Network security solution http://www.Dlink.Com netdefendos ver. 2.30.01 network security firewall cli reference guide security security.
Cli reference guide dfl-260e/860e/1660/2560/2560g netdefendos version 2.30.01 d-link corporation no. 289, sinhu 3rd rd, neihu district, taipei city 114, taiwan r.O.C. Http://www.Dlink.Com published 2011-05-16 copyright © 2011.
Cli reference guide dfl-260e/860e/1660/2560/2560g netdefendos version 2.30.01 published 2011-05-16 copyright © 2011 copyright notice this publication, including all photographs, illustrations and software, is protected under interna- tional copyright laws, with all rights reserved. Neither this manu...
Table of contents preface ...............................................................................................................10 1. Introduction .....................................................................................................12 1.1. Running a command ....................
2.2.30. Idppipes ...................................................................................46 2.2.31. Ifstat ........................................................................................47 2.2.32. Igmp .................................................................................
3.3.1. Advancedscheduleoccurrence .......................................................89 3.4. Alg ....................................................................................................90 3.4.1. Alg_ftp ....................................................................................
3.30.8. Pppoetunnel .......................................................................... 138 3.30.9. Sslvpninterface .................................................................... 140 3.30.10. Vlan .................................................................................. 140 3.3...
3.55.20. Sslvpninterfacesettings ........................................................ 195 3.55.21. Statesettings .......................................................................... 195 3.55.22. Tcpsettings .......................................................................... 196 3.55...
List of examples 1. Command option notation ..................................................................................10 1.1. Help for commands ........................................................................................13 1.2. Help for object types .................................
Preface audience the target audience for this reference guide is: • administrators that are responsible for configuring and managing the d-link firewall. • administrators that are responsible for troubleshooting the d-link firewall. This guide assumes that the reader is familiar with the d-link fire...
Because the table name option is followed by ellipses it is possible to specify more than one routing table. Since table name is optional as well, the user can specify zero or more policy-based routing tables. Gw-world:/> routes virroute virroute2 notation preface 11.
Chapter 1. Introduction • running a command, page 12 • help, page 13 • function keys, page 14 • command line history, page 15 • tab completion, page 16 • user roles, page 18 this guide is a reference for all commands and configuration object types that are available in the command line interface for...
1.2. Help 1.2.1. Help for commands there are two ways of getting help about a command. A brief help is displayed if the command name is typed followed by -? Or -h . This applies to all commands and is therefore not listed in the option list for each command in this guide. Using the help command give...
1.3. Function keys in addition to the return key there are a number of function keys that are used in the cli. Backspace delete the character to the left of the cursor. Tab complete current word. Ctrl-a or home move the cursor to the beginning of the line. Ctrl-b or left arrow move the cursor one ch...
1.4. Command line history every time a command is run, the command line is added to a history list. The up and down arrow keys are used to access previous command lines (up arrow for older command lines and down arrow to move back to a newer command line). See also section 2.4.3, “history”. Example ...
1.5. Tab completion by using the tab function key in the cli the names of commands, options, objects and object prop- erties can be automatically completed. If the text entered before pressing tab only matches one pos- sible item, e.G. "activate" is the only match for "acti", and a command is expect...
If " . " is entered instead of a property value and tab is pressed it will be replaced by the current value of that property. This is useful when editing an existing list of items or a long text value. The "" character before a tab can be used to automatically fill in the default value for a paramet...
1.6. User roles some commands and options cannot be used unless the logged in user has administrator priviege. This is indicated in this guide by a note following the command or "admin only" written next to an option. 1.6. User roles chapter 1. Introduction 18.
1.6. User roles chapter 1. Introduction 19.
Chapter 2. Command reference • configuration, page 20 • runtime, page 31 • utility, page 77 • misc, page 78 2.1. Configuration 2.1.1. Activate activate changes. Description activate the latest changes. This will issue a reconfiguration, using the new configuration. If the reconfiguration is successf...
Example 2.1. Create a new object add objects with an identifier property (not index): gw-world:/> add address ip4address example_ip address=1.2.3.4 comments="this is an example" gw-world:/> add ip4address example_ip2 address=2.3.4.5 add an object with an index: gw-world:/main> add route interface=la...
Note requires administrator privilege. 2.1.4. Cc change the current context. Description change the current configuration context. A context is a group of objects that are dependent on and grouped by a parent object. Many objects lie in the "root" context and do not have a specific parent. Other obj...
Depending on the specified . Type of configuration object to perform operation on. 2.1.5. Commit save new configuration to media. Description save the new configuration to media. This command can only be issued after a successful activate command. Usage commit note requires administrator privilege. ...
Options -force force object to be deleted even if it's used by other objects or has children. Category that groups object types. The property that identifies the configuration object. May not be applicable depending on the specified . Type of configuration object to perform operation on. Note requir...
All changes made to the object will be lost. If the object is added after the last commit, it will be re- moved. To reject the changes in more than one object, use either the -recursive flag to delete a context and all its children recursively or the -all flag to reject the changes in all objects in...
Note requires administrator privilege. 2.1.9. Reset reset unit configuration and/or binaries. Description reset configuration or binaries to factory defaults. Usage reset -configuration reset the configuration to factory defaults. Reset -unit reset the unit to factory defaults. Options -configuratio...
Example 2.5. Set property values set properties for objects that have an identifier property: gw-world:/> set address ip4address example_ip address=1.2.3.4 comments="this is an example" gw-world:/> set ip4address example_ip2 address=2.3.4.5 comments=comment_without_whitespace gw-world:/main> set rou...
When showing a table of all objects of a certain type, the status of each object since the last time the configuration was committed is indicated by a flag. The flags used are: - the object is deleted. O the object is disabled. ! The object has errors. + the object is newly created. * the object is ...
Options -changes show all changes in the current configuration. -disabled show disabled properties. -errors show all errors in the current configuration. -references show all references to this object from other objects. -verbose show error details. Category that groups object types. The property th...
Depending on the specified . Type of configuration object to perform operation on. Note requires administrator privilege. 2.1.12. Undelete chapter 2. Command reference 30
2.2. Runtime 2.2.1. About show copyright/build information. Description show copyright and build information. Usage about 2.2.2. Alarm show alarm information. Description show list of currently active alarms. Usage alarm [-history] [-active] options -active show the currently active alarms. -history...
Arp show all arp entries. Arp -show [] [-ip=] [-hw=] [-num=] show arp entries. Arp -hashinfo [] show information on hash table health. Arp -flush [] flush arp cache of specified interface. Arp -notify= [] [-hwsender=] send gratuitous arp for ip. Options -flush flush arp cache of all specified interf...
Options interface to show bigpond information. 2.2.7. Blacklist blacklist. Description block and unblock hosts on the black and white list. Note: static blacklist hosts cannot be unblocked. If -force is not specified, only the exact host with the service, protocol/port and destiny specified is unblo...
-dest= destination address to block/unblock (exceptextablished flag is set on). -dynamic show dynamic hosts only. -force unblock all services for the host that matches to options. -info show detailed information. -listtime show time in list (for dynamic hosts). -port= number of the port to block/unb...
2.2.9. Cam cam table information. Description show information about the cam table(s) and their entries. Usage cam -num= show cam table information. Cam [-num=] show interface-specified cam table information. Cam [-flush] flush cam table information of specified interface. Cam -flush flush cam table...
Display configuration log. Description display the log of the last configuration read attempt. Usage cfglog 2.2.12. Connections list current state-tracked connections. Description list current state-tracked connections. Usage connections -show [-num=] [-verbose] [-srciface=] [-destiface=] [-protocol...
-protocol= show only given ip protocol. -show show connections. -srciface= filter on source interface. -srcip= filter on source ip address. -srcport= show only given source tcp/udp port. -verbose verbose (more information). 2.2.13. Cpuid display info about the cpu. Description display the make and m...
Cryptostat 2.2.16. Dconsole displays the content of the diagnose console. Description the diagnose console is used to help troubleshooting internal problems within the security gateway usage dconsole [-clean] [-flush] [-date=] [-onlyhigh] [-blockoutput] options -clean remove all diagnose entries. (a...
2.2.19. Dhcpserver show content of the dhcp server ruleset. Description show the content of the dhcp server ruleset and various information about active/inactive leases. Display filter filters leases based on interface/mac/ip (example: if1 192.168.*) usage dhcpserver show dhcp server leases. Dhcpser...
Dns client and queries. Description show status of the dns client and manage pending dns queries. Usage dns [-query=] [-list] [-remove] options -list list pending dns queries. -query= resolve domain name. -remove remove all pending dns queries. 2.2.21. Dnsbl dnsbl. Description show status of dnsbl. ...
In the "flags" field of the dynrouting exports, the following letters are used: o route describe the optimal path to the network u route is unexported usage dynroute [-rules] [-exports] options -exports show current exports. -rules show dynamic routing, filter ruleset. 2.2.23. Frags show active frag...
2.2.26. Httpalg commands related to the http application layer gateway. Description show information about the wcf cache or list the overridden wcf hosts. Usage httpalg -override [-flush] list or flush hosts that have overridden the wcf filter. Httpalg -wcfcache [-show] [-url=] [-flush] [-verbose] [...
Options -display display status. -repost re-post all urls now. (admin only) 2.2.28. Hwaccel list configured hardware accelerators. Description display information about configured hardware accelarators. Usage hwaccel 2.2.29. Hwm show hardware monitor sensor status. Description show hardware monitor ...
Show list of currently piped hosts. Usage idppipes -show [-host=] lists hosts for which new connections are piped by idp. Idppipes -unpipe [-all] [-host=] remove piping for the specified host. Options -all mark all hosts. -host= filter on source ip address. -show lists hosts for which new connection...
2.2.32. Igmp igmp interfaces. Description show information about the current state of the igmp interfaces. Send simulated messages to test configuration of the interface. Usage igmp prints the current igmp state. Igmp -state [] prints the current igmp state. If an interface is specified, more detail...
Description turn ike on-screen snooping on/off. Useful for troubleshooting ipsec connections. Usage ikesnoop show ike snooping status. Ikesnoop -on [] [-verbose] enable ike snooping. Ikesnoop -off disable ike snooping. Options -off turn ike snooping off. -on turn ike snooping on. -verbose enable ike...
-max= limit list to entries. (default: 10) -release forcibly free ip assigned to subsystem. (admin only) -show show ip pool information. -verbose verbose output. Ip address to free. 2.2.35. Ipsecglobalstats show global ipsec statistics. Description list global ipsec statistics. Usage ipsecglobalstat...
Languagefiles show all language files on disk. Languagefiles -remove= remove a language file from disk. Options -remove= specify language file to delete. 2.2.41. Ldap ldap information. Description status and statistics for the configured ldap databases. Usage ldap list all ldap databases. Ldap -list...
Show contents of the license file. Description show contents of the license file. Usage license 2.2.43. Linkmon display link montitoring statistics. Description . If link monitor hosts have been configured, linkmon will monitor host reachability to detect link/ nic problems. Usage linkmon 2.2.44. Lo...
Options -num= maximum number of items to list (default: 20). -verbose verbose (more information). Translated ip. Nat pool name. 2.2.48. Netobjects show runtime values of network objects. Description displays named network objects and their contents. Example 2.10. List network objects which have name...
Pcapdump -show [] show a captured packets brief. Pcapdump -write [] [-filename=] write the captured packets to disk. Pcapdump -wipe remove all captured packets from memory. Pcapdump -cleanup remove all captured packets, release capture mode and delete all written capture files from disk. Options -cl...
-start start capture. -status show capture status. -stop stop capture. -tcp tcp filter. -udp udp filter. -wipe remove all captured packets from memory. -write write the captured packets to disk. Name of interface(s). Note requires administrator privilege. 2.2.51. Pipes show pipes information. Descri...
2.2.52. Pptpalg show pptp alg information. Description shows information and statistics of the pptp algs. Usage pptpalg show all configured pptp algs. Pptpalg -sessions [-verbose] [-num=] list all pptp sessions. Pptpalg -services list all services attached to pptp alg. Options -num= number of entrie...
2.2.54. Routemon list the currently monitored interfaces and gateways. Description list the currently monitored interfaces and/or gateways. Usage routemon 2.2.55. Routes display routing lists. Description display information about the routing table(s): - contents of a (named) routing table. - the li...
Options -all also show routes for interface addresses. -flushl3cache flush layer 3 cache. -lookup= lookup the route for the given ip address. -nonhost do not show single-host routes. -num= limit display to entries. (default: 20) -switched only show switched routes and l3c entries. -tables display li...
2.2.57. Selftest run appliance self tests. Description the appliance self tests are used to verify the correct function of hardware components. Normal sgw operations might be disrupted during the test(s). The outcome of the throughput crypto accelerator tests are dependent on configuration values. I...
Selftest -ping [-interfaces=] run a ping test over the interfaces. Selftest -throughput [-interfaces=] run a throughput test over the interfaces. Selftest -traffic [-interfaces=] run a traffic test over the interfaces. Selftest -cryptoaccel verify the correct functioning of the accelerator cards. Se...
Maximal achievable interface throughput. -traffic run a traffic test over the interfaces. The traffic test uses mixed frame sizes and verifies the content of each received frame. Note requires administrator privilege. 2.2.58. Services show runtime values of configured services. Description shows the...
Usage sessionmanager show session manager status. Sessionmanager -status show session manager status. Sessionmanager -list [-num=] list active sessions. Sessionmanager -info show in-depth information about session(s). Sessionmanager -message send message to session with console. Sessionmanager -disc...
Description show the contents of the settings section, category by category. Usage settings show list of categories. Settings show settings in category. Options show settings in category. 2.2.61. Shutdown initiate core or system shutdown. Description initiate restart of the core/system. Usage shutdo...
Description list running sip-alg configurations, sip registration and call information. The -flags option with -snoop allows any combination of the following values: - 0x00000001 general - 0x00000002 errors - 0x00000004 options - 0x00000008 parse - 0x00000010 validate - 0x00000020 sdp - 0x00000040 a...
2.2.65. Stats display various general firewall statistics. Description display general information about the firewall, such as uptime, cpu load, resource consumption and other performance data. Usage stats 2.2.66. Sysmsgs system messages. Description show contents of the fwloader sysmsg buffer. Usag...
Description display/set the system date and time. Usage time display current system time. Time -set set system local time: . Time -sync [-force] synchronize time with timeserver(s) (specified in settings). Options -force force synchronization regardless of the maxadjust setting. -set set system loca...
Show currently logged-on users and other information. Also allows logged-on users to be forcibly logged out. Note: in the user listing -list , only privileges actually used by the policy are displayed. Usage userauth list all authenticated users. Userauth -list [-num=] list all authenticated users. ...
Vlan list attached vlans. Vlan display vlans connected to physical iface . Options display vlan information about this interface. 2.2.73. Vpnstats alias for ipsecstats. 2.2.74. Zonedefense zonedefense. Description block/unblock ip addresses/net and ethernet addresses. Usage zonedefense [-save] [-blo...
2.3. Utility 2.3.1. Ping ping host. Description sends one or more icmp echo, tcp syn or udp datagrams to the specified ip address of a host. All datagrams are sent preloaded-style (all at once). The data size -length given is the icmp or udp data size. 1472 bytes of icmp data results in a 1500-byte ...
2.4. Misc 2.4.1. Echo print text. Description print text to the console. Example 2.17. Hello world echo hello world usage echo []... Options text to print. 2.4.2. Help show help for selected topic. Description the help system contains information about commands and configuration object types. The fa...
Example 2.20. Upload certificate data scp certificate.Cer user@sgw-ip:certificate/certificate_name scp certificate.Key user@sgw-ip:certificate/certificate_name example 2.21. Upload ssh public key data scp sshkey.Pub user@sgw-ip:sshclientkey/sshclientkey_name usage options -long enable long listing f...
Execute script. Script -show [-all] [-name=] show script in console window. Script -store [-all] [-name=] store a script to persistent storage. Script -remove [-all] [-name=] remove script. Script list script files. Options -all apply to all scripts. -create create configuration script from specifie...
2.4.5. Script chapter 2. Command reference 82.
Chapter 3. Configuration reference • access, page 84 • address, page 86 • advancedscheduleprofile, page 89 • alg, page 90 • arp, page 98 • blacklistwhitehost, page 99 • certificate, page 100 • client, page 101 • commentgroup, page 104 • comportdevice, page 105 • configmodepool, page 106 • datetime, ...
• iprule, page 143 • iprulefolder, page 146 • ipsecalgorithms, page 147 • ldapdatabase, page 148 • ldapserver, page 149 • linkmonitor, page 150 • localuserdatabase, page 151 • logreceiver, page 152 • natpool, page 155 • ospfprocess, page 156 • pipe, page 161 • piperule, page 164 • psk, page 165 • ra...
Description use an access rule to allow or block specific source ip addresses on a specific interface. Properties index the index of the object, starting at 1. (identifier) name specifies a symbolic name for the object. Action accept, expect or drop. (default: drop) interface the interface the packe...
3.2. Address this is a category that groups the following object types. 3.2.1. Addressfolder description an address folder can be used to group related address objects for better overview. Properties name specifies a symbolic name for the network object. (identifier) comments text describing the cur...
Name specifies a symbolic name for the network object. (identifier) members group members. Userauthgroups groups and user names that belong to this object. Objects that fil- ter on credentials can only be used as source networks and destin- ations networks in rules. (optional) nodefinedcredentials i...
Name specifies a symbolic name for the network object. (identifier) address ip address, e.G. "172.16.50.8", "192.168.30.7,192.168.30.11", "192.168.7.0/24" or "172.16.25.10-172.16.25.50". Activeaddress the dynamically set address used by e.G. Dhcp enabled ethernet interfaces. (optional) userauthgroup...
3.3. Advancedscheduleprofile description an advanced schedule profile contains definitions of occurrences used by various policies in the system. Properties name specifies a symbolic name for the service. (identifier) comments text describing the current object. (optional) 3.3.1. Advancedscheduleocc...
3.4. Alg this is a category that groups the following object types. 3.4.1. Alg_ftp description use an ftp application layer gateway to manage ftp traffic through the system. Properties name specifies a symbolic name for the alg. (identifier) allowserverpassive allow server to use passive mode (unsaf...
File list of file types to allow or deny. (optional) verifycontentmimetype verify that file extentions correspond to the mime type. (default: no) comments text describing the current object. (optional) 3.4.2. Alg_h323 description use an h.323 application layer gateway to manage h.323 multimedia traf...
Maxdownloadsize the maximal allowed file size in kb. (optional) filelisttype specifies if the file list contains files to allow or deny. (default: block) failmodebehavior standard behaviour on error: allow or deny. (default: deny) file list of file types to allow or deny. (optional) verifycontentmim...
Note if no index is specified when creating an instance of this type, the object will be placed last in the list and the index will be equal to the length of the list. 3.4.4. Alg_pop3 description use an pop3 application layer gateway to manage pop3 traffic through the system. Properties name specifi...
Description use a pptp application layer gateway to manage pptp traffic through the system. Properties name specifies a symbolic name for the alg. (identifier) echotimeout specifies idle timeout for echo messages in the pptp tunnel. (default: 0) idletimeout specifies idle timeout for user traffic in...
Verifysenderemail check emails for mismatching smtp command from ad- dress and email header from address. (default: no) verifysenderemailaction action if sender verfication fails. (default: deny) verifysenderemailspamtag spam tag that is inserted into the subject. (default: "*** spam ***") verifysen...
Cachesize size of the ip cache of checked sender ip addresses. (default: 0) cachetimeout timeout in seconds before a cached ip address is removed. (default: 600) dnsblacklists specifies the blacklist domain and its weighted value. Comments text describing the current object. (optional) 3.4.7.1. Alg_...
Comments text describing the current object. (optional) 3.4.9. Alg_tls description tls alg properties name specifies a symbolic name for the alg. (identifier) hostcert specifies the host certificate. Rootcert specifies the root certificate. (optional) comments text describing the current object. (op...
3.5. Arp description use an arp entry to publish additional ip addresses and/or mac addresses on a specified interface. Properties mode static, publish or xpublish. (default: publish) interface indicates the interface to which the arp entry applies; e.G. The interface the ad- dress shall be publishe...
3.6. Blacklistwhitehost description hosts and networks added to this whitelist can never be blacklisted by idp or threshold rules. Properties addresses specifies the addresses that will be whitelisted. Service specifies the service that will be whitelisted. Schedule the schedule when the whitelist s...
3.7. Certificate description an x. 509 certificate is used to authenticate a vpn client or gateway when establishing an ipsec tunnel. Properties name specifies a symbolic name for the certificate. (identifier) type local, remote or request. Certificatedata certificate data. Privatekey private key. N...
3.8. Client this is a category that groups the following object types. 3.8.1. Dyndnsclientcjbnet description configure the parameters used to connect to the cjb.Net dyndns service. Properties username username. Password the password for the specified username. (optional) comments text describing the...
Properties dnsname the dns name excluding the .Dlinkddns.Com suffix. Username username. Password the password for the specified username. (optional) comments text describing the current object. (optional) note this object type does not have an identifier and is identified by the name of the type onl...
Note this object type does not have an identifier and is identified by the name of the type only. There can only be one instance of this type. 3.8.6. Dyndnsclientpeanuthull description configure the parameters used to connect to the peanut hull dyndns service. Properties dnsnames specifies the dns n...
3.9. Commentgroup description group together one or more configuration objects. Properties description group description. (default: "(new group)") color group color. (default: 9ebee7) note if no index is specified when creating an instance of this type, the object will be placed last in the list and...
3.10. Comportdevice description a serial communication port, that is used for accessing the cli. Properties port port. (identifier) bitspersecond bits per second. (default: 9600) databits data bits. (default: 8) parity parity. (default: none) stopbits stop bits. (default: 1) flowcontrol flow control...
3.11. Configmodepool description an ike config mode pool will dynamically assign the ip address, dns server, wins server etc. To the vpn client connecting to this gateway. Properties ippooltype specifies whether a predefined ip pool or a static set of ip addresses should be used as ip address source...
3.12. Datetime description set the date, time and time zone information for this system. Properties timezone specifies the time zone. (default: gmt) dstenabled enable daylight saving time. (default: yes) dstoffset daylight saving time offset in minutes. (default: 60) dststartmonth what month dayligh...
3.13. Device description global parameters for this device. Properties name name of the device. (default: device) localcfgversion local version number of the configuration. (default: 1) configuser name of the user who committed the current configuration. (default: baseconfiguration) configsession se...
3.14. Dhcprelay description use a dhcp relay to dynamically alter the routing table according to relayed dhcp leases. Properties name specifies a symbolic name for the relay rule. (identifier) action ignore, relay or bootpfwd. (default: ignore) sourceinterface the source interface of the dhcp packet...
3.15. Dhcpserver description a dhcp server determines a set of ip addresses and host configuration parameters to hand out to dhcp clients attached to a given interface. Properties index the index of the object, starting at 1. (identifier) name specifies a symbolic name for the dhcp server rule. (ide...
Static dhcp server host entry properties host ip address of the host. Statichosttype identifier for host. (default: macaddress) macaddress the hardware address of the host. Clientidenttype type of client identifier specified. (default: ascii) clientident the client identifier for the host. Comments ...
3.16. Dns description configure the dns (domain name system) client settings. Properties dnsserver1 ip of the primary dns server. (optional) dnsserver2 ip of the secondary dns server. (optional) dnsserver3 ip of the tertiary dns server. (optional) comments text describing the current object. (option...
3.17. Driver this is a category that groups the following object types. 3.17.1. E1000ethernetpcidriver description intel (e1000) gigabit ethernet adaptor. Properties rxringsize rx ringsize. (default: 64) txringsize rx ringsize. (default: 256) enablemonitoring enable monitoring. (default: no) belowcp...
3.17.3. Ixp4npeethernetdriver description intel (ixp4xxnpe) fast ethernet adaptor. Properties comments text describing the current object. (optional) note this object type does not have an identifier and is identified by the name of the type only. There can only be one instance of this type. 3.17.4....
Description realtek (8169,8110) gigabit ethernet adaptor. Properties comments text describing the current object. (optional) note this object type does not have an identifier and is identified by the name of the type only. There can only be one instance of this type. 3.17.6. R8169ethernetpcidriver c...
3.18. Dynamicroutingrule description a dynamic routing policy rule creates a filter to catch statically configured or ospf learned routes. The matched routes can be controlled by the action rules to be either exported to ospf processes or to be added to one or more routing tables. Properties index t...
3.18.1. Dynamicroutingruleexportospf description an ospf action is used to manipulate and export new or changed routes to an ospf router pro- cess. Properties exporttoprocess specifies to which ospf process the route change should be exported. Settag specifies a tag for this route. This tag can be u...
Proxyarpallinterfaces always select all interfaces, including new ones, for publishing routes via proxy arp. (default: no) proxyarpinterfaces specifies the interfaces on which the security gateway should publish routes via proxy arp. (optional) comments text describing the current object. (optional)...
3.19. Ethernetdevice description hardware settings for an ethernet interface. Properties name specifies a symbolic name for the device. (identifier) ethernetdriver the ethernet pci driver that should be used by the interface. Pcibus pci bus number where the ethernet adapter is installed. Pcislot pci...
3.20. Highavailability description configure the high availability cluster parameters for this system. Properties enabled enable high availability. (default: no) clusterid a (locally) unique cluster id to use in identifying this group of ha security gateways. (default: 0) synciface specifies the int...
3.21. Httpalgbanners description http banner files specifies the look and feel of http alg restriction web pages. Properties name specifies a symbolic name for the http banner files. (identifier) compressionforbidden html for the compressionforbidden.Html web page. Contentforbidden html for the cont...
3.22. Httpauthbanners description http banner files specifies the look and feel of html authentication web pages. Properties name specifies a symbolic name for the http banner files. (identifier) formlogin html for the formlogin.Html web page. Loginsuccess html for the loginsuccess.Html web page. Lo...
3.23. Httpposter description use the http poster for dynamic dns or automatic logon to services using web-based authentica- tion. Properties url1 the first url that will be posted when the security gateway is loaded. (optional) url2 the second url that will be posted when the security gateway is loa...
3.24. Hwm description hardware monitoring allows monitoring of hardware sensors. Properties name specifies a symbolic name for the object. Type type of monitoring. Sensor sensor index. Minlimit lower limit. (optional) maxlimit upper limit. (optional) enablemonitoring enable/disable monitoring. (defa...
3.25. Idlist description an id list contains ids, which are used within the authentication process when establishing an ipsec tunnel. Properties name specifies a symbolic name for the id list. (identifier) comments text describing the current object. (optional) 3.25.1. Id description an id is used t...
3.26. Idprule description an idp rule defines a filter for matching specific network traffic. When the filter criterion is met, the idp rule actions are evaluated and possible actions taken. Properties index the index of the object, starting at 1. (identifier) name specifies a symbolic name for the ...
Properties action specifies what action to take if the given signature is found. (default: audit) signatures specifies what signature(s) to search for in the network traffic. (optional) zonedefense activate zonedefense. (default: no) blacklist activate blacklist. (default: no) blacklisttimetoblock t...
3.27. Igmprule description an igmp rule specifies how to handle inbound igmp reports and outbound igmp queries. Properties index the index of the object, starting at 1. (identifier) name specifies a symbolic name for the rule. (optional) type the type of igmp messages the rule applies to. (default: ...
Note if no index is specified when creating an instance of this type, the object will be placed last in the list and the index will be equal to the length of the list. 3.27. Igmprule chapter 3. Configuration reference 129.
3.28. Igmpsetting description igmp parameters can be tuned for one, or a group of interfaces in order to match the characteristics of a network. Properties name specifies a symbolic name for the object. (identifier) interface the interfaces that these settings should apply to. Robustnessvariable igm...
3.29. Ikealgorithms description configure algorithms which are used in the ike phase of an ipsec session. Properties name specifies a symbolic name for the object. (identifier) nullenabled enable plaintext. (default: no) desenabled enable des encryption algorithm. (default: no) des3enabled enable 3d...
3.30. Interface this is a category that groups the following object types. 3.30.1. Defaultinterface description a special interface used to represent internal mechanisms in the system as well as an abstract "any" interface. Properties name specifies a symbolic name for the interface. (identifier) co...
Added automatically for this interface. (default: no) autointerfacenetworkroute automatically add a route for this interface using the given network. (default: yes) autodefaultgatewayroute automatically add a default route for this interface using the given default gateway. (default: yes) dhcpdns1 i...
Description use an interface group to combine several interfaces for a simplified security policy. Properties name specifies a symbolic name for the interface. (identifier) equivalent specifies if the interfaces should be considered security equivalent, that means that if enabled the interface group...
Encryption and authentication session keys. (default: 3600) ipseclifetimekilobytes the lifetime of the ipsec connection in kilobytes. (default: 0) encapsulationmode specifies if the ipsec tunnel should use tunnel or transport mode. (default: tunnel) authmethod certificate or pre-shared key. Psk sele...
Net) deadpeerdetection enable dead peer detection. (default: yes) nattraversal enable or disable nat traversal. (default: onifneeded) keepalive disabled, auto or manual. (default: disabled) keepalivesourceip source ip address used when sending keep-alive icmp pings. Keepalivedestinationip destinatio...
Pppauthpap use pap authentication protocol for this tunnel. User name and password are sent in plaintext. (default: yes) pppauthchap use chap authentication protocol for this tunnel. (default: yes) pppauthmschap use ms-chap authentication protocol for this tunnel. (default: yes) pppauthmschapv2 use ...
Tunnelprotocol specifies if pptp or l2tp should be used for this tunnel. (default: pptp) interface the interface that the pptp/l2tp server should be listening on. Serverip specifies the ip that the pptp/l2tp server should listen on, this can be an ip of a interface, or for example an arp published i...
Name specifies a symbolic name for the interface. (identifier) ethernetinterface the physical ethernet interface that connects to the pppoe server network. Ip the host name to store the assigned ip address in. Network the network from which traffic should be routed into the tun- nel. Dns1 ip of the ...
3.30.9. Sslvpninterface description an ssl vpn interface, together with the bundled client, creates an easy to use tunnel solution for roaming users. Properties name specifies a symbolic name for the interface. (identifier) outerinterface the physical interface that the ssl vpn interface will listen...
Broadcast specifies the broadcast address of the virtual lan interface. (optional) privateip the private ip address of this high availability node. (optional) metric specifies the metric for the auto-created route. (default: 100) autoswitchroute enable transparent mode, which means that a switch rou...
3.31. Ippool description an ip pool is a dynamic object which consists of ip leases that are fetched from a dhcp server. The ip pool is used as an address source by subsystems that may need to distribute addresses, e.G. By ipsec in configuration mode. Properties name specifies a symbolic name for th...
3.32. Iprule description an ip rule specifies what action to perform on network traffic that matches the specified filter criter- ia. Properties index the index of the object, starting at 1. (identifier) name specifies a symbolic name for the rule. (optional) action reject, drop, fwdfast, allow, nat...
Slbnetsize specifies network size for network stickiness. (default: 24) slbnewport rewrite destination port to this port. (optional) slbmonitorroutingtable routing table used for server monitoring. (default: main) slbmonitorping enable monitoring using icmp ping packets. (default: no) slbpingpolling...
Nections for connection-rate algorithm. (default: 10) requireigmp multicast traffic must have been requested using igmp be- fore it is forwarded. (default: yes) multiplexargument specifies how the traffic should be forwarded and translated. Multiplexalltoone rewrite all destination ips to a single i...
3.33. Iprulefolder description an ip rule folder can be used to group ip rules into logical groups for better overview and simpli- fied management. Properties index the index of the object, starting at 1. (identifier) name specifies the name of the folder. Comments text describing the current object...
3.34. Ipsecalgorithms description configure algorithms which are used in the ipsec phase of an ipsec session. Properties name specifies a symbolic name for the object. (identifier) nullenabled enable plaintext. (default: no) desenabled enable des encryption algorithm. (default: no) des3enabled enabl...
3.35. Ldapdatabase description external ldap server used to verify user names and passwords. Properties name specifies a symbolic name for the server. (identifier) ip the ip address of the server. Port the tcp port of the server. (default: 389) timeout the timeout, in milliseconds, used when process...
3.36. Ldapserver description an ldap server is used as a central repository of certificates and crls that the security gateway can download when necessary. Properties host specifies the ip address or hostname of the ldap server. Username specifies the username to use when accessing the ldap server. ...
3.37. Linkmonitor description the link monitor allows the system to monitor one or more hosts and take action if they are un- reachable. Properties action specifies what action the system should take. Addresses specifies the addresses that should be monitored. Maxloss a single host is considered unr...
3.38. Localuserdatabase description a local user database contains user accounts used for authentication purposes. Properties name specifies a symbolic name for the object. (identifier) comments text describing the current object. (optional) 3.38.1. User description user credentials may be used in u...
3.39. Logreceiver this is a category that groups the following object types. 3.39.1. Eventreceiversnmp2c description a snmp2c event receiver is used to receive snmp events from the system. Properties name specifies a symbolic name for the log receiver. (identifier) ipaddress destination ip address. ...
3.39.2. Logreceivermemory description a memory log receiver is used to receive and keep log events in system ram. Properties name specifies a symbolic name for the log receiver. (identifier) logseverity specifies with what severity log events will be sent to the specified log receiv- ers. (optional;...
Comments text describing the current object. (optional) 3.39.4. Logreceiversyslog description a syslog receiver is used to receive log events from the system in the standard syslog format. Properties name specifies a symbolic name for the log receiver. (identifier) ipaddress specifies the ip address...
3.40. Natpool description a nat pool is used for nating multiple concurrent connections to using different source ip ad- dresses. Properties name specifies a symbolic name for the nat pool. (identifier) type specifies how nat'ed connections are assigned a nat ip ad- dress. (default: stateful) ipsour...
3.41. Ospfprocess description an ospf router process defines a group of routers exchanging routing information via the open shortest path first routing protocol. Properties name specifies a symbolic name for the ospf process. (identifier) routerid specifies the ip address that is used to identify th...
Cifies the details of the log. (default: off) debugroute enables or disabled logging of routing table manipulation events and also specifies the details of the log. (default: off) authtype specifies the authentication type for the ospf protocol exchanges. (default: none) authpassphrase specifies the...
Properties interface specifies which interface in the security gateway will be used for this os- pf interface. (identifier) type auto, broadcast, point-to-point or point-to-multipoint. (default: auto) network specifies the network related to the configured ospf interface. (optional) metrictype metri...
Description for point-to-point and point-to-multipoint networks, specify the ip addresses of directly connected routers. Properties interface specifies the ospf interface of the neighbor. Ipaddress ip address of the neighbor. Metric specifies the metric of the neighbor. (optional) comments text desc...
Routerid the id of the router on the other side of the virtual link. Usedefaultauth use the authentication configuration specified in the ospf process. (default: yes) authtype specifies the authentication type for the ospf protocol exchanges. (default: none) authpassphrase specifies the passphrase u...
3.42. Pipe description a pipe defines basic traffic shaping parameters. The pipe rules then determines which traffic goes through which pipes. Properties name specifies a symbolic name for the pipe. (identifier) limitkbpstotal total bandwidth limit for this pipe in kilobits per second. (optional) li...
Userlimitpps0 specifies the throughput limit per group in pps for precedence 0 (the lowest precedence). (optional) userlimitkbps1 specifies the bandwidth limit per group in kbps for precedence 1. (optional) userlimitpps1 specifies the throughput limit per group in pps for precedence 1. (optional) us...
(default: 7) comments text describing the current object. (optional) 3.42. Pipe chapter 3. Configuration reference 163.
3.43. Piperule description a pipe rule determines traffic shaping policy - which pipes to use - for one or more types of traffic with the same granularity as the standard ruleset. Properties index the index of the object, starting at 1. (identifier) name specifies a symbolic name for the object. (op...
3.44. Psk description psk (pre-shared key) authentication is based on a shared secret that is known only by the parties involved. Properties name specifies a symbolic name for the pre-shared key. (identifier) type specifies the type of the shared key. Pskascii specifies the psk as a passphrase. Pskh...
3.45. Radiusaccounting description external radius server used to collect user statistics. Properties name specifies a symbolic name for the server. (identifier) ipaddress the ip address of the server. Port the udp port of the server. (default: 1813) retrytimeout the retry timeout, in seconds, used ...
3.46. Radiusserver description external radius server used to verify user names and passwords. Properties name specifies a symbolic name for the server. (identifier) ipaddress the ip address of the server. Port the udp port of the server. (default: 1812) retrytimeout the retry timeout, in seconds, u...
3.47. Remoteidlist description list of remote ids that are allowed access when using pre shared keys as authentication method. Properties type specifies the type of the shared key. Pskascii specifies the psk as a passphrase. Pskhex specifies the psk as a hexadecimal key. Idtype selects the type of r...
3.48. Remotemanagement this is a category that groups the following object types. 3.48.1. Remotemgmthttp description configure http/https management to enable remote management to the system. Properties name specifies a symbolic name for the object. (identifier) interface specifies the interface for...
Properties name specifies a symbolic name for the ssh server. (identifier) interface specifies the interface for which remote access is granted. Port the listening port for the ssh server. (default: 22) allowauthmethodpassword allow password client authentication. (default: yes) allowauthmethodpubli...
Comments text describing the current object. (optional) 3.48.3. Remotemgmtssh chapter 3. Configuration reference 171.
3.49. Routebalancinginstance description a route balancing instance is assoicated with a routingtable and defines how to make use of multiple routes to the same destination. Properties routingtable specify routingtable to deploy route load balancing in. (identifier) algorithm specify which algorithm...
3.50. Routebalancingspilloversettings description settings associated with the spillover algorithm. Properties interface interface to threshold limit. (identifier) holdtime number of consecutive seconds over/under the threshold limit to trig- ger state change for the affected routes. (default: 30) o...
3.51. Routingrule description a routing rule forces the use of a routing table in the forward and/or return direction of traffic on a connection. The ordering parameter of the routing table determines if it is consulted before or after the main routing table. Properties index the index of the object...
3.52. Routingtable description the system has a predefined main routing table. Alternate routing tables can be defined by the user. Properties name specifies a symbolic name for the routing table. (identifier) ordering specifies how a route lookup is done in a named routing ta- ble. (default: only) ...
1000) enablehostmonitoring enables the host monitoring functionality. (default: no) reachability specifies the number of hosts that are required to be reach- able to consider the route to be active. (default: all) graceperiod specifies the time to wait after a reconfiguration until the monitoring be...
Requesturl specifies the http url to monitor. Expectedresponse expected http response. Comments text describing the current object. (optional) note if no index is specified when creating an instance of this type, the object will be placed last in the list and the index will be equal to the length of...
3.53. Scheduleprofile description a schedule profile defines days and dates and are then used by the various policies in the system. Properties name specifies a symbolic name for the service. (identifier) mon specifies during which intervals the schedule profile is active on mondays. (optional) tue ...
3.54. Service this is a category that groups the following object types. 3.54.1. Servicegroup description a service group is a collection of service objects, which can then be used by different policies in the system. Properties name specifies a symbolic name for the service. (identifier) members gr...
Echoreplycodes specifies which echo reply message codes should be matched. (default: 0-255) sourcequenching enable matching of source quenching messages. (default: no) sourcequenchingcodes specifies which source quenching message codes should be matched. (default: 0-255) timeexceeded enable matching...
Properties name specifies a symbolic name for the service. (identifier) destinationports specifies the destination port or the port ranges applicable to this ser- vice. Type specifies whether this service uses the tcp or udp protocol or both. (default: tcp) sourceports specifies the source port or t...
3.55. Settings this is a category that groups the following object types. 3.55.1. Arptablesettings description advanced arp-table settings. Properties arpmatchenetsender the ethernet sender address matching the hardware address in the arp data. (default: droplog) arpquerynosenderip if the ip source ...
3.55.2. Authenticationsettings description settings related to authentication and accounting. Properties logoutaccusersatshutdown logout authenticated accounting users and send accounting- stop packets prior to shutdown. (default: yes) allowauthifnoaccountingre- sponse allow an authenticated user to...
Note this object type does not have an identifier and is identified by the name of the type only. There can only be one instance of this type. 3.55.4. Dhcprelaysettings description advanced dhcp relay settings. Properties maxtransactions maximum number of concurrent bootp/dhcp transactions. (default...
Note this object type does not have an identifier and is identified by the name of the type only. There can only be one instance of this type. 3.55.6. Fragsettings description settings related to fragmented packets. Properties pseudoreass_maxconcurrent maximum number of concurrent fragment reassembl...
General settings for hardware monitoring properties enablesensors enable/disable all hwm functionality. (default: no) sensorpollinterval sensor polling interval. (default: 500) memorypollinterval memory polling interval in minutes. (default: 15) memoryusepercent should mem monitor use percentage as ...
Settings for the ipsec tunnel interfaces used for establishing ipsec vpn connections to and from this system. Properties ipsecmaxtunnels amount of ipsec tunnels allowed (0 = automatic). (default: 0) ipsecmaxrules amount of ipsec rules allowed (0 = automatic). (default: 0) ikesendinitialcontact send ...
Description settings related to the ip protocol. Properties logchecksumerrors log ip packets with bad checksums. (default: yes) lognonip4 log occurrences of non-ipv4 packets. (default: yes) logreceivedttl0 log received packets with ttl=0; this should never happen! (default: yes) log0000src log inval...
Iprf how to handle the ip reserved flag, if set; it should never be. (default: droplog) stripdfonsmall strip the "dontfragment" flag for packets of this size or smal- ler. (default: 65535) multicastipenetonmismatch what action to take when ethernet and ip multicast addresses do not match. (default: ...
Maxahlen ipsec ah; authenticated communication. (default: 2000) maxskiplen skip; simple key management for ip, vpn protocol. (default: 2000) maxospflen ospf; open shortest path first, routing protocol. (default: 1480) maxipiplen ipip/fwz; encapsulated (tunneled) transport, used by vpn-1. (default: 2...
Logsendperseclimit limits how many log packets the security gateway may send out per second. (default: 2000) note this object type does not have an identifier and is identified by the name of the type only. There can only be one instance of this type. 3.55.15. Miscsettings description miscellaneous ...
Igmpqueryinterval the interval (ms) between general queries sent by the secur- ity gateway. (default: 125000) igmpqueryresponseinterval the maximum time (ms) until a host/client has to send an an- swer to a query. (default: 10000) igmpstartupqueryinterval the general query interval (ms) to use durin...
Configured ip rules. (default: yes) snmprequestlimit maximum number of snmp packets that will be processed each second. (default: 100) snmpsyscontact the contact person for this managed node. (default: n/a) snmpsysname the name for this managed node. (default: n/a) snmpsyslocation the physical locat...
Transp_camsize_dynamic allocate the cam size value dynamically. (default: yes) transp_camsize maximum number of entries in each cam table. (default: 8192) transp_l3csize_dynamic allocate the l3 cache size value dynamically. (default: yes) transp_l3csize maximum number of entries in each layer 3 cach...
Note this object type does not have an identifier and is identified by the name of the type only. There can only be one instance of this type. 3.55.20. Sslvpninterfacesettings description ssl vpn interface settings. Properties sslvpnbeforerules pass ssl vpn connections sent to the security gateway d...
Maxconnections_dynamic allocate the max connection value dynamically. (default: yes) maxconnections maximum number of simultaneous connections. (default: 8192) note this object type does not have an identifier and is identified by the name of the type only. There can only be one instance of this typ...
Tcp- opt_altchkdata the altchkdata (alternate checksum data) option. (default: striplog) tcpopt_cc the cc (connection count) option series (semi common). (default: striplogbad) tcpopt_other how to handle tcp options not specified above. (default: striplog) tcpsynurg the tcp urg flag together with sy...
Note this object type does not have an identifier and is identified by the name of the type only. There can only be one instance of this type. 3.55.23. Vlansettings chapter 3. Configuration reference 198.
3.56. Sshclientkey description the public key of the client connecting to the ssh server. Properties name specifies a symbolic name for the key. (identifier) type dsa or rsa. (default: dsa) subject value of the subject header tag of the public key file. (optional) publickey specifies the public key....
3.57. Thresholdrule description a threshold rule defines a filter for matching specific network traffic. When the filter criterion is met, the threshold rule actions are evaluated and possible actions taken. Properties index the index of the object, starting at 1. (identifier) name specifies a symbo...
Thresholdunit specifies the threshold unit. (default: connssec) zonedefense activate zonedefense. (default: no) blacklist activate blacklist. (default: no) blacklisttimetoblock the number of seconds that the dynamic black list should re- main. (optional) blacklistblockonlyservice only block the serv...
3.58. Updatecenter description configure automatical updates. Properties avenabled automatic updates of antivirus definitions and engine. (default: no) idpenabled automatic updates of idp maintenance signatures. (default: no) advancedidpenabled automatic updates of advanced idp signatures. (default:...
3.59. Userauthrule description the user authentication ruleset specifies from where users are allowed to authenticate to the sys- tem, and how. Properties index the index of the object, starting at 1. (identifier) name specifies a symbolic name for the rule. (optional) agent http, https, xauth, ppp ...
Pppauthmschap use ms-chap authentication protocol. (default: yes) pppauthmschapv2 use ms-chap v2 authentication protocol. (default: yes) idletimeout if a user has successfully been authenticated, and no traffic has been seen from his ip address for this number of seconds, he/she will automatically b...
3.60. Zonedefenseblock description manually configured blocks are used to block a host/network on the switches either by default or based on schedule. Properties addresses specifies the addresses to block. Protocol all, tcp, udp or icmp. (default: all) port specifies which udp or tcp port to use. (d...
3.61. Zonedefenseexcludelist description the exclude list is used exclude certain hosts/networks from being blocked out by idp/threshold rule violations. Properties addresses specifies the addresses that should not be blocked. (optional) comments text describing the current object. (optional) note t...
3.62. Zonedefenseswitch description a zonedefense switch will have its acls controlled and hosts/networks violating the idp/ threshold rules will be blocked directly on the switch. Properties name specifies a symbolic name for the zonedefense switch. (identifier) switchmodel specifies the switch mod...
3.62. Zonedefenseswitch chapter 3. Configuration reference 208.
Index commands a about, 31 activate, 20 add, 20 alarm, 31 arp, 31 arpsnoop, 32 ats, 33 b bigpond, 33 blacklist, 34 buffers, 35 c cam, 36 cancel, 21 cc, 22 certcache, 36 cfglog, 36 commit, 23 connections, 37 cpuid, 38 crashdump, 38 cryptostat, 38 d dconsole, 39 delete, 23 dhcp, 39 dhcprelay, 40 dhcps...
Sipalg, 68 sshserver, 70 sslvpn, 71 stats, 72 sysmsgs, 72 t techsupport, 72 time, 72 u uarules, 73 undelete, 29 updatecenter, 74 userauth, 74 v vlan, 75 vpnstats, 76 (see also ipsecstats) z zonedefense, 76 object types a access, 84 addressfolder, 86 advancedscheduleoccurrence, 89 advancedschedulepro...
Ipsectunnelsettings, 186 ipsettings, 187 ixgbeethernetpcidriver, 113 ixp4npeethernetdriver, 114 l l2tpclient, 136 l2tpserver, 137 l2tpserversettings, 189 ldapdatabase, 148 ldapserver, 149 lengthlimsettings, 189 linkmonitor, 150 localreasssettings, 190 localuserdatabase, 151 loginclientbigpond, 103 l...
