Interface Groups - D-Link NetDefendOS User Manual

C. Now, return to the first loopback interface and set the LoopTo property:
gw-world:/> set Interface LoopbackInterface LB1 LoopTo=LB2

3.4.10. Interface Groups

Any set of NetDefendOS interfaces can be grouped together into an Interface Group. This then
acts as a single NetDefendOS configuration object which can be used in creating security policies
in the place of a single group. When a group is used, for example, as the source interface in an IP
rule , any of the interfaces in the group could provide a match for the rule.
A group can consist of ordinary Ethernet interfaces or it could consist of other types such as
VLAN interfaces or VPN Tunnels. Also, the members of a group do not need to be of the same
type. A group might consist, for example, of a combination of two Ethernet interfaces and four
VLAN interfaces.
The Security/Transport Equivalent Option
When creating an interface group, the option Security/Transport Equivalent can be enabled (it is
disabled by default). Enabling the option means that the group can be used as the destination
interface in NetDefendOS rules where connections might need to be moved between two
interfaces. For example, the interface might change with route failover or OSPF.
If a connection is moved from one interface to another within a group and Security/Transport
Equivalent is enabled, NetDefendOS will not check the connection against the NetDefendOS rule
sets with the new interface.
With the option disabled, a connection cannot be moved to another interface in the group and is
instead dropped and must be reopened. This new connection is then checked against the
NetDefendOS rule sets. In some cases, such as an alternative interface that is much slower, it may
not be sensible to allow certain connections over the new interface.
Example 3.26. Creating an Interface Group
Command-Line Interface
gw-world:/> add Interface InterfaceGroup examplegroup
Web Interface
1. Go to: Network > Interfaces and VPN > Interface Groups > Add > InterfaceGroup
2. Enter the following information to define the group:
• Name: The name of the group to be used later
• Security/Transport Equivalent: If enabled, the interface group can be used as a
destination interface in rules where connections might need to be moved between the
Members=exampleIf1,exampleIf2
218
Chapter 3: Fundamentals