 and configure it as an AMF link to the AMF Master.
    AMF-Member(config)# interface port1.0.1 ↓
    AMF-Member(config-if)# switchport mode trunk ↓
    AMF-Member(config-if)# switchport trunk allowed vlan add 10,100-101 ↓
    AMF-Member(config-if)# switchport atmf-link ↓
11. Configure the AMF Application Proxy Whitelist on the port that the terminal connects to.
    AMF-Member(config-if)# interface port1.0.2-1.0.3 ↓
12. Disable ingress filtering so that after the terminal authenticates, it can move to another port and authenticate again.
    AMF-Member(config-if)# switchport mode access ingress-filter disable ↓

    > Note

    > > If the terminal may move to another port, this setting must be performed for all ports involved in terminal movement. When ingress filtering is enabled, terminal information remains on the port before movement, so authentication cannot be received on the destination port.

13. Enable the AMF Application Proxy Whitelist on the port that the terminal connects to.
    AMF-Member(config-if)# application-proxy whitelist enable ↓

    > Note

    > > For the target port, the default setting of the authentication suppression period (quietPeriod) after authentication failure is 60 seconds. To shorten the authentication suppression period, use the "auth timeout quiet-period" command.

    > Note

    > > Terminals that have not been assigned a VLAN by AMF Security use the VLAN set for the port (vlan1 by default).

14. Enable session timeout for the AMF Application Proxy Whitelist on the port that the terminal connects to.
    With the session timeout enabled, authentication state for a device is deleted when the time configured on the AMF > AMF Application Proxy Settings page has passed after the device was successfully authenticated.
    When the session timeout is set to 0, authentication state of a device is not deleted due to the time passed since a successful authentication.
    AMF-Member(config-if)# auth session-timeout ↓

    > Note

    > > Make sure to configure the session timeout when you are going to use schedule-based authentication.

15. Change the authentication operation mode to Multi-Supplicant mode on the port that the terminal connects to.
    AMF-Member(config-if)# auth host-mode multi-supplicant ↓
    When the device ports are in the default "Single-Host" mode, only the first authenticated device is allowed.
16. Enable dynamic VLAN on the port that the terminal connects to.
    AMF-Member(config-if)# auth dynamic-vlan-creation type multi ↓
    When dynamic vlan is not enabled, a vlan configured on the device ports is used for authenticated devices even if AMF Security assigned a specific vlan to each device.
17. Set the action to drop packets when blocking a terminal with the AMF Application Proxy.
    AMF-Member(config-if)# application-proxy threat-protection drop ↓

AMF Member configuration is done.
To save the current settings as a startup-config, do the following:

AMF-Member(config-if)# end ↓
AMF-Member# copy running-config startup-config ↓

### Configuring AR Router

> Note

> > Depending on the product, some features that are enabled during the procedure are enabled by default.

1. Disable Spanning Tree Protocol (RSTP), which is enabled by default on the LAN port.
   awplus(config)# no spanning-tree rstp enable ↓
2. Set the time zone to Japan Standard Time.
   awplus(config)# clock timezone JST plus 9:00 ↓
3. Configure the hostname.
   When linking the UTM-related functions of the AR Router with AMF Security, the host name of the AR Router must start with "awplus".
   awplus(config)# hostname awplus-UTM-Router ↓
4. Configure the AMF network name.
   awplus-UTM-Router(config)# atmf network-name AMF001 ↓
5. Enable AMF Application Proxy.
   awplus-UTM-Router(config)# service atmf-application-proxy ↓
6. Enable web server function.
   awplus-UTM-Router(config)# service http ↓
7. Create PPPoE interface ppp0 on WAN port eth1.
   awplus-UTM-Router(config)# interface eth1 ↓
   awplus-UTM-Router(config-if)# encapsulation ppp 0 ↓
8. Configure settings for PPPoE connection for PPP interface ppp0.
   - Request to get DNS server address by IPCP (ppp ipcp dns)
   - Checking PPP connection status by LCP Echo (keepalive)
   - Request to obtain IP address by IPCP (ip address negotiated)
   - Username (ppp username)
   - Password (ppp password)
   - MSS rewrite (ip tcp adjust-mss)
   awplus-UTM-Router(config-if)# interface ppp0 ↓
   awplus-UTM-Router(config-if)# ppp ipcp dns request ↓
   awplus-UTM-Router(config-if)# keepalive ↓
   awplus-UTM-Router(config-if)# ip address negotiated ↓
   awplus-UTM-Router(config-if)# ppp username user@isp ↓
   awplus-UTM-Router(config-if)# ppp password isppasswd ↓
   awplus-UTM-Router(config-if)# ip tcp adjust-mss pmtu ↓
9. Set the IP Address for the LAN side interface.
   awplus-UTM-Router(config-if)# interface vlan1 ↓
   awplus-UTM-Router(config-if)# ip address 192.168.1.1/24 ↓
10. Configure Firewall, IP Reputation and Malware Protection logging and sending the log messages to AMF Security (192.168.1.10).
    Use the log command for this.
    awplus-UTM-Router(config-if)# log host 192.168.1.10 ↓
    awplus-UTM-Router(config)# log host 192.168.1.10 level informational facility local5 ↓
11. Assign the VLANs to a port1.0.1 and configure it as an AMF link to the AMF Master.
    awplus-UTM-Router(config)# interface port1.0.1 ↓
    awplus-UTM-Router(config-if)# switchport mode trunk ↓
    awplus-UTM-Router(config-if)# switchport trunk allowed vlan add 1 ↓
    awplus-UTM-Router(config-if)# switchport atmf-link ↓

    > Note

    > > When the above settings are made, the following is automatically set.
    > > switchport trunk native vlan none

12. Configure settings for the IP reputation (IP address blacklist) function.
    In order to link the IP reputation function and AMF Security, it is necessary to set the action for the categories that can be linked to "deny". Note that the default "alert" does not work.
    awplus-UTM-Router(config-if)# ip-reputation ↓
    awplus-UTM-Router(config-ip-reputation)# provider proofpoint ↓
    awplus-UTM-Router(config-ip-reputation)# category CnC action deny ↓
    awplus-UTM-Router(config-ip-reputation)# category Mobile_CnC action deny ↓
    awplus-UTM-Router(config-ip-reputation)# category Bot action deny ↓
    awplus-UTM-Router(config-ip-reputation)# category SpywareCnC action deny ↓
    awplus-UTM-Router(config-ip-reputation)# category Mobile_Spyware_CnC action deny ↓
    awplus-UTM-Router(config-ip-reputation)# category Drop action deny ↓
    awplus-UTM-Router(config-ip-reputation)# protect ↓
13. Configure settings for the malware protection (stream type antivirus) function.
    awplus-UTM-Router(config-ip-reputation)# malware-protection ↓
    awplus-UTM-Router(config-malware)# provider kaspersky ↓
    awplus-UTM-Router(config-malware)# protect ↓
14. Defines the entity (communication subject) used when creating firewall and NAT rules.
    Create a zone 'private' to represent the internal network.
    awplus-UTM-Router(config-malware)# zone private ↓
    awplus-UTM-Router(config-zone)# network lan ↓
    awplus-UTM-Router(config-network)# ip subnet 192.168.1.0/24 ↓
    awplus-UTM-Router(config-network)# ip subnet 192.168.10.0/24 ↓
    awplus-UTM-Router(config-network)# ip subnet 192.168.100.0/24 ↓
    awplus-UTM-Router(config-network)# ip subnet 192.168.101.0/24 ↓
    Create a zone "public" to represent the external network.
    awplus-UTM-Router(config-network)# zone public ↓
    awplus-UTM-Router(config-zone)# network wan ↓
    awplus-UTM-Router(config-network)# ip subnet 0.0.0.0/0 interface ppp0 ↓
    awplus-UTM-Router(config-network)# host ppp0 ↓
    awplus-UTM-Router(config-host)# ip address dynamic interface ppp0 ↓
15. Set up the firewall function to block communication from the outside while allowing communication from the inside to occur freely.
    - rule 10 - Allow communication between internal networks
    - rule 20 - Allow communication from internal network to external
    - rule 30 - Allow DNS communication from the WAN side interface of the AR Router to the outside for database updates and inquiries for each UTM function
    - rule 40 - Allow HTTPS communication from the WAN side interface of the AR Router to the outside for updating the database of each UTM function
    awplus-UTM-Router(config-host)# firewall ↓
    awplus-UTM-Router(config-firewall)# rule 10 permit any from private.lan to private.lan ↓
    awplus-UTM-Router(config-firewall)# rule 20 permit any from private.lan to public ↓
    awplus-UTM-Router(config-firewall)# rule 30 permit dns from public.wan.ppp0 to public.wan ↓
    awplus-UTM-Router(config-firewall)# rule 40 permit https from public.wan.ppp0 to public.wan ↓
    awplus-UTM-Router(config-firewall)# protect ↓
16. Set all computers connected to the LAN side network to use the dynamic ENAT function.
    awplus-UTM-Router(config-firewall)# nat ↓
    awplus-UTM-Router(config-nat)# rule 10 masq any from private to public ↓
    awplus-UTM-Router(config-nat)# enable ↓
17. Enable DNS relay function.
    awplus-UTM-Router(config-nat)# ip dns forwarding ↓
18. Set IP route information as static.
    - LAN side (192.168.100.0/24, 192.168.101.0/24) via AMF Master (192.168.1.254)
    - Others (0.0.0.0/0) via ppp0 (default route)
    awplus-UTM-Router(config)# ip route 192.168.100.0/24 192.168.1.254 ↓
    awplus-UTM-Router(config)# ip route 192.168.101.0/24 192.168.1.254 ↓
    awplus-UTM-Router(config)# ip route 0.0.0.0/0 ppp0 ↓

AR Router Configuration is done.
To save the current settings as a startup-config, do the following:

awplus-UTM-Router(config)# end ↓
awplus-UTM-Router# copy running-config startup-config ↓

### Configuring AT-VST-VRT

For details on AT-VST-VRT basic settings (IP Address, static route settings, etc.), refer to the AT-VST-VRT document posted on our website.

- Access to AT-VST-VRT setting page
  Accessing Management Interface / Starting Configuration
- AT-VST-VRT interface IP Address setting
  Network Settings / Interface Settings
- AT-VST-VRT static route (Gateway) settings
  Network Settings / Static route
- AT-VST-VRT system time, NTP synchronization destination settings
  System / Day and Time

### Configuring AMF Security

Refer to the following for the basic settings of AMF Security.

- Setting AMF Security in AT-VST-VRT
  Refer to the AT-VST-VRT document
- Initial setting of AMF Security
  Accessing Management Interface/Starting Configuration > Preparing for Configuration

1. Open the AMF > AMF Application Proxy Settings page, register the AMF Master.

2. Click the AMF Master "Add" button to open the AMF > Edit AMF Master dialog.

3. Enter the AMF Master's IP Address, Username, Password and Pre-Shared Key.

   Configure the settings shown in the following table:

   Table 7: Configurable fields
   Item Name | Value
   --- | ---
   IPv4 Address | 192.168.1.254
   Username | manager
   Password | friend
   Pre-Shared Key | password

4. Click the "Submit" button, then click the "OK" button.
   You can view the registered AMF Master on the AMF > AMF Application Proxy Settings page.

   > Note

   > > If IP communication between AMF Security and AMF Master is not established, or if the AMF Master and AMF Member settings are insufficient, the connection status display is "Error". In this case, check the communication path, AMF Master, and AMF Member settings again.

5. Register the network to which the terminal is connected.
   Networks can be registered on the Policy Settings > Network List page. Open the Policy Settings > Network List page.

6. Click the "Add Network" button at the top right corner to move to the Policy Settings > Add Network page.

7. Enter information for the network to add.

   Configure the settings shown in the following table:

   Table 8: Configurable fields
   Item Name | Value
   --- | ---
   Network ID | VLAN100
   VLAN ID | 100
   Note | (empty)

8. Click the "Submit" button.
   Once the network is registered, the added information is displayed on the Policy Settings > Network List page.

9. Register another network using the same procedure as steps 6 to 8.
   Configure the settings shown in the following table:

   Table 9: Configurable fields
   Item Name | Value
   --- | ---
   Network ID | VLAN101
   VLAN ID | 101
   Note | (empty)

10. Register the Device ID (Device).
    Devices can be registered on the Device > Add Device page. Open the Deice > Device List page.

11. Click the "Add Device" button at the top right corner to move to the Device > Add Device page.
    On this page, register the device ID, interface, and policy of the new device.

12. Enter information about the new device.

    Configure the settings shown in the following table:

    Table 10: Configurable fields
    Item Name | Value
    --- | ---
    Device ID | Device1
    Tag | (empty)
    Note | (empty)

13. Next, you have to enter the interface MAC Address of the device.
    Click the "Add" button next to "Interfaces" to open the Device > Edit Interface dialog.

14. Register the MAC Address of the "Device1" terminal.

    Configure the settings shown in the following table:

    Table 11: Configurable fields
    Item Name | Value
    --- | ---
    MAC Address | 00:00:00:00:00:01
    Name | (empty)
    Note | (empty)

15. Click the "Submit" button.
    "Interfaces" section of the Device > Add Device page now shows the interface MAC Address which you just entered.

16. Click the "Add" button next to "Policies" to open the Device > Edit Policy dialog.

17. Enter information for the policy.

    Configure the settings shown in the following table:

    Table 12: Configurable fields
    Item Name | Value
    --- | ---
    Priority | 10
    Network | VLAN100
    Location | (empty)
    Schedule | (empty)

18. Click the "Submit" button.
    "Policies" section of the Device > Add Device page shows the security policy which you just added.

19. Click the "Submit" button.
    Once the device is added, the Device > Device List page reflects the updated information.

20. Register the "Device ID" of "Device2" using the same procedure as steps 11 to 19.

    Table 13: Configurable fields
    Item Name | Value
    --- | ---
    Device ID | Device2
    Tag | (empty)
    Note | (empty)
    Interfaces
    MAC Address | 00:00:00:00:00:02
    Name | (empty)
    Note | (empty)
    Policies
    Priority | 10
    Network | VLAN101
    Location | (empty)
    Schedule | (empty)

    - Device > Add Device page

    - Device > Device List page

21. Configure trap monitoring settings so that automatic response operations are performed based on the threat information logs detected and sent by the UTM-related functions of the AR Router.
    Open the System Settings > Trap Monitor Settings page.
    On this page, set "Rules".

22. Enter "Rules".

    Configure the settings shown in the following table:
    - Check the checkbox for "Enable the monitoring of traps from this host."
    - Enter the IP Address (192.168.1.1) of the AR Router in "Host Addresses" (only receive notifications from the set IP Address)
    - Select "AMF Dependency" for "AMF Action" (the action set on the switch side is applied)
    - Check all checkboxes for "Trap Action Target List" table.
23. Click the "Submit" button, then click the "OK" button.

AMF Security configuration is done.
For terminals connected to AMF members, AMF Security authenticates based on the registered authentication information.
You can view the authentication results on the Device > Active Device List page.

When a terminal is detected by the UTM-related functions of the AR Router, information about the suspected device is registered on AMF Security and displayed on the Policy Settings > Action List page. At the same time, AMF Security informs the AMF Master of the information of the suspect terminal.

◼ AMF Master

    AMF-Master#show application-proxy threat-protection all

    Quarantine Vlan           : Not set
    Global IP-Filter          : Disabled
    IP-Filter Limit Exceeded  : 0
    Redirect-URL              : Not set

    Client IP        Interface       MAC Address     VLAN      Action
    -----------------------------------------------------------------
    192.168.101.100  -               -               -           none
    AMF-Master#

In this setting example, since the AMF Master operates as an L3 switch, the IP Address and MAC Address of the suspected terminal are linked from the ARP table of the AMF Master itself, and the packet discard action is applied. AMF Members search FDB for MAC addresses of suspected devices and apply actions.
◼ AMF Master

    AMF-Master#show application-proxy threat-protection all

    Quarantine Vlan           : Not set
    Global IP-Filter          : Disabled
    IP-Filter Limit Exceeded  : 0
    Redirect-URL              : Not set

    Client IP        Interface       MAC Address     VLAN      Action
    -----------------------------------------------------------------
    192.168.101.100  -               0000.0000.0002  -           none
    AMF-Master#

◼ AMF Member

    AMF-Member#show application-proxy threat-protection all

    Quarantine Vlan           : Not set
    Global IP-Filter          : Disabled
    IP-Filter Limit Exceeded  : 0
    Redirect-URL              : Not set

    Client IP        Interface       MAC Address     VLAN      Action
    -----------------------------------------------------------------
    192.168.101.100  * (port1.0.3)   0000.0000.0002  101         drop
    AMF-Member#

◼ Policy Settings > Action List page

◼ Device > Active Device List page

Click the "Resume" button and then the "OK" button to release the action.

### AMF Master Configuration

    !
    hostname AMF-Master
    !
    service http
    !
    clock timezone JST plus 9:00
    !
    atmf network-name AMF001
    atmf master
    atmf topology-gui enable
    !
    service atmf-application-proxy
    application-proxy whitelist server 192.168.1.10 key password
    !
    no spanning-tree rstp enable
    !
    vlan database
    vlan 10,100-101 state enable
    !
    interface port1.0.1
    switchport
    switchport mode trunk
    switchport trunk allowed vlan add 1
    switchport trunk native vlan none
    switchport atmf-link
    !
    interface port1.0.3
    switchport
    switchport mode trunk
    switchport trunk allowed vlan add 10,100-101
    switchport atmf-link
    !
    interface vlan1
    ip address 192.168.1.254/24
    !
    interface vlan10
    ip address 192.168.10.254/24
    !
    interface vlan100
    ip address 192.168.100.254/24
    !
    interface vlan101
    ip address 192.168.101.254/24
    !
    ip route 0.0.0.0/0 192.168.1.1
    !
    end

### AMF Member Configuration

    !
    hostname AMF-Member
    !
    service http
    !
    clock timezone JST plus 9:00
    !
    atmf network-name AMF001
    !
    service atmf-application-proxy
    !
    no spanning-tree rstp enable
    !
    vlan database
    vlan 10,100-101 state enable
    !
    interface port1.0.1
    switchport
    switchport mode trunk
    switchport trunk allowed vlan add 10,100-101
    switchport atmf-link
    !
    interface port1.0.2-1.0.3
    switchport
    switchport mode access ingress-filter disable
    application-proxy whitelist enable
    auth session-timeout
    auth host-mode multi-supplicant
    auth dynamic-vlan-creation type multi
    application-proxy threat-protection drop
    !
    interface vlan10
    ip address 192.168.10.10/24
    !
    ip route 0.0.0.0/0 192.168.10.254
    !
    end

### AR Router Configuration

    !
    hostname awplus-UTM-Router
    !
    log host 192.168.1.10
    log host 192.168.1.10 level informational facility local5
    !
    service http
    !
    clock timezone JST plus 9:00
    !
    atmf network-name AMF001
    !
    zone private
    network lan
    ip subnet 192.168.1.0/24
    ip subnet 192.168.10.0/24
    ip subnet 192.168.100.0/24
    ip subnet 192.168.101.0/24
    !
    zone public
    network wan
    ip subnet 0.0.0.0/0 interface ppp0
    host ppp0
    ip address dynamic interface ppp0
    !
    firewall
    rule 10 permit any from private.lan to private.lan
    rule 20 permit any from private.lan to public
    rule 30 permit dns from public.wan.ppp0 to public.wan
    rule 40 permit https from public.wan.ppp0 to public.wan
    protect
    !
    nat
    rule 10 masq any from private to public
    enable
    !
    malware-protection
    provider kaspersky
    protect
    !
    ip-reputation
    category Bot action deny
    category CnC action deny
    category Drop action deny
    category Mobile_CnC action deny
    category Mobile_Spyware_CnC action deny
    category SpywareCnC action deny
    provider proofpoint
    protect
    !
    service atmf-application-proxy
    !
    no spanning-tree rstp enable
    !
    interface port1.0.1
    switchport
    switchport mode trunk
    switchport trunk allowed vlan add 1
    switchport trunk native vlan none
    switchport atmf-link
    !
    interface eth1
    encapsulation ppp 0
    !
    interface vlan1
    ip address 192.168.1.1/24
    !
    interface ppp0
    ppp ipcp dns request
    keepalive
    ip address negotiated
    ppp username user@isp
    ppp password isppasswd
    ip tcp adjust-mss pmtu
    !
    ip route 0.0.0.0/0 ppp0
    ip route 192.168.100.0/24 192.168.1.254
    ip route 192.168.101.0/24 192.168.1.254
    !
    ip dns forwarding
    !
    end

## Configuration example using Tag

This is an example of setting authentication using the tag set in the Device ID (Device) of the authentication data of AMF Security.

> Note

> > For more information, refer to Quick Tour/Authentication using Tags > What is authentication using Tag.

This setting example shows how to register AMF Security authentication data.
Normally, a terminal (MAC Address) is registered with an AMF Security device and associated with a policy, and the terminal connects to the network set for that policy.
When using tags, do not set policies on AMF Security devices, set tags on the devices, and connect to the networks set in the policies of the tags created separately.
In this setting example, the configuration of Configuration Examples/Controlling Devices with AMF Application Proxy > Configuring AMF Application Proxy and assume the following:
◼ Users and owned devices

- User 1 (user_1) owns two terminals (PC-1, PC-2)
- User 2 (user_2) owns 3 terminals (PC-3, PC-4, PC-5)
- User 3 (user_3) owns one terminal (PC-6)
- User 4 (user_4) owns one terminal (PC-7)
- User 5 (user_5) owns one terminal (PC-8)

◼ Affiliation of each user

- Group A (group_A)
  User 1
  User 2
  User 3
- Group B (group_B)
  User 4
  User 5

◼ Affiliation (Group) network

- Group A (group_A)
  VLAN100
- Group B (group_B)
  VLAN101

> Note

> > This setting example does not describe port settings (such as adding the number of ports) to which AMF Member terminals connect due to an increase in the number of terminals.

An overview of the authentication data (devices, tags, networks) to be registered with AMF Security is as follows.

- Device
  user_1
  user_2
  user_3
  user_4
  user_5
- Affiliation (tag)
  group_A
  group_B
- Tags to set on the device
  user_1 : group_A
  user_2 : group_A
  user_3 : group_A
  user_4 : group_B
  user_5 : group_B
- Do not set policies on devices
- Policy to set for the tag (Network)
  group_A : VLAN100
  group_B : VLAN101

Table 14: Device ID (Device) configuration data
Device ID (first)
Device ID | user_1
Tag | group_A
Interfaces
MAC Address | 00:00:00:00:00:01
Name | PC-1
Interfaces
MAC Address | 00:00:00:00:00:02
Name | PC-2
Policies | None
Device ID (second)
Device ID | user_2
Tag | group_A
Interfaces
MAC Address | 00:00:00:00:00:03
Name | PC-3
Interfaces
MAC Address | 00:00:00:00:00:04
Name | PC-4
Interfaces
MAC Address | 00:00:00:00:00:05
Name | PC-5
Policies | None
Device ID (third)
Device ID | user_3
Tag | group_A
Interfaces
MAC Address | 00:00:00:00:00:06
Name | PC-6
Policies | None
Device ID (fourth)
Device ID | user_4
Tag | group_B
Interfaces
MAC Address | 00:00:00:00:00:07
Name | PC-7
Policies | None
Device ID (fifth)
Device ID | user_5
Tag | group_B
Interfaces
MAC Address | 00:00:00:00:00:08
Name | PC-8
Policies | None

Table 15: Tag configuration data
Tag (first)
Tag | group_A
Policies | VLAN100
Tag (second)
Tag | group_B
Policies | VLAN101

With these settings, the network connected to users (terminals) belonging to a group are connected is changed collectively only by changing the tag policy.

### AMF Master, AMF Member, AR Router, AT-VST-VRT setting procedure

For the AMF Master, AMF Member, AR Router, and AT-VST-VRT setting procedures, refer to Configuration Examples/Controlling Devices with AMF Application Proxy > Configuring AMF Application Proxy.

### Configuring AMF Security

For basic settings, AMF Master, Network, and Trap Monitor Settings are the same as Configuration Examples/Controlling Devices with AMF Application Proxy > Configuring AMF Application Proxy.
The flow of setting procedures for AMF Security is as follows:

- Basic settings of Configuration Examples/Controlling Devices with AMF Application Proxy > Configuring AMF Application Proxy
- Step 1 to Step 9 of Configuration Examples/Controlling Devices with AMF Application Proxy > Configuring AMF Application Proxy
- Register tags on the Group > Tag List page
- Register devices on the Device > Add Device page
- Steps from step 21 of Configuration Examples/Controlling Devices with AMF Application Proxy > Configuring AMF Application Proxy

1. Configure basic settings for AMF Security.
   Refer to Configuration Examples/Controlling Devices with AMF Application Proxy > Configuring AMF Application Proxy/Configuring AMF Security.
2. Configure AMF Master and network.
   Refer to steps 1 to 9 of Configuration Examples/Controlling Devices with AMF Application Proxy > Configuring AMF Application Proxy
3. Register tags based on the set policy.
   Tags can be registered on the Group > Tag List page. Open the Group > Tag List page.

4. Click the "Add Tag" button at the top right corner to move to the Group > Add Tag page.

5. Enter information for the tag to add.

   Configure the settings shown in the following table:

   Table 16: Configurable fields
   Item Name | Value
   --- | ---
   Tag | group_A
   Note | (empty)

6. Click the "Add" button next to "Policies" to open the Group > Edit Policy dialog.

7. Enter information for the policy.

   Configure the settings shown in the following table:

   Table 17: Configurable fields
   Item Name | Value
   --- | ---
   Priority | 10
   Network | VLAN100
   Location | (empty)
   Schedule | (empty)

8. Click the "Submit" button to return to the Group > Add Tag page.

9. Click the "Submit" button.
   Once the tag is registered, the added information is displayed on the Group > Tag List page.

10. Register another tag using the same procedure as steps 4 to 9.

    Table 18: Configurable fields
    Item Name | Value
    --- | ---
    Tag | group_B
    Note | (empty)
    Policies
    Priority | 20
    Network | VLAN101
    Location | (empty)
    Schedule | (empty)

11. Register the Device ID (Device).
    Devices can be registered on the Device > Add Device page. Open the Deice > Device List page.

12. Click the "Add Device" button at the top right corner to move to the Device > Add Device page.
    On this page, register the device ID, interface, and policy of the new device.

13. Enter information about the new device.

    Configure the settings shown in the following table:

    Table 19: Configurable fields
    Item Name | Value
    --- | ---
    Device ID | user_1
    Tag | group_A
    Note | (empty)

14. Next, you have to enter the interface MAC Address of the device.
    Click the "Add" button next to "Interfaces" to open the Device > Edit Interface dialog.

15. Register the MAC Address of the "user_1" terminal.

    Configure the settings shown in the following table:

    Table 20: Configurable fields
    Item Name | Value
    --- | ---
    MAC Address | 00:00:00:00:00:01
    Name | PC-1
    Note | (empty)

16. Click the "Submit" button.
    "Interfaces" section of the Device > Add Device page now shows the interface MAC Address which you just entered.

17. Register the MAC Address and name of the other terminal using the same procedure as steps 14 to 16.

    Configure the settings shown in the following table:

    Table 21: Configurable fields
    Item Name | Value
    --- | ---
    MAC Address | 00:00:00:00:00:02
    Name | PC-2
    Note | (empty)

18. Since no policy is set for this device "user_1", just click the "Submit" button.
    Once the device is added, the Device > Device List page reflects the updated information.

19. Register the "Device ID" of "user_2", "user_3", "user_4" and "user_5" in the same procedure as steps 12 to 18.
    The tags and interfaces to be registered for each "Device ID" are as follows.

    Table 22: Tag configuration data
    Device ID | Tag to register
    --- | ---
    user_2～user_3 | group_A
    user_4～user_5 | group_B

    Table 23: Device ID (Device) configuration data
    Device ID (user_2)
    Tag | group_A * Common with "user_1 to user_3"
    Note | (empty)
    Interfaces
    MAC Address | 00:00:00:00:00:03
    Name | PC-3
    Note | (empty)
    Interfaces
    MAC Address | 00:00:00:00:00:04
    Name | PC-4
    Note | (empty)
    Interfaces
    MAC Address | 00:00:00:00:00:05
    Name | PC-5
    Note | (empty)
    Device ID (user_3)
    Tag | group_A * Common with "user_1 to user_3"
    Note | (empty)
    Interfaces
    MAC Address | 00:00:00:00:00:06
    Name | PC-6
    Note | (empty)
    Device ID (user_4)
    Tag | group_B * Common with "user_4 to user_5"
    Note | (empty)
    Interfaces
    MAC Address | 00:00:00:00:00:07
    Name | PC-7
    Note | (empty)
    Device ID (user_5)
    Tag | group_B * Common with "user_4 to user_5"
    Note | (empty)
    Interfaces
    MAC Address | 00:00:00:00:00:08
    Name | PC-8
    Note | (empty)

    - Device > Add Device page (user_2)

    - Device > Add Device page (user_3)

    - Device > Add Device page (user_4)

    - Device > Add Device page (user_5)

    - Device > Device List page

20. Configure Trap Monitor Settings.
    Refer to steps from step 21 of Configuration Examples/Controlling Devices with AMF Application Proxy > Configuring AMF Application Proxy

AMF Security configuration is done.

29 Sep 2022 09:15