Firewall/VPN Router
Firewall/Internet Gateway with IPSec VPN, DMZ port and built-in 3-port
switch. WAN connection is through a DSL or cable modem.
SOHO Firewall/VPN Router With DMZ Port & 3-Port Switch
The DFL-100 firewall/VPN router delivers complete network protection and Virtual Private Network (VPN) services for the
small office environment. This device provides an economic, hardware-based solution for dependable protection against content-
based threats, along with content filtering, firewall, VPN and intrusion detection.This allows you to effectively detect and defeat
Internet attacks, prevent misuse, and improve the quality of key network applications, without degrading the performance of your

Designed for SOHO
Your office is connected to the outside world Internet or linked to
to prevent IP spoofing. The DFL-100 detects DoS (Denial of
the corporate network and trusted suppliers through the Intranet,
Service) attacks against your network operating systems and
and is vulnerable to attacks. The DFL-100 is a compact and easy-
applications and alerts you of these attacks by e-mail.
to-install unit that can address the needs of a SOHO network. With
the functionality typically found in the more expensive devices, this
device combines extensive firewall protection with Internet
Industry-standard IPSec, PPTP and L2TP VPNs provide secure
gateway functions, eliminating for you the need to install a separate
communication between networks and clients. The DFL-100
firewall behind a remote router. For SOHO application, it also
provides Auto-Key Internet Key Exchange (IKE) and hardware
gives you easy configuration/setup, plus SNMP standard
accelerated DES
encryption. Client pass-through support

is provided for IPSec PPTP
and L2TP.
A DMZ port is provided to allow your web, mail and FTP servers
to be directly accessed from the Internet. This alleviates congested
Logging allows you to monitor your network. The DFL-100
server traffic from entering the your internal network, while
provides extensive logging for filtering activities, session tracking
providing your office LAN with the firewall protection. A buit-in 3-
activities, intrusion detection activities and user authentication
port switch allows your workstations to directly connect to the
actitivies. Logs can be easily searched by keywords, source,
firewall/router, saving you the cost and trouble of installation a
destination, time and date.
separate Fast Ethernet switch.
Setup and Management
Configuration can be done by Telnet. A built-in web-based
The DFL-100 provides Stateful Packet Inspection (SPI). Virtual IP
configurator provides easy system setup and administration.
mapping maps public IP addresses to servers on the internal and
Industry-standard MIBs are also built in for platform-independent
DMZ networks for secure public access. IP/MAC binding
SNMP-based management and monitoring.
automatically binds a host IP address with its unique MAC address
Key Features
Connects to DSL/cable modem
Intruder prevention
DMZ port for external server connection

Stateful Packet Inspection
3 built-in Fast Ethernet switch ports
Web-based configuration setup
Internet gateway functions with DHCP server
Built-in MBIs for SNMP management/monitoring
IPSec security with VPN tunnels
Universal Plug-n-Play (UPnP) enabled

Technical Specifications
Firewall/VPN Router
Device Ports
Network & Routing Protocols
- 1 10/100Mbps Fast Ethernet port for DSL/cable modem connection
- 1 10/100Mbps Fast Ethernet DMZ port
- Routing Protocol: Static and Default Routing
- 3 10/100Mbps Fast Ethernet switch ports (for internal LAN connection)
DMZ & LAN Port Support
- DHCP server for automatic IP assignment
- Full/half duplex
- Virtual server mapping (maximum: 32)
- 802.3x Flow Control in full duplex
VPN & Data Encryption
- Back pressure in half duplex
- Point-to-Point Tunneling Protocol (RFC 2637)
- Layer Two Tunneling Protocol (RFC 2661)
- Boot ROM & runtime code: 2MB flash
- Buffer: 32MB SDRAM
Connection Modes
- Site to site
- Site to client
- Method for Transmitting PPP over Ethernet (RFC 2516)
Number of Tunnels
- Point-to-Point Protocol (PPP) (RFC 1661)
IPSec tunnels (maximum: 80)
- PPP Internet Protocol Control Protocol (IPCP) (RFC 1332)
- PPP Authentication Protocol (RFC 1334)
- PPP Encryption Control Protocol (ECP) (RFC 1968)
- Security Architecture for the Internet Protocol (RFC 2401)
- PPP Compression Control Protocol (CCP) (RFC 1962)
- IP Security Document Roadmap (RFC 2411)
- PPP Challenge Handshake Authentication Protocol (CHAP) (RFC 1994)
- IP Authentication Header (RFC 2402)
- Microsoft PPP CHAP Extensions I and II (RFC 2433, 2759)
- IP Encapsulating Security Payload (RFC2406)
- Microsoft Point-To-Point Encryption (MPPE) Protocol (RFC 3078)
- IP Payload Compression Protocol (RFC 2393)
- Various Encryption Protocols
- Internet IP Security Domain of Interpretation for ISAKMP (RFC 2407)
- HMAC: Keyed-Hashing for Message Authentication (RFC 2104)
- Use of HMAC-MD5-96 within ESP and AH (RFC 2403)
- Use of HMAC-SHA-1-96 within ESP and AH (RFC 2404)
Stateful Packet Inspection
- All AH and ESP Transforms
- IP Address and Port Number
- Packet Count and Byte Count
Encryption Algorithms
- Sequence and Acknowledgement Number
- DES & 3DES (with hardware accelerator aid)
- Timestamps
- RC4
- Payload Modification History
- Dynamic Association
UDP Encapsulation
- Allows firewalls and NAT gateway to handle IPSec traffic
- Follows IPSec standards for UDP encapsulation
- Filtering activities: rejected internal and external connection request
Advanced Key Management
- Session tracking activities: session creation and termination information
- Internet Security Association and Key Management Protocol (ISAKMP)
- Intrusion detection activities: outside attack logging
- Internet Key Exchange (IKE) (RFC 2409)
- User authentication activities: user authenticating with firewall logging
Supported IKE Mechanisms
DoS Blocked Attack Types
- Pre-shared Key
- SYN Flooding
- Default 768 bits MODP Group
- TCP Hijacking
- Default 1024 bits MODP Group
- LAND Attack
- WinNuke / OOBNuke
- Christmas Tree
Physical & Environmental
- SYN/FIN (Jackal)
Diagnostic LEDs
- SYN/FIN (zero-sized DNS zone payload)
- Link/Act (per port)
- BackOffice (UDP 31337)
- 100Mbps (per port)
- NetBus
- Power (per device)
- Smurf
- Tear Drop
Power Input
- ICMP Flooding
- DC 5V 2.5A
- Trojan Horse
- Through external AC power adapter
234 (W) x 161 (D) x 35 (H) mm
- IP Network Address Translation (NAT) (RFC 2663)
360 grams (approx.)
- Traditional IP Network Translation (Traditional NAT) (RFC 3022)
- Protocol Complications with IP Network Address Translation
Operating Temperature
(RFC 3027)
-5 C ~ 50 C
NAT Application Level Gateway
Storage Temperature
- H.323 Protocol Suite
-25 C~ 55 C
- File Transfer Protocol (FTP)
- Session Description Protocol (SDP)
Operating Humidity
- Real-Time Transport Protocol (RTP)
10% - 95% non-condensing
- Internet Relay Chat (IRC)
- Multiple Gaming Protocol

Technical Specifications
Firewall/VPN Router
EMI Certification
- FCC Class B
- CE Class B
- C-Tick Class B
- BSMI Class B
- UL
- T-mark

Document Outline