Contents

System Settings

References > System Settings

---

---

Account List

Note

Default account "manager" cannot be deleted.

Add Account

Note

You need to initialize (delete and recreate) the AMF Security mini application instance in the Web GUI of your AlliedWare Plus device, if you forget Password for all Accounts that have the "Configure system settings" check box, including the default "manager". Please make sure that you keep your passwords safely and never forget them.
Refer to the AlliedWare Plus device manual for the setting method.

Note

Register your Email Address in your account and set the Email Notification on the System Settings > Email Notification Settings page. This allows you to recover your password by email if you forget it.
Refer to Appendix / If you forget your password for instructions on how to recover your password by email.

Password Configuration

Update Account

Note

Account name and permissions of the default account "manager" cannot be changed.

Note

You need to initialize (delete and recreate) the AMF Security mini application instance in the Web GUI of your AlliedWare Plus device, if you forget Password for all Accounts that have the "Configure system settings" check box, including the default "manager". Please make sure that you keep your passwords safely and never forget them.
Refer to the AlliedWare Plus device manual for the setting method.

Note

Register your Email Address in your account and set the Email Notification on the System Settings > Email Notification Settings page. This allows you to recover your password by email if you forget it.
Refer to Appendix / If you forget your password for instructions on how to recover your password by email.

Password Configuration

Account Group List

Note

Refer to Appendix / CSV File for CSV Files.

Add Account Group

Update Account Group

Network Settings

View and change network configurations for the AMF Security mini system.

Note

If you set the upload / delete of the SSL Certificate of the Web server, the connection with the connected AMF Master is temporarily disconnected.

Services

Note

Only TLS 1.2 and TLS 1.3 are supported for HTTPS.

Note

AMF Security mini is using several ports internally. Refer to Appendix / TCP or UDP port number used inside AMF Security mini for the ports used by AMF Security mini.

Note

If you specify HTTP as the web server protocol and 80 as the port number when accessing the web setting screen, you will be redirected to the web server protocol and port number set above.

Note

The combination of web server protocol and port number HTTPS / 80 is non-configurable (reserved).

Note

If you upgrade to this version with the web server protocol and port number set to HTTPS / 80 in AMF Security mini software version 1.7.0, or if you import the system setting file with the same settings, the setting is changed to HTTP / 80.

SSL Certificate

Register the SSL server certificate of the Web server (AMF Security mini) and the SSL server certificate of the whitelist authentication server installed in AMF Security mini.
If you want external applications to interact with AMF Security mini via HTTPS, you may have to install an SSL server certificate issued by a trusted certificate authority (CA).
If you want to encrypt the control session with the AMF Application Proxy Whitelist, obtain the SSL server certificate from a trusted certificate authority and upload it to AMF Security mini.
"SSL Certificate" section shows a summary of the installed SSL server certificate.

Use the method best suited for your needs to get the certificate.

• If your CA provides you with intermediate CA certificates or cross root CA certificates in addition to your server certificate, concatenate those certificates into a single file then upload the file to AMF Security mini. Contact the CA for detailed information on how to concatenate certificate files.
  
• To install a certificate file, it must meet the following requirements.
  

  Table 21: SSL Certificate Requirements

  Type	X.509, RFC6818
  Encryption	PEM (Privacy Enhanced Mail)
  Extension	.crt

Note

After setting the AMF master, AMF Security mini accepts both unencrypted and encrypted sessions. You cannot disable one of them.

Upload SSL Certificate

This dialog lets you upload your own SSL Certificate for the White-list Authentication Server.

Logging Settings

Note

With this setting, the connection with connected AMF Master is temporarily disconnected.

◼ Log Output
You can view and configure levels for various types of logs.
◼ Syslog

Note

The encoding method of Syslog data to be sent is "UTF-8".

Note

AMF Security mini is using several ports internally. Refer to Appendix / TCP or UDP port number used inside AMF Security mini for the ports used by AMF Security mini.

Date / Time Settings

Note

With this setting, AMF Security mini restarts. Therefore, the connection between the connected AMF Master is temporarily disconnected.

Note

If you change the time zone setting, AMF Security mini restarts, but after that, you need to restart (Stop → Start) the AMF Security mini application instance in the Web GUI of your AlliedWare Plus device. Refer to the AlliedWare Plus device manual for the setting method.

After that, the timezone setting is retained.

Select Timezone

System Information

This page lets you perform maintenance operations such as backup, restore and system restart.

Note

With the following settings, the connection with connected AMF Master is temporarily disconnected.
・Hostname
・System Settings - Import
・System Settings - Reset
・Services - Restart All

Note

System settings export and import features are intended for pure backup and restore. Do not modify an exported file nor imported a modified file using the feature.
When importing System Settings, you can specify a file with any extension as long as the contents of the file are correct.

◼ System Information

Note

You need this Serial Number to issue your AMF Security mini license.
The Serial Number is created during AMF Security mini installation, so the Serial Number changes to a new one if:

• Delete the AMF Security mini application on the AlliedWare Plus device's Web GUI and install the AMF Security mini application again
  
• Restore (migrate) the AMF Security mini application to an AlliedWare Plus device in a different chassis
  

If you reset the system settings, the serial number is not be changed.

◼ Software Info
◼ System Settings
Some system settings that are exported, imported, or reset are not covered.
Manually backup, configure or delete those elements.

• Configurations to be backed up, restored and reset.
  
  • Account List
    
  • Network Settings - Services
    
  • Logging Settings
    
  • Date / Time Settings
    
  • Trap Monitor Settings
    
  • Email Notification Settings
    
  • AMF Settings
    
  • TQ Settings
    
  • Redirect-URL Settings - Uploaded Site Content
    
• Configurations not to be backed up, restored and reset.
  
  • Network Settings - SSL Certificate
    
  • Trap Monitor Settings - Uploaded Rules
    
  • Licenses
    
  • AMF - SSL Certificate
    
  • AMF - Redirect-URL Settings - Uploaded Site Content
    
  • AMF Security Log
    
  • Action Log
    

◼ Authentication Data

Note

Authentication data file to import should be in CSV format. Refer to Appendix / CSV File for CSV Files.

Note

The Start Date / Time and End Date of the schedule included in the Authentication data are the date and time of the timezone currently set on the System Settings > Date > Time Settings page.
For details, refer to Policy settings > About the start date and time and end date and time of the schedule.

Note

When you import and update authentication data, AMF Security mini resets packet control flows for the devices which are contained in the authentication data.

Note

The method of uploading authentication data of AT-SESC software version 1.3.x or earlier cannot remove the network, location, and schedule settings from the security policy set for the device that has already been registered. To delete, delete the device once and then upload the authentication data, or update the security policy directly on the Device > Update Device page.

◼ Services
◼ Technical Support Information

Trap Monitor Settings

This page lets you configure various parameters required for interaction with external applications.
You can also setup AMF Security mini to forward SNMP traps and syslog messages to other systems.

Note

Trap monitor only responds to specific set of log messages and SNMP traps. You cannot define actions for arbitrary messages and traps.

Note

With this setting, the connection with connected AMF Master is temporarily disconnected.

◼ Protocols

Note

AMF Security mini is using several ports internally. Refer to Appendix / TCP or UDP port number used inside AMF Security mini for the ports used by AMF Security mini.

◼ Networks
Specify the monitored or unmonitored network, Syslog message, and SNMP Trap transfer destination host.
If Monitored Networks and Excluded Networks overlap, Exclude Networks have precedence.

Note

Some external applications do not respect settings of Monitored Networks and Excluded Networks.

◼ Device Lookup
Specify a target range of the action to notify.

Note

Device Lookup is not supported for AMF Application Proxy's IP-Filter action.

Note

When the action is applied to the target device by the IP Address of the device, the IP Address is displayed as "ip =" in the "MAC Address" item of the Device > Active Device List page. This IP Address is the IP Address that caused the action to be applied.

◼ Rules
Trap monitor rules can be updated and added through trap monitor rule files.
By default, trap monitor rules for the UTM functions of AT-AR3050S/AT-AR4050S routers are installed.

Note

Trap monitor rule files are provided by our "AMF-SEC Technology Partner Program". Contact our sales engineer for the Technology Partner Program.

• AT-AR3050S/AR4050S
  This tab lets you configure trap monitor rules for the UTM functions of AT-AR3050S/AT-AR4050S routers.
  
  To receive and monitor syslog messages from AT-AR3050S/AT-AR4050S routers,
  Then, check events which you want to monitor in the "Trap Action Target List" table.
  
  • IP Reputation：Detection of Malware Category
    Block traffic from a device when AMF Security mini receives a syslog message indicating that the IP reputation feature on the router detects the device tries to communicate with a destination classified as Malware category (Malware C&C server (CnC), Malware-infected host (Bot) or Mobile C&C Server (Mobile_CnC)).
    
  • IP Reputation：Detection of Spyware Category
    Block traffic from a device when AMF Security mini receives a syslog message indicating that the IP reputation feature on the router detects the device tries to communicate a destination classified as Spyware category (drop site (Drop), Spyware C&C server (SpywareCnC) or Mobile Spyware C&C server (Mobile_Spyware_CnC)).
    
  • Malware Protection：Detection of known malware on communicate from LAN to WAN
    Block traffic from a device when AMF Security mini receives a syslog message indicating that the malware protection feature on the router detects the known malware on the device.
    
  • Antivirus：Detection of virus on communicate from LAN to WAN
    Block traffic from a device when AMF Security mini receives a syslog message indicating that the anti-virus feature on the router detects the known virus on the device.
    
  • Firewall(IDS)：Detection of Syn Flood attacks from LAN to WAN
    Block traffic from a device when AMF Security mini receives a syslog message indicating that the firewall's IDS feature on the router detects the SYN Flood attack from the device.
    
  • Firewall(IDS)：Detection of ICMP Flood attacks from LAN to WAN
    Block traffic from a device when AMF Security mini receives a syslog message indicating that the firewall's IDS feature on the router detects the ICMP Flood attack from the device.
    
  • Firewall(IDS)：Detection of UDP Flood attacks from LAN to WAN
    Block traffic from a device when AMF Security mini receives a syslog message indicating that the firewall's IDS feature on the router detects the UDP Flood attack from the device.
    
  • Firewall(IDS)：Detection of TCP Stealth Scan from LAN to WAN
    Block traffic from a device when AMF Security mini receives a syslog message indicating that the firewall's IDS feature on the router detects the TCP Stealth Scan attack from the device.
    

  Note

  To use those rules, you also have to configure AT-AR3050S/AT-AR4050S. Refer to the AT-AR3050S/AT-AR4050S's documentation for more details.

  Table 47: Buttons

  Item Name	Description
  Value	Open the Rule Setup page.
  Edit	Display the "Edit Character Encoding" dialog and set the character encoding method.

  Table 48: Displayed columns

  Item Name	Description
  Version	Version of the Trap Monitor Rules

  Table 49: Configurable fields

  Item Name	Description
  Enable the monitoring of traps from this host.	If you want to monitor the device by receiving Syslog message from AT-AR3050S or AT-AR4050S, check the check box.
  Host Addresses	IPv4 Address of AT-AR3050S/AT-AR4050S routers. Multiple hosts can be specified by separating each address by a semicolon (;). Default is unspecified (empty) which means that AMF Security mini accepts syslog messages from any IPv4 Address.
  OpenFlow/TQ Action	In TQ's AMF Application Proxy under AMF Security mini, select the action to control the communication of the device. ・Drop(Block): Block traffic from the device. ・Quarantine: Move the device to the quarantine network. ・Log-Only: AMF Security mini does not notify you of the action and does not control the communication of the device. Output only the log of the applicable device.
  AMF Action	An action to be taken on the AMF network deploying AMF Application Proxy feature. ・Drop Packets: Block traffics from the device at the layer two (MAC) level. ・Link-Down: Shutdown the port where the device is connected. ・Quarantine: Move the device to the quarantine VLAN. ・AMF Dependency: AMF Security mini does not specify an action and lets AMF devices determine its action. ・IP-Filter: Block traffics from the device at the layer 3 (IP) level. ・Log-Only: AMF Security mini notifies the action of the log, but only outputs the log without controlling the communication of the corresponding device.
  Character Encoding	Set the encoding method for Syslog/SNMP trap messages sent from cooperative applications. Specify the following character strings according to the encoding method. ・UTF-8: Specify utf-8-sig. ・Shift_JIS: Specifies shift-jis. The default is utf-8-sig. If this setting is left blank, the default utf-8-sig is set.

  Table 50: Buttons

  Item Name	Description
  Page Bottom
  Submit	Save the settings.

Rules

Email Notification Settings

This page lets you configure Email Notifications.
AMF Security mini can send email to the set address when an event such as device authentication or blocking occurs or when you forget your password.
AMF Security mini also sends emails to forward the contents of syslog messages and SNMP traps it receives.

Note

Email Notification of syslog and trap messages are always enabled and cannot be disabled.

Note

With this setting, the connection with connected AMF Master is temporarily disconnected.

Note

To recover your password if you forget it, you need to register your Email Address on the Add Account page or Update Account page in advance.

AMF Security mini queues the notification emails by the following rules and tries to resend them upon failure.

• When an event occurs, AMF Security mini queues up to 100 emails for the event in the first 10 seconds after the event.
  
• Queued emails are sent out as a single email after 10 seconds.
  
• If 100 or more events occur in 10 seconds after the first event, AMF Security mini queues them too.
  
• A Queue is created for each event types of Email Notification Settings.
  
• AMF Security mini attempts up to four retries, i.e. AMF Security mini tries to send an email up to 5 times.
  

To enable Email Notifications, check the "Enable Email Notification" on the page.

◼ Email Notification Settings
You can enable or disable email notification for each event with checkboxes.

• Send Email Notification on Authentication Success
  
• Send Email Notification on UnAuth Authentication Success
  
• Send Email Notification on Authentication Failed
  
• Send Email Notification on Edge Device Detect Event
  
• Send Email Notification on Block Event
  
• Send Email Notification on Quarantine Event
  
• When Redirect-URL is applied to device
  
• Send Email when Switch License Exceeded (Not supported in this version.)
  
• Send Email when Database Synchronization Status has changed (Not supported in this version.)
  

Note

"Send Email Notification on Block Event" or "Send Email Notification on Quarantine Event" is checked, AMF Security mini also sends notification email when a device is blocked or quarantined by AMF Application Proxy.
If you want to notify by email in the OpenFlow Action / AMF Action Log, check "Send Email Notification on Block Event". This product does not support OpenFlow.

◼ SMTP Server Settings

Note

AMF Security mini is using several ports internally. Refer to Appendix / TCP or UDP port number used inside AMF Security mini for the ports used by AMF Security mini.

Note

If your browser is configured to use Japanese, some part of emails is written in Japanese even if Language setting for Email Notification is English. If both browser and Email Notification are configured to use English, mail body is written in English. Note that strings contained in authentication data or messages received from an external application are left unchanged.

Note

When you want AMF Security mini to send notification emails when a device is blocked by the AMF Application Proxy with "Drop Packets", "Link-Down" or "IP-Filter" action, check "Send Email Notification on Block Event" .

Note

Encryption only supports STARTTLS. Note that the commonly used SMTP port number is 587.

Licenses

You have to install proper licenses before you start using AMF Security mini.
AMF Application Proxy do not work until the license is installed.

Note

After registering the license, if you delete or add the license during operation of AMF Application Proxy network, AMF Application Proxy may not operate normally.
Therefore, disconnect AMF security from the operating network before removing or adding a registered license.

If the licenseicense is removed or added during operation and AMF Application Proxy does not work properly, restart AMF security mini.

Note

If you do not have a license file, contact our sales engineer.
To obtain the license file, you need the AMF Security mini serial number displayed on the System Settings > System Information page.

Note

For the license, also refer to Accessing Management Interface / Starting Configuration > Installing Licenses.

License Installation

AMF Security Log

This page shows log messages generated by AMF Security mini service. The latest 1000 messages are displayed in this page.
You can view messages for a specific date by selecting a date at the right side of the page.

Action Log

This page shows AMF Security mini services' log messages related to actions.
It is possible to filter messages by each field's content.

Note

Depending on the specifications of the Web browser, it may not be possible to display all action logs on this page. In that case, download and check the action log.

Note

When clearing the action log, the connection with connected AMF Master is temporarily disconnected.

---

(C) 2023 Allied Telesis, Inc. All rights reserved.

C613-04158-00 Rev A

06 Sep 2023 16:33