Grandstream’s GCC: Deep Packet Inspection and basic Firewall rules

January 21, 2025
Muponisi Maswanganyi
Technical Tips & Guides
1 likes
1292 views
0 comments

Cyberattacks are becoming more sophisticated, widespread, frequent, and can easily outpace current business defences. Cybersecurity solution can be costly and cumbersome to implement making it difficult for smaller enterprises to implement.

That is where Grandstream’s GCC range comes to the rescue. As a cost effective yet sophisticated network management tool with features like DPI, DNS Filtering, Application Filtering and more.

Let’s dive into some of the network security features this device supports:

SSL Proxy & Content Control

Network administrators can use content filtering to enforce various rules on users' web access permissions, boost team productivity, or stop users from visiting unapproved or ineffective websites. The various layers of web content filtering can be used in tandem or separately to create a comprehensive solution for tracking users' online activities.

The GCC6000 device provides the following content control methods, content control through:

• DNS Filtering

• Web Filtering

• Application Filtering

DNS Filtering

In a domain environment with Active Directory, a Group Policy Object (GPO) can be configured to prevent users from modifying network adapter settings including DNS.

1. Navigating to content control and add a new DNS filter with an action to block YouTube.

Navigating to Security Logs and confirm the URLs that contains the wildcard are blocked.

SSL Proxy & Web Filtering

Web Filtering is a security mechanism to filter web access using the GCC device as an SSL proxy, which allows the device to inspect HTTPS traffic going through the GCC device.

The GCC devices come with an embedded SSL proxy that can be used to encrypt and decrypt data passing between the clients and the server (the GCC router module), this traffic is encrypted and can only pass through devices that have a CA certificate installed. The CA certificate installed confirms the authenticity of the connected device and allows it to receive HTTPS traffic from the GCC network.

Steps to configure SSL proxy and web filtering

1. Navigate to “SSL Proxy → Basic Settings “, then enable SSL Proxy and select/add CA Certificate and download the certificate to your local machine.

2. Add the CA Certificate to your device (PC, Smartphone …). In Windows for example, open Manage Computer Certificates and import the CA Cert under Trusted Root Certificate Authorities → Certificates

3. Under Content Control → Web Filtering, enable Web Filtering and add a new URL Filtering with a wildcard (ex: *facebook*) and set the action to Block

4. Open a web browser (private tab) and test the wildcard by using a URL that contains that wildcard: facebook.com

5. Navigate to Security Log and confirm the URL that contains the wildcard are blocked

Application Filter

Application Filtering is an intuitive and easy-to-use way to block access to specific websites, or specific niches directly, the way it works is that the GCC has a list of predefined web access categories, and each category contains a list of the most known websites within the category, you have the option to block access to the entire category, or to specific websites within the category.

Steps to configure Application Filtering

1. Navigate to “Content Control → Application Filtering → Basic Settings”, then enable Application Filtering.

2. Under App Filtering Rules tab, apply a rule on an app category, in our case Streaming (contains 228 apps).

You can add a rule that overrides the category if you want to filter a specific application, this option allows you to search for that specific application to filter.

3. Under Override Filtering Rules tab, click on “Add” button to add a new rule that will override the previous selected category (Messaging) for example under Messaging, select WhatsAPP and set the Action to “Block”.

Navigate to Security Log and confirm the app is blocked.

Anti-Malware

The GCC6000 series supports embedded anti-malware software that helps the firewall system detect, block, and scan the network for any potential security threats, it can be very similar to the functionalities found on an anti-virus software, with many more features narrowed for network security, including protection against various threats.

The anti-malware module is periodically updated to include the latest security patches to stay up to date with the evolving attack methods

With the below easy steps you can enables your network malware defence

1. First navigate to Anti-Malware → Virus Signature Library and update the signature library information.

2. Then navigate to Anti-Malware → Configuration, then enable Anti-malware and set “Data Packet Inspection Depth” to High and enable Scan Compressed Files.

3. To simulate a Malware infection, use a test malware (harmless) like Eicar by visiting: https://secure.eicar.org/eicar_com.zip.

Navigate to Security Log → Log, filter by Anti-malware, and confirm the test malware is blocked.

The GCC range makes implementing basic firewall rules simple and effective ensuring that your network and users have a basic level of security from cyberthreats.

For more information, get in touch with us on sales@miro.co.za or on 012 657 0960 or simply order your GCC devices online at www.miro.co.za

For upcoming certified training, visit www.miroacademy.co.za or get in touch with us on training@miro.co.za