XLOG Firewall

Firewall

• Opening, closing and forwarding ports is handled through the firewall.
• Port-based attacks from outside are blocked, keeping the system secure.
• Group-based rules can be created; the rules you choose apply to the groups you choose.
• With country-based blocking, IP blocks outside Türkiye, Azerbaijan and Iraq can be blocked in bulk with a single setting; specific IPs can be allowed when needed.
• Timed port opening: a port is opened for a set period and closes automatically.
• The IPs currently connected to a port can be viewed live.
• Port access triggers instant notification by SMS and e-mail.

Network Configuration

• Physical interfaces are defined as WAN, LAN or HA; addressing is done with a static IP, DHCP or PPPoE.
• VLAN, bridge and LAGG (link aggregation) virtual interfaces are created from the interface.
• Several interfaces can be grouped under one zone; because rules are written against the zone name, changing an interface does not break them.
• A gateway and a monitoring address are defined for each WAN; ordering multiple gateways sets up load balancing and redundancy.
• Static routing entries, MTU and DNS settings are managed on the same screen.
• With a Layer 2 tunnel interface, a remote branch joins the same broadcast domain as the central site.

IPS/IDS

• The intrusion detection system detects attacks arriving on the WAN and LAN interfaces; it runs in notification or blocking mode.
• Ready-made signatures and rules make management straightforward.
• Because the rules update automatically, attack conditions are tracked in real time.
• Under heavy traffic there is only a very small drop in throughput; it does not slow the network down.
• IPS/IDS signatures can be selected per profile to create blocking or warning conditions.
• Signature updates require no user intervention; the software stays current and keeps protecting.

Web Filtering

• A filter database of 70+ categories and 4,900,000+ sites is standard on every model.
• The blacklists ship on the device; no additional service is needed.
• Blacklist updates download automatically and require no user intervention; malicious software and illegal content addresses are blocked automatically.

HTTPS Filtering

• HTTPS/SSL pages can be blocked without installing a certificate on the computers.
• Wildcards (*.facebook.com) can be defined in the blacklists.
• Visits to HTTPS/SSL pages are logged per IP; the host names of the visited addresses are kept as well.
• Because no SSL certificate is used, no certificate error appears in the browser.
• Thanks to the dynamic database, sites that are not in the blacklist can be added to the lists by the user.

Hotspot

• The hotspot captive portal can be designed; a company logo or a welcome message can be published.
• Authentication methods: username and password, Turkish ID number, passport, SMS, LDAP/Active Directory, one-time password (voucher) and hotel/hospital software integrations; several methods can be used together in one zone.
• Integration with hotel management systems is available.
• For venues that want to charge for internet access, a timed billing module is available.
• After the hotspot login, users can be redirected automatically to any site you choose.
• The login and logout times of users who signed in can be listed.
• Currently active users and their quota usage can be listed.
• Privileged users can connect without seeing the hotspot page.
• One-time passwords can be created for guests.
• With thermal printer integration, the username and password can be handed over as a printed slip.
• The captive portal can be published in Turkish, English, German and Russian; the language is selected automatically from the browser setting. The privacy notice and the terms of use are defined separately for each language.

Speed Limiting

• Download and upload speed can be defined per user or per MAC address.
• A daily, weekly or monthly quota can be defined per user or per MAC address; when the quota is used up, access is cut off or dropped to a defined lower speed.
• Daily per-user and per-MAC quota usage is recorded and can be listed by date range.
• Devices generating excessive traffic are shown at the top of the list.

VPN / SSL VPN

• Site-to-site VPN is available; networks at remote sites can be joined to the central network.
• It interoperates with devices on the market that support IPsec VPN.
• Multi-subnet support is available; several VPN connections with different subnets can be established to the same IP.
• With SSL VPN, remote users can be joined to the corporate network in software.
• On MPLS networks it provides standalone management with no need for an additional DHCP or DNS server; installing only at the central site lets you manage every device from one point.
• With WireGuard support, a modern low-latency tunnel can be established.
• The XLOG VPN client connects from Windows, Linux, Android and iOS devices.
• VPN MFA: a second verification step is added with SMS, e-mail or Google Authenticator.

Line Aggregation

• Up to 5 internet lines can be combined on the system.
• It is a solution applied where the internet infrastructure is not fast enough.
• It works both as traffic steering and as line aggregation; both configurations are supported.

Line Failover

• When one of the internet lines in use is cut, internet continuity is maintained over the active lines.
• A monitoring address is defined for each line; when the address stops responding the line is considered down and traffic moves to the surviving lines.
• Which rule exits over which line can be chosen per rule; when the primary line returns, traffic falls back to its original layout.

Active–Passive (HA)

• Setup is done by defining an HA interface, the peer device IP and a shared key between the two devices.
• If the active device fails, the standby device takes over automatically; no manual intervention is needed on the network.
• The configuration is synchronized between the two devices; rules and profiles are not copied separately.
• The role of each device (MASTER/BACKUP) and the connection status are visible live in the panel.

Logging / Signing

• These logs can be reported in detail.
• Records are kept signed on the device for 2 years.
• Records can be searched by MAC address, source/destination IP, username, destination port, domain and date.
• Internet records can be downloaded to your computer by date.
• With the FTP backup feature, internet records can be copied to another device.
• Logins to the XLOG system are recorded.

SYSLOG

• Devices such as switches, routers and servers are defined as syslog sources; the records they send are collected on the device.
• The collected records can be searched by date range, source/destination address and port, user, rule and action fields.
• Records produced on XLOG are sent to an external SIEM or log server; you can choose which log types are forwarded.
• Internet records from other firewall brands are received over syslog and signed.

Application Filtering

• Allow or block rules are defined with a single click through ready-made application categories.
• Applications are listed in categories; permission is granted in bulk per category and, where needed, one application at a time.
• A specific application can be found with the search box and an exception defined for that application alone.
• Because the profile is bound to a firewall rule, the restriction is applied per user, per group or per time of day.

RADIUS MAC Filtering

• It works with managed switch integration on both Layer 2 and Layer 3 networks.
• Devices that join the network, or try to, can be tracked live.
• With SNMP and telnet support it collects ARP information from edge and core switches, adds the MAC address to log records on Layer 3 networks and provides signed logging.
• With Layer 2 filtering, clients trying to connect from the internal network join only with the system administrator's approval.