D-Link NetDefend DFL-210 Cli Reference Manual
  1. Manuals
  2. Brands
  3. D-Link Manuals
  4. Firewall
  5. DFL-210 - NetDefend - Security Appliance
  6. Cli reference manual

D-Link NetDefend DFL-210 Cli Reference Manual

Network security firewall
Hide thumbs Also See for NetDefend DFL-210:
Table of Contents

Advertisement

Quick Links

Download this manual See also: User Manual, Quick Manual
Network Security Firewall
CLI Reference Guide
DFL-210/ 800/1600/ 2500
DFL-260/ 860/1660/ 2560(G)
Security
Security
Ver
2.27.01
Network Security Solution
http://www.dlink.com

Advertisement

Table of Contents
loading
Need help?

Need help?

Do you have a question about the NetDefend DFL-210 and is the answer not in the manual?

Questions and answers

Subscribe to Our Youtube Channel

Related Manuals for D-Link NetDefend DFL-210

Summary of Contents for D-Link NetDefend DFL-210

  • Page 1 Network Security Firewall CLI Reference Guide DFL-210/ 800/1600/ 2500 DFL-260/ 860/1660/ 2560(G) Security Security 2.27.01 Network Security Solution http://www.dlink.com...
  • Page 2 CLI Reference Guide DFL-210/260/800/860/1600/1660/2500/2560/2560G NetDefendOS version 2.27.01 D-Link Corporation No. 289, Sinhu 3rd Rd, Neihu District, Taipei City 114, Taiwan R.O.C. http://www.DLink.com Published 2010-06-22 Copyright © 2010...
  • Page 3 D-Link reserves the right to revise this publication and to make changes from time to time in the content hereof without any obligation to notify any person or parties of such revision or changes.

  • Page 4: Table Of Contents

    Table of Contents Preface .......................10 1. Introduction .....................12 1.1. Running a command ................12 1.2. Help ....................13 1.2.1. Help for commands ..............13 1.2.2. Help for object types ..............13 1.3. Function keys ..................14 1.4. Command line history ................15 1.5. Tab completion ..................16 1.5.1.
  • Page 5 CLI Reference Guide 2.2.30. ifstat ..................47 2.2.31. igmp ..................47 2.2.32. ikesnoop ...................48 2.2.33. ippool ..................49 2.2.34. ipsecglobalstats ................49 2.2.35. ipseckeepalive ................50 2.2.36. ipsecstats ..................50 2.2.37. ipsectunnels ................51 2.2.38. killsa ..................51 2.2.39. languagefiles ................52 2.2.40. ldap ..................52 2.2.41. license ..................53 2.2.42. linkmon ..................53 2.2.43.
  • Page 6 CLI Reference Guide 3.3.1. AdvancedScheduleOccurrence ............90 3.4. ALG ....................91 3.4.1. ALG_FTP ..................91 3.4.2. ALG_H323 ................92 3.4.3. ALG_HTTP ................92 3.4.4. ALG_POP3 ................94 3.4.5. ALG_PPTP ................94 3.4.6. ALG_SIP ...................95 3.4.7. ALG_SMTP ................95 3.4.8. ALG_TFTP ................97 3.4.9. ALG_TLS ..................98 3.5. ARP ....................99 3.6. BlacklistWhiteHost ................100 3.7.
  • Page 7 CLI Reference Guide 3.30.6. L2TPClient ................139 3.30.7. L2TPServer ................140 3.30.8. LoopbackInterface ..............141 3.30.9. PPPoETunnel ................142 3.30.10. VLAN .................. 143 3.31. IPPool ....................145 3.32. IPRuleSet ..................146 3.32.1. IPRule ................... 146 3.32.2. IPRuleFolder ................148 3.33. IPsecAlgorithms ................. 150 3.34.
  • Page 8 CLI Reference Guide 3.55.16. MiscSettings ................196 3.55.17. MulticastSettings ..............197 3.55.18. RemoteMgmtSettings .............. 198 3.55.19. RoutingSettings ..............199 3.55.20. SSLSettings ................200 3.55.21. StateSettings ................201 3.55.22. TCPSettings ................202 3.55.23. VLANSettings ............... 203 3.56. SSHClientKey ................... 204 3.57. ThresholdRule ................... 205 3.57.1.
  • Page 9 List of Examples 1. Command option notation ..................10 1.1. Help for commands ..................13 1.2. Help for object types ..................13 1.3. Command line history ..................15 1.4. Tab completion ....................16 1.5. Inline help ....................16 1.6. Edit an existing property value ................17 1.7. Using categories with tab completion ..............17 2.1.

  • Page 10: Preface

    Administrators that are responsible for configuring and managing the D-Link Firewall. • Administrators that are responsible for troubleshooting the D-Link Firewall. This guide assumes that the reader is familiar with the D-Link Firewall, and has the necessary basic knowledge in network security. Notation...
  • Page 11 Notation Preface Because the table name option is followed by ellipses it is possible to specify more than one routing table. Since table name is optional as well, the user can specify zero or more policy-based routing tables. gw-world:/> routes Virroute Virroute2...

  • Page 12: Introduction

    Chapter 1. Introduction • Running a command, page 12 • Help, page 13 • Function keys, page 14 • Command line history, page 15 • Tab completion, page 16 • User roles, page 18 This guide is a reference for all commands and configuration object types that are available in the command line interface for NetDefendOS.

  • Page 13: Help

    1.2. Help Chapter 1. Introduction 1.2. Help 1.2.1. Help for commands There are two ways of getting help about a command. A brief help is displayed if the command name is typed followed by -? or -h. This applies to all commands and is therefore not listed in the option list for each command in this guide.

  • Page 14: Function Keys

    1.3. Function keys Chapter 1. Introduction 1.3. Function keys In addition to the return key there are a number of function keys that are used in the CLI. Backspace Delete the character to the left of the cursor. Complete current word. Ctrl-A or Home Move the cursor to the beginning of the line.

  • Page 15: Command Line History

    1.4. Command line history Chapter 1. Introduction 1.4. Command line history Every time a command is run, the command line is added to a history list. The up and down arrow keys are used to access previous command lines (up arrow for older command lines and down arrow to move back to a newer command line).

  • Page 16: Tab Completion

    1.5. Tab completion Chapter 1. Introduction 1.5. Tab completion By using the tab function key in the CLI the names of commands, options, objects and object prop- erties can be automatically completed. If the text entered before pressing tab only matches one pos- sible item, e.g.

  • Page 17: Configuration Object Type Categories

    1.5.3. Configuration object type cat- Chapter 1. Introduction egories If "." is entered instead of a property value and tab is pressed it will be replaced by the current value of that property. This is useful when editing an existing list of items or a long text value. The "<"...

  • Page 18: User Roles

    1.6. User roles Chapter 1. Introduction 1.6. User roles Some commands and options cannot be used unless the logged in user has administrator priviege. This is indicated in this guide by a note following the command or "Admin only" written next to an option.
  • Page 19 1.6. User roles Chapter 1. Introduction...

  • Page 20: Command Reference

    Chapter 2. Command Reference • Configuration, page 20 • Runtime, page 31 • Utility, page 78 • Misc, page 79 2.1. Configuration 2.1.1. activate Activate changes. Description Activate the latest changes. This will issue a reconfiguration, using the new configuration. If the reconfiguration is successful a commit command must be issued within the configured timeout interval in order to save the changes to media.

  • Page 21: Cancel

    2.1.3. cancel Chapter 2. Command Reference Example 2.1. Create a new object Add objects with an identifier property (not index): gw-world:/> add Address IP4Address example_ip Address=1.2.3.4 Comments="This is an example" gw-world:/> add IP4Address example_ip2 Address=2.3.4.5 Add an object with an index: gw-world:/main>...

  • Page 22: Change Context

    2.1.4. cc Chapter 2. Command Reference Note Requires Administrator privilege. 2.1.4. cc Change the current context. Description Change the current configuration context. A context is a group of objects that are dependent on and grouped by a parent object. Many objects lie in the "root"...

  • Page 23: Commit

    2.1.5. commit Chapter 2. Command Reference <Identifier> The property that identifies the configuration object. May not be applicable depending on the specified <Type>. <Type> Type of configuration object to perform operation on. 2.1.5. commit Save new configuration to media. Description Save the new configuration to media.

  • Page 24: Pskgen

    2.1.7. pskgen Chapter 2. Command Reference Options -force Force object to be deleted even if it's used by other objects or has children. <Category> Category that groups object types. <Identifier> The property that identifies the configuration object. May not be applicable depending on the specified <Type>.

  • Page 25: Reject Changes

    2.1.8. reject Chapter 2. Command Reference All changes made to the object will be lost. If the object is added after the last commit, it will be re- moved. To reject the changes in more than one object, use either the -recursive flag to delete a context and all its children recursively or the -all flag to reject the changes in all objects in the configura- tion.

  • Page 26: Reset

    2.1.9. reset Chapter 2. Command Reference Note Requires Administrator privilege. 2.1.9. reset Reset unit configuration and/or binaries. Description Reset configuration to the base configuration as generated by the current core or reset binaries to factory defaults. Usage reset -configuration Reset the configuration to factory defaults. reset -unit Reset the unit to factory defaults.

  • Page 27: Show

    2.1.11. show Chapter 2. Command Reference Example 2.5. Set property values Set properties for objects that have an identifier property: gw-world:/> set Address IP4Address example_ip Address=1.2.3.4 Comments="This is an example" gw-world:/> set IP4Address example_ip2 Address=2.3.4.5 Comments=comment_without_whitespace gw-world:/main> set Route 1 Comment="A route" gw-world:/>...

  • Page 28: Show Objects

    2.1.11. show Chapter 2. Command Reference When showing a table of all objects of a certain type, the status of each object since the last time the configuration was committed is indicated by a flag. The flags used are: The object is deleted. The object is disabled.

  • Page 29: Undelete

    2.1.12. undelete Chapter 2. Command Reference Show all changes. Options -changes Show all changes in the current configuration. -disabled Show disabled properties. -errors Show all errors in the current configuration. -references Show all references to this object from other objects. -verbose Show error details.
  • Page 30 2.1.12. undelete Chapter 2. Command Reference <Identifier> The property that identifies the configuration object. May not be applicable depending on the specified <Type>. <Type> Type of configuration object to perform operation on. Note Requires Administrator privilege.

  • Page 31: Runtime

    2.2. Runtime Chapter 2. Command Reference 2.2. Runtime 2.2.1. about Show copyright/build information. Description Show copyright and build information. Usage about 2.2.2. alarm Show alarm information. Description Show list of currently active alarms. Usage alarm [-history] [-active] Options -active Show the currently active alarms. -history Show the 20 latest alarms.

  • Page 32: Arpsnoop

    2.2.4. arpsnoop Chapter 2. Command Reference Show all ARP entries. arp -show [<Interface>] [-ip=<pattern>] [-hw=<pattern>] [-num=<n>] Show ARP entries. arp -hashinfo [<Interface>] Show information on hash table health. arp -flush [<Interface>] Flush ARP cache of specified interface. arp -notify=<ip> [<Interface>] [-hwsender=<Ethernet Address>] Send gratuitous ARP for IP.

  • Page 33: Ats

    2.2.5. ats Chapter 2. Command Reference Show snooped interfaces. arpsnoop {ALL | NONE | <interface>} [-verbose] Snoop specified interface. Options -verbose Verbose. {ALL | NONE | <interface>} Interface name. 2.2.5. ats Show active ARP Transaction States. Description Show active ARP Transaction States. Usage ats [-num=<n>] Options...

  • Page 34: Buffers

    2.2.7. buffers Chapter 2. Command Reference Usage blacklist -show [-creationtime] [-dynamic] [-listtime] [-info] [-black] [-white] [-all] Show information about the blacklisted hosts. blacklist -block <host> [-serv=<service>] [-prot={TCP | UDP | ICMP | OTHER | TCPUDP | ALL}] [-port=<port number>] [-dest=<ip address>] [-time=<seconds>] Block specified netobject.

  • Page 35: Cam

    2.2.8. cam Chapter 2. Command Reference List packet buffers or the contents of a buffer. Description Lists the 20 most recently freed packet buffers, or in-depth information about a specific buffer. Usage buffers List the 20 most recently freed buffers. buffers -recent Decode the most recently freed buffer.

  • Page 36: Certcache

    2.2.9. certcache Chapter 2. Command Reference Flush CAM table information. Options -flush Flush CAM table. If interface is specified, only entries using this interface are flushed. (Admin only) -num=<n> Limit list to <n> entries per CAM table. (Default: 20) <Interface> Interface.

  • Page 37: Cpuid

    2.2.12. cpuid Chapter 2. Command Reference connections -show [-num=<n>] [-verbose] [-srciface=<interface>] [-destiface=<interface>] [-protocol=<name/num>] [-srcport=<port>] [-destport=<port>] [-srcip=<ip addr>] [-destip=<ip addr>] List connections. connections Same as "connections -show". connections -close [-all] [-srciface=<interface>] [-destiface=<interface>] [-protocol=<name/num>] [-srcport=<port>] [-destport=<port>] [-srcip=<ip addr>] [-destip=<ip addr>] Close connections. Options -all Mark all connections.

  • Page 38: Crashdump

    2.2.14. cryptostat Chapter 2. Command Reference 2.2.13. crashdump Show the contents of the crash.dmp file. Description Show the contents of the crash.dmp file, if it exists. Usage crashdump 2.2.14. cryptostat Show information about crypto accelerators. Description Show information about installed crypto accelerators. Usage cryptostat 2.2.15.

  • Page 39: Dhcp

    2.2.16. dhcp Chapter 2. Command Reference -onlyhigh Only show entries with severity high. (Admin only) 2.2.16. dhcp Display information about DHCP-enabled interfaces or modify/update their leases. Description Display information about a DHCP-enabled interface. Usage dhcp List DHCP enabled interfaces. dhcp -list List DHCP enabled interfaces.

  • Page 40: Dhcpserver

    2.2.18. dhcpserver Chapter 2. Command Reference dhcprelay Show the currently relayed DHCP sessions. dhcprelay -show [-rules] [-routes] [<display filter>]... Show DHCP/BOOTP relayer ruleset. dhcprelay -release <ip address> [-interface=<Interface>] Terminate relayed session. Options -interface=<Interface> Interface. -release Terminate relayed session <[interface:]ip>. (Admin only) -routes Show the currently relayed DHCP sessions.

  • Page 41: Dns

    2.2.19. dns Chapter 2. Command Reference Release an active IP. Options -fromentry=<Integer> Shows dhcp server lease list from offset <n>. -leases Show DHCP server leases. -mappings Show DHCP server IP mappings. -num=<Integer> Limit list to <n> leases. -release={BLACKLIST} Release specific type of IPs. (Admin only) -releaseip Release an active IP.

  • Page 42: Dynroute

    2.2.21. dynroute Chapter 2. Command Reference Description Show status of DNSBL. Usage dnsbl [-show] [<SMTP ALG>] [-clean] Options -clean Clear DNSBL statistics for ALG. -show Show DNSBL statistics for ALG. <SMTP ALG> Name of SMTP ALG. 2.2.21. dynroute Show dynamic routing policy. Description Show the dynamic routing policy filter ruleset and current exports.

  • Page 43: Frags

    2.2.23. ha Chapter 2. Command Reference Description List active fragment reassemblies. More detailed information can optionally be obtained for specific reassemblies: Newest reassembly All reassemblies 0..1023 Assembly 'N' Example 2.9. frags frags NEW frags 254 Usage frags [{NEW | ALL | <reassembly id>}] [-free] [-done] [-num=<n>] Options -done List done (lingering) reassemblies.

  • Page 44: Hostmon

    2.2.24. hostmon Chapter 2. Command Reference -activate Go active. -deactivate Go inactive. 2.2.24. hostmon Show Host Monitor statistics. Description Show active Host Monitor sessions. Usage hostmon [-verbose] [-num=<n>] Options -num=<n> Limit list to <n> entries. (Default: 20) -verbose Verbose output. 2.2.25.

  • Page 45: Httpposter

    2.2.26. httpposter Chapter 2. Command Reference -flush Removes all entries. -num=<n> Limit list to <n> entries. (Default: 20) -override List hosts that have overridden the wcf filter. -server[={STATUS | CONNECT | Web Content Filtering Server options. (Default: status) DISCONNECT}] -show Show Web Content Filtering cache data.

  • Page 46: Hwm

    2.2.29. idppipes Chapter 2. Command Reference 2.2.28. hwm Show hardware monitor sensor status. Description Show hardware monitor sensor status. Usage hwm [-all] [-verbose] Options -all Show ALL sensors, WARNING: use at own risk, may take long time for highspeed ifaces to cope. -verbose Show sensor number, type and limits.

  • Page 47: Ifstat

    2.2.31. igmp Chapter 2. Command Reference 2.2.30. ifstat Show interface statistics. Description Show list of attached interfaces, or in-depth information about a specific interface. Usage ifstat [<Interface>] [-filter=<expr>] [-pbr=<table name>] [-num=<n>] [-restart] [-allindepth] Options -allindepth Show in-depth information about all interfaces. -filter=<expr>...

  • Page 48: Ikesnoop

    2.2.32. ikesnoop Chapter 2. Command Reference igmp -join <Interface> <MC address> [<host address>] Simulate an incoming IGMP join message. igmp -leave <Interface> <MC address> [<host address>] Simulate an incoming IGMP leave message. Options -join Simulate an incoming IGMP join message. -leave Simulate an incoming IGMP leave message.

  • Page 49: Ippool

    2.2.33. ippool Chapter 2. Command Reference Turn IKE snooping on. -verbose Enable IKE snooping with verbose output. <ip address> IP address to snoop. 2.2.33. ippool Show IP pool information. Description Show information about the current state of the configured IP pools. Usage ippool -release [<ip address>] [-all] Forcibly free IP assigned to subsystem.

  • Page 50: Ipseckeepalive

    2.2.35. ipseckeepalive Chapter 2. Command Reference Options -verbose Show all statistics. 2.2.35. ipseckeepalive Show status of the IPsec ping keepalives. Description Show status of the IPsec ping keepalives. Usage ipseckeepalive [-num=<n>] Options -num=<n> Maximum number of entries to display (default: 48). 2.2.36.

  • Page 51: Ipsectunnels

    2.2.37. ipsectunnels Chapter 2. Command Reference -usage Show detailed SA statistics information. -verbose Show verbose information. <tunnel> Only show SAs matching pattern. 2.2.37. ipsectunnels Lists the current IPsec configuration. Description Lists the current IPsec configuration, Usage ipsectunnels -iface=<recv iface> Show specific interface. ipsectunnels -num={ALL | <Integer>} [-force] Show specific number if interface.

  • Page 52: Languagefiles

    2.2.39. languagefiles Chapter 2. Command Reference Delete SAs belonging to provided remote SG/peer. killsa -all Delete all SAs. Options -all Kill all SAs. <ip address> IP address of remote SG/peer. Note Requires Administrator privilege. 2.2.39. languagefiles Manage language files on disk. Description Manage language files on disk Usage...

  • Page 53: License

    2.2.41. license Chapter 2. Command Reference ldap List all LDAP databases. ldap -list List all LDAP databases. ldap -show [<LDAP Server>] Show LDAP database status and statistics. ldap -reset [<LDAP Server>] Reset LDAP database. Options -list List all LDAP databases. -reset Reset status for LDAP database.

  • Page 54: Lockdown

    2.2.43. lockdown Chapter 2. Command Reference . If link monitor hosts have been configured, linkmon will monitor host reachability to detect link/ NIC problems. Usage linkmon 2.2.43. lockdown Enable / disable lockdown. Description During local lockdown, only traffic from admin nets to the security gateway itself is allowed. Everything else is dropped.

  • Page 55: Memory

    2.2.45. memory Chapter 2. Command Reference logout 2.2.45. memory Show memory information. Description Show core memory consumption. Also show detailed memory use of some components and lists. Usage memory 2.2.46. natpool Show current NAT Pools. Description Show current NAT Pools and in-depth information. Usage natpool [-verbose] [<pool name>...

  • Page 56: Netobjects

    2.2.48. netobjects Chapter 2. Command Reference Usage netcon 2.2.48. netobjects Show runtime values of network objects. Description Displays named network objects and their contents. Example 2.10. List network objects which have names containing "net". netobjects *net* Usage netobjects [<String>] [-num=<num>] Options -num=<num>...
  • Page 57 2.2.49. ospf Chapter 2. Command Reference ospf -iface [<interface>] [-process=<OSPF Router Process>] Show interface information. ospf -area [<OSPF Area>] [-process=<OSPF Router Process>] Show area information. ospf -neighbor [<OSPF Neighbor>] [-process=<OSPF Router Process>] Show neighbor information. ospf -route [{HA | ALT}] [-process=<OSPF Router Process>] Show the internal OSPF process routingtable.

  • Page 58: Pcapdump

    2.2.50. pcapdump Chapter 2. Command Reference -process=<OSPF Router Pro- Required if there are >1 OSPF router processes. cess> -route Show the internal OSPF process routingtable. -snoop={ON | OFF} Show troubleshooting messages on the console. -verbose Increase amount of information to display. <interface>...
  • Page 59 2.2.50. pcapdump Chapter 2. Command Reference pcapdump -write [<interface(s)>] [-filename=<String>] Write the captured packets to disk. pcapdump -wipe Remove all captured packets from memory. pcapdump -cleanup Remove all captured packets, release capture mode and delete all written capture files from disk. Options -cleanup Remove all captured packets, release capture mode and delete...

  • Page 60: Pciscan

    2.2.51. pciscan Chapter 2. Command Reference -stop Stop capture. -tcp TCP filter. -udp UDP filter. -wipe Remove all captured packets from memory. -write Write the captured packets to disk. <interface(s)> Name of interface(s). Note Requires Administrator privilege. 2.2.51. pciscan Show detected PCI devices. Description Usage pciscan...

  • Page 61: Pipes

    2.2.52. pipes Chapter 2. Command Reference -force_driver Force a certain device to a specific driver. (Admin only) <Integer> Index of device to update. {BROADCOM | BNE2 | E100 | Interface driver to use. E1000 | R8139 | MARVELL | NI- TROXII | ST201 | TULIP | X3C905} 2.2.52.

  • Page 62: Reconfigure

    2.2.54. reconfigure Chapter 2. Command Reference pptpalg Show all configured PPTP ALGs. pptpalg -sessions <PPTP ALG> [-verbose] [-num=<Integer>] List all PPTP sessions. pptpalg -services <PPTP ALG> List all services attached to PPTP ALG. Options -num=<Integer> Number of entries to list. -services List all services attached to PPTP ALG.

  • Page 63: Routes

    2.2.56. routes Chapter 2. Command Reference routemon 2.2.56. routes Display routing lists. Description Display information about the routing table(s): Contents of a (named) routing table. The list of routing tables, along with a total count of route entries in each table, as well as how many of the entries are single-host routes.

  • Page 64: Rtmonitor

    2.2.57. rtmonitor Chapter 2. Command Reference -switched Only show switched routes and L3C entries. -tables Display list of named (PBR) routing tables. -verbose Verbose. <table name> Name of routing table. 2.2.57. rtmonitor Real-time monitor information. Description Show informaton about real-time monitor objects, and real-time monitor alerts. All objects matching the specified filter are displayed.

  • Page 65: Selftest

    2.2.59. selftest Chapter 2. Command Reference Example 2.12. Show a range of rules rules -verbose 1-5 7-9 Usage rules -type=IP [-ruleset={* | <IP Rule Set>}] [-verbose] [-schedule] [<rules>]... Show IP rules. rules -type={ROUTING | PIPE | IDP | THRESHOLD | IGMP} [-verbose] [-schedule] [<rules>]...

  • Page 66: Interface Ping Test Between All Interfaces

    2.2.59. selftest Chapter 2. Command Reference Example 2.13. Interface ping test between all interfaces selftest -ping Example 2.14. Interface ping test between interfaces 'if1' and 'if2' selftest -ping -interfaces=if1,if2 Example 2.15. Start a 30 min burn-in duration test, testing RAM, storage media and crypto the accelerator selftest -burnin -minutes 30 -media -memory -cryptoaccel Usage...

  • Page 67: Services

    2.2.60. services Chapter 2. Command Reference Run burn-in tests for a set of sub tests. If no sub tests are specified the following are included: - memory, -ping, -traffic, -cryptoaccel. selftest -abort Abort a running self test. selftest Show the status of a running test. Options -abort Abort a running self test.

  • Page 68: Sessionmanager

    2.2.61. sessionmanager Chapter 2. Command Reference Example 2.16. List all services which names begin with "http" services http* Usage services [<String>] Options <String> Name or pattern. 2.2.61. sessionmanager Session Manager. Description Show information about the Session Manager, and list currently active users. Explanation of Timeout flags for sessions: Session is disabled Session uses a timeout in its subsystem...

  • Page 69: Settings

    2.2.62. settings Chapter 2. Command Reference sessionmanager -message <session name> <database> <message text> Send message to session with console. sessionmanager -disconnect <session name> <database> [<IP Address> [{LOCAL | SSH | NETCON | HTTP | HTTPS}]] Forcibly terminate session(s). Options -disconnect Forcibly terminate session(s).

  • Page 70: Shutdown

    2.2.63. shutdown Chapter 2. Command Reference <category> Show settings in category. 2.2.63. shutdown Initiate core or system shutdown. Description Initiate restart of the core/system. Usage shutdown [<seconds>] [-normal] [-reboot] Options -normal Initiate core shutdown. -reboot Initiate system reboot. <seconds> Seconds until shutdown. (Default: 5) Note Requires Administrator privilege.
  • Page 71 2.2.64. sipalg Chapter 2. Command Reference 0x00000080 SUPPORTED_CHANGES 0x00000100 2543COMPLIANCE 0x00000200 RECEPTION 0x00000400 SESSION 0x00000800 REQUEST 0x00001000 RESPONSE 0x00002000 TOPO_CHANGES 0x00004000 MEDIA 0x00008000 CONTACT 0x00010000 CONN 0x00020000 PING 0x00040000 TRANSACTION 0x00080000 CALLLEG Flags can be added in the usual way. The default value is 0x00000003 (GENERAL and ERRORS). NOTE: 'verbose' option outputs a lot of information on the console which may lead to system in- stability.

  • Page 72: Sshserver

    2.2.65. sshserver Chapter 2. Command Reference Control SIP snooping. Useful for troubleshooting SIP transactions. NOTE: 'verbose' option outputs a lot of information on the console which may lead to system instability. Use with caution. Options -calls Show active calls table. -connection Show SIP connections.

  • Page 73: Stats

    2.2.66. stats Chapter 2. Command Reference -b=<bits> Bitsize. (Default: 1024) -keygen Generate SSH Server private keys. This operation may take a long time to finish, up to several minutes! -restart Stop and start the SSH Server. -status Show server status and list all connected clients. -t={RSA | DSA} Type, (default: both RSA and DSA keys will be created).

  • Page 74: Time

    2.2.69. time Chapter 2. Command Reference Description Generate information useful for technical support. Due to the large amount of output, this command might show a truncated result when execute from the local console. Usage techsupport 2.2.69. time Display current system time. Description Display/set the system date and time.

  • Page 75: Updatecenter

    2.2.71. updatecenter Chapter 2. Command Reference Description Displays the contents of the user authentication ruleset. Example 2.17. Show a range of rules uarules -v 1-2,4-5 Usage uarules [-verbose] [<Integer Range>] Options -verbose Verbose output. <Integer Range> Range of rules to list. 2.2.71.

  • Page 76: Userauth

    2.2.72. userauth Chapter 2. Command Reference -removedb={ANTIVIRUS | IDP} Remove the database for the specified service. -servers Show autoupdate server information. -status[={ANTIVIRUS | IDP | Show update status and service information. (Admin only; ALL}] Default: all) -update[={ANTIVIRUS | IDP | Force an update now for the specified service.

  • Page 77: Vlan

    2.2.73. vlan Chapter 2. Command Reference <Interface> Interface. <user ip> IP address for user(s). 2.2.73. vlan Show information about VLAN. Description Show list of attached Virtual LAN Interfaces, or in-depth information about a specified VLAN. Usage vlan List attached VLANs. vlan <Interface>...

  • Page 78: Utility

    2.3. Utility Chapter 2. Command Reference 2.3. Utility 2.3.1. ping Ping host. Description Sends one or more ICMP ECHO, TCP SYN or UDP datagrams to the specified IP address of a host. All datagrams are sent preloaded-style (all at once). The data size -length given is the ICMP or UDP data size.

  • Page 79: Misc

    2.4. Misc Chapter 2. Command Reference 2.4. Misc 2.4.1. echo Print text. Description Print text to the console. Example 2.18. Hello World echo Hello World Usage echo [<String>]... Options <String> Text to print. 2.4.2. help Show help for selected topic. Description The help system contains information about commands and configuration object types.

  • Page 80: History

    2.4.3. history Chapter 2. Command Reference Display help about selected topic from any category. help -category={COMMANDS | TYPES} [<Topic>] Display help from a specific topic category. Options -category={COMMANDS | Topic category. TYPES} <Topic> Help topic. 2.4.3. history Dump history to screen. Description List recently typed commands that have been stored in the command history.

  • Page 81: Script

    2.4.5. script Chapter 2. Command Reference Example 2.21. Upload certificate data scp certificate.cer user@sgw-ip:certificate/certificate_name scp certificate.key user@sgw-ip:certificate/certificate_name Example 2.22. Upload ssh public key data scp sshkey.pub user@sgw-ip:sshclientkey/sshclientkey_name Usage Options -long Enable long listing format. <File> File to list. 2.4.5. script Handle CLI scripts.
  • Page 82 2.4.5. script Chapter 2. Command Reference Execute script. script -show [-all] [-name=<Name>] Show script in console window. script -store [-all] [-name=<Name>] Store a script to persistent storage. script -remove [-all] [-name=<Name>] Remove script. script List script files. Options -all Apply to all scripts. -create Create configuration script from specified object, class or category.
  • Page 83 2.4.5. script Chapter 2. Command Reference...

  • Page 84: Configuration Reference

    Chapter 3. Configuration Reference • Access, page 85 • Address, page 87 • AdvancedScheduleProfile, page 90 • ALG, page 91 • ARP, page 99 • BlacklistWhiteHost, page 100 • Certificate, page 101 • Client, page 102 • CommentGroup, page 104 •...

  • Page 85: Access

    3.1. Access Chapter 3. Configuration Reference • IPRuleSet, page 146 • IPsecAlgorithms, page 150 • LDAPDatabase, page 151 • LDAPServer, page 152 • LinkMonitor, page 153 • LocalUserDatabase, page 154 • LogReceiver, page 155 • NATPool, page 158 • OSPFProcess, page 159 •...
  • Page 86 3.1. Access Chapter 3. Configuration Reference Properties Index The index of the object, starting at 1. (Identifier) Name Specifies a symbolic name for the object. Action Accept, Expect or Drop. (Default: Drop) Interface The interface the packet must arrive on for this rule to be carried out. Excep- tion: the Expect rule.

  • Page 87: Address

    3.2. Address Chapter 3. Configuration Reference 3.2. Address This is a category that groups the following object types. 3.2.1. AddressFolder Description An address folder can be used to group related address objects for better overview. Properties Name Specifies a symbolic name for the network object. (Identifier) Comments Text describing the current object.
  • Page 88 3.2.1. AddressFolder Chapter 3. Configuration Reference Name Specifies a symbolic name for the network object. (Identifier) Members Group members. UserAuthGroups Groups and user names that belong to this object. Objects that fil- ter on credentials can only be used as source networks and destin- ations networks in rules.

  • Page 89: Ethernetaddress

    3.2.2. EthernetAddress Chapter 3. Configuration Reference Name Specifies a symbolic name for the network object. (Identifier) Address IP address, e.g. "172.16.50.8", "192.168.30.7,192.168.30.11", "192.168.7.0/24" or "172.16.25.10-172.16.25.50". ActiveAddress The dynamically set address used by e.g. DHCP enabled Ethernet interfaces. (Optional) UserAuthGroups Groups and user names that belong to this object. Objects that fil- ter on credentials can only be used as source networks and destin- ations networks in rules.

  • Page 90: Advancedscheduleprofile

    3.3. AdvancedScheduleProfile Chapter 3. Configuration Reference 3.3. AdvancedScheduleProfile Description An advanced schedule profile contains definitions of occurrences used by various policies in the system. Properties Name Specifies a symbolic name for the service. (Identifier) Comments Text describing the current object. (Optional) 3.3.1.

  • Page 91: Alg

    3.4. ALG Chapter 3. Configuration Reference 3.4. ALG This is a category that groups the following object types. 3.4.1. ALG_FTP Description Use an FTP Application Layer Gateway to manage FTP traffic through the system. Properties Name Specifies a symbolic name for the ALG. (Identifier) AllowServerPassive Allow server to use passive mode (unsafe for server).

  • Page 92: Alg_H323

    3.4.2. ALG_H323 Chapter 3. Configuration Reference File List of file types to allow or deny. (Optional) VerifyContentMimetype Verify that file extentions correspond to the MIME type. (Default: No) Comments Text describing the current object. (Optional) 3.4.2. ALG_H323 Description Use an H.323 Application Layer Gateway to manage H.323 multimedia traffic. Properties Name Specifies a symbolic name for the ALG.
  • Page 93 3.4.3. ALG_HTTP Chapter 3. Configuration Reference MaxDownloadSize The maximal allowed file size in kB. (Optional) FileListType Specifies if the file list contains files to allow or deny. (Default: Block) FailModeBehavior Standard behaviour on error: Allow or Deny. (Default: Deny) File List of file types to allow or deny.

  • Page 94: Alg_Pop3

    3.4.4. ALG_POP3 Chapter 3. Configuration Reference Note If no Index is specified when creating an instance of this type, the object will be placed last in the list and the Index will be equal to the length of the list. 3.4.4.

  • Page 95: Alg_Sip

    3.4.6. ALG_SIP Chapter 3. Configuration Reference Description Use a PPTP Application Layer Gateway to manage PPTP traffic through the system. Properties Name Specifies a symbolic name for the ALG. (Identifier) EchoTimeout Specifies idle timeout for Echo messages in the PPTP tunnel. (Default: 0) IdleTimeout SPecifies idle timeout for user traffic in the PPTP tunnel.
  • Page 96 3.4.7. ALG_SMTP Chapter 3. Configuration Reference VerifySenderEmail Check emails for mismatching SMTP command From ad- dress and email header From address. (Default: No) VerifySenderEmailAction TODO. (Default: Deny) VerifySenderEmailDomainOnly Only check domain names in email From addresses. (Default: MaxEmailPerMinute Specifies the maximum amount of emails per minute from the same host.

  • Page 97: Alg_Tftp

    3.4.8. ALG_TFTP Chapter 3. Configuration Reference CacheTimeout Timeout in seconds before a cached IP address is removed. (Default: 600) DNSBlackLists Specifies the BlackList domain and its weighted value. Comments Text describing the current object. (Optional) 3.4.7.1. ALG_SMTP_Email Description Used to whitelist or blacklist an email sender/recipient. Properties Type Specifies if the email address is the sender or the recipient.

  • Page 98: Alg_Tls

    3.4.9. ALG_TLS Chapter 3. Configuration Reference 3.4.9. ALG_TLS Description TLS Alg Properties Name Specifies a symbolic name for the ALG. (Identifier) HostCert Specifies the host certificate. RootCert Specifies the root certificate. (Optional) Comments Text describing the current object. (Optional)

  • Page 99: Arp

    3.5. ARP Chapter 3. Configuration Reference 3.5. ARP Description Use an ARP entry to publish additional IP addresses and/or MAC addresses on a specified interface. Properties Mode Static, Publish or XPublish. (Default: Publish) Interface Indicates the interface to which the ARP entry applies; e.g. the interface the ad- dress shall be published on.

  • Page 100: Blacklistwhitehost

    3.6. BlacklistWhiteHost Chapter 3. Configuration Reference 3.6. BlacklistWhiteHost Description Hosts and networks added to this whitelist can never be blacklisted by IDP or Threshold Rules. Properties Addresses Specifies the addresses that will be whitelisted. Service Specifies the service that will be whitelisted. Schedule The schedule when the whitelist should be active.

  • Page 101: Certificate

    3.7. Certificate Chapter 3. Configuration Reference 3.7. Certificate Description An X. 509 certificate is used to authenticate a VPN client or gateway when establishing an IPsec tunnel. Properties Name Specifies a symbolic name for the certificate. (Identifier) Type Local, Remote or Request. CertificateData Certificate data.

  • Page 102: Client

    3.8. Client Chapter 3. Configuration Reference 3.8. Client This is a category that groups the following object types. 3.8.1. DynDnsClientCjbNet Description Configure the parameters used to connect to the Cjb.net DynDNS service. Properties Username Username. Password The password for the specified username. (Optional) Comments Text describing the current object.

  • Page 103: Dyndnsclientpeanuthull

    3.8.4. DynDnsClientPeanutHull Chapter 3. Configuration Reference Properties DNSName The DNS name excluding the .dyns.cx suffix. Username Username. Password The password for the specified username. (Optional) Comments Text describing the current object. (Optional) Note This object type does not have an identifier and is identified by the name of the type only.

  • Page 104: Commentgroup

    3.9. CommentGroup Chapter 3. Configuration Reference 3.9. CommentGroup Description Group together one or more configuration objects. Properties Description TODO. (Default: "(New Group)") Color TODO. (Default: 9EBEE7) Note If no Index is specified when creating an instance of this type, the object will be placed last in the list and the Index will be equal to the length of the list.

  • Page 105: Comportdevice

    3.10. COMPortDevice Chapter 3. Configuration Reference 3.10. COMPortDevice Description A serial communication port, that is used for accessing the CLI. Properties Port Port. (Identifier) BitsPerSecond Bits per second. (Default: 9600) DataBits Data bits. (Default: 8) Parity Parity. (Default: None) StopBits Stop bits.

  • Page 106: Configmodepool

    3.11. ConfigModePool Chapter 3. Configuration Reference 3.11. ConfigModePool Description An IKE Config Mode Pool will dynamically assign the IP address, DNS server, WINS server etc. to the VPN client connecting to this gateway. Properties IPPoolType Specifies whether a predefined IP Pool or a static set of IP addresses should be used as IP address source.

  • Page 107: Datetime

    3.12. DateTime Chapter 3. Configuration Reference 3.12. DateTime Description Set the date, time and time zone information for this system. Properties TimeZone Specifies the time zone. (Default: GMT) DSTEnabled Enable daylight saving time. (Default: Yes) DSTOffset Daylight saving time offset in minutes. (Default: 60) DSTStartMonth What month daylight saving time starts.

  • Page 108: Device

    3.13. Device Chapter 3. Configuration Reference 3.13. Device Description Global parameters for this device. Properties Name Name of the device. (Default: Device) LocalCfgVersion Local version number of the configuration. (Default: 1) RemoteCfgVersion Remote version number of the configuration. (Default: 0) ConfigUser Name of the user who committed the current configuration.

  • Page 109: Dhcprelay

    3.14. DHCPRelay Chapter 3. Configuration Reference 3.14. DHCPRelay Description Use a DHCP Relay to dynamically alter the routing table according to relayed DHCP leases. Properties Name Specifies a symbolic name for the relay rule. (Identifier) Action Ignore, Relay or BootpFwd. (Default: Ignore) SourceInterface The source interface of the DHCP packet.

  • Page 110: Dhcpserver

    3.15. DHCPServer Chapter 3. Configuration Reference 3.15. DHCPServer Description A DHCP Server determines a set of IP addresses and host configuration parameters to hand out to DHCP clients attached to a given interface. Properties Index The index of the object, starting at 1. (Identifier) Name Specifies a symbolic name for the DHCP Server rule.

  • Page 111: Dhcpservercustomoption

    3.15.2. DHCPServerCustomOption Chapter 3. Configuration Reference Static DHCP Server host entry Properties Host IP Address of the host. StaticHostType Identifier for host. (Default: MACAddress) MACAddress The hardware address of the host. ClientIdentType Type of client identifier specified. (Default: Ascii) ClientIdent The client identifier for the host.

  • Page 112: Dns

    3.16. DNS Chapter 3. Configuration Reference 3.16. DNS Description Configure the DNS (Domain Name System) client settings. Properties DNSServer1 IP of the primary DNS Server. (Optional) DNSServer2 IP of the secondary DNS Server. (Optional) DNSServer3 IP of the tertiary DNS Server. (Optional) Comments Text describing the current object.

  • Page 113: Driver

    3.17. Driver Chapter 3. Configuration Reference 3.17. Driver This is a category that groups the following object types. 3.17.1. BNE2EthernetPCIDriver Description Broadcom NE2 Gigabit Ethernet. Properties Comments Text describing the current object. (Optional) Note This object type does not have an identifier and is identified by the name of the type only.

  • Page 114: E100Ethernetpcidriver

    3.17.4. E100EthernetPCIDriver Chapter 3. Configuration Reference BelowCPULoad Below CPU load. (Default: 80) BelowInterfaceLoad Below interface load. (Default: 70) MinInterval Minimum interval. (Default: 30) RxErrorPercentage Rx error percentage. (Default: 20) TxErrorPercentage Tx error percentage. (Default: 7) ErrorTime Error time. (Default: 10) Comments Text describing the current object.

  • Page 115: Marvellethernetpcidriver

    3.17.6. MarvellEthernetPCIDriver Chapter 3. Configuration Reference Note This object type does not have an identifier and is identified by the name of the type only. There can only be one instance of this type. 3.17.6. MarvellEthernetPCIDriver Description Marvell (88E8001,88E8053,88E8062) Fast and Gigabit Ethernet Adaptor. Properties Comments Text describing the current object.

  • Page 116: St201Ethernetpcidriver

    This object type does not have an identifier and is identified by the name of the type only. There can only be one instance of this type. 3.17.9. ST201EthernetPCIDriver Description D-Link (ST201) Fast Ethernet Adaptor. Properties Comments Text describing the current object. (Optional)
  • Page 117 3.17.11. X3C905EthernetPCIDriver Chapter 3. Configuration Reference Note This object type does not have an identifier and is identified by the name of the type only. There can only be one instance of this type.

  • Page 118: Dynamicroutingrule

    3.18. DynamicRoutingRule Chapter 3. Configuration Reference 3.18. DynamicRoutingRule Description A Dynamic Routing Policy rule creates a filter to catch statically configured or OSPF learned routes. The matched routes can be controlled by the action rules to be either exported to OSPF processes or to be added to one or more routing tables.

  • Page 119: Dynamicroutingruleexportospf

    3.18.2. DynamicRoutingRuleAddRoute Chapter 3. Configuration Reference 3.18.1. DynamicRoutingRuleExportOSPF Description An OSPF action is used to manipulate and export new or changed routes to an OSPF Router Pro- cess. Properties ExportToProcess Specifies to which OSPF Process the route change should be exported. SetTag Specifies a tag for this route.
  • Page 120 3.18.2. DynamicRoutingRuleAddRoute Chapter 3. Configuration Reference ProxyARPAllInterfaces Always select all interfaces, including new ones, for publishing routes via Proxy ARP. (Default: No) ProxyARPInterfaces Specifies the interfaces on which the security gateway should publish routes via Proxy ARP. (Optional) Comments Text describing the current object. (Optional) Note If no Index is specified when creating an instance of this type, the object will be placed last in the list and the Index will be equal to the length of the list.

  • Page 121: Ethernetdevice

    3.19. EthernetDevice Chapter 3. Configuration Reference 3.19. EthernetDevice Description Hardware settings for an Ethernet interface. Properties Name Specifies a symbolic name for the device. (Identifier) EthernetDriver The Ethernet PCI driver that should be used by the interface. PCIBus PCI bus number where the Ethernet adapter is installed. PCISlot PCI slot number used by the Ethernet adapter.

  • Page 122: Highavailability

    3.20. HighAvailability Chapter 3. Configuration Reference 3.20. HighAvailability Description Configure the High Availability cluster parameters for this system. Properties Enabled Enable high availability. (Default: No) Sync Specifies if cluster members are to synchronization configura- tion data. (Default: Yes) ClusterID A (locally) unique cluster ID to use in identifying this group of HA security gateways.

  • Page 123: Httpalgbanners

    3.21. HTTPALGBanners Chapter 3. Configuration Reference 3.21. HTTPALGBanners Description HTTP banner files specifies the look and feel of HTTP ALG restriction web pages. Properties Name Specifies a symbolic name for the HTTP Banner Files. (Identifier) CompressionForbidden HTML for the CompressionForbidden.html web page. ContentForbidden HTML for the ContentForbidden.html web page.

  • Page 124: Httpauthbanners

    3.22. HTTPAuthBanners Chapter 3. Configuration Reference 3.22. HTTPAuthBanners Description HTTP banner files specifies the look and feel of HTML authentication web pages. Properties Name Specifies a symbolic name for the HTTP Banner Files. (Identifier) FormLogin HTML for the FormLogin.html web page. LoginSuccess HTML for the LoginSuccess.html web page.

  • Page 125: Httpposter

    3.23. HTTPPoster Chapter 3. Configuration Reference 3.23. HTTPPoster Description Use the HTTP poster for dynamic DNS or automatic logon to services using web-based authentica- tion. Properties URL1 The first URL that will be posted when the security gateway is loaded. (Optional) URL2 The second URL that will be posted when the security gateway is loaded.

  • Page 126: Hwm

    3.24. HWM Chapter 3. Configuration Reference 3.24. HWM Description Hardware Monitoring allows monitoring of hardware sensors. Properties Name Specifies a symbolic name for the object. Type Type of monitoring. Sensor Sensor index. MinLimit Lower limit. (Optional) MaxLimit Upper limit. (Optional) EnableMonitoring Enable/disable monitoring.

  • Page 127: Idlist

    3.25. IDList Chapter 3. Configuration Reference 3.25. IDList Description An ID list contains IDs, which are used within the authentication process when establishing an IPsec tunnel. Properties Name Specifies a symbolic name for the ID list. (Identifier) Comments Text describing the current object. (Optional) 3.25.1.

  • Page 128: Idprule

    3.26. IDPRule Chapter 3. Configuration Reference 3.26. IDPRule Description An IDP Rule defines a filter for matching specific network traffic. When the filter criterion is met, the IDP Rule Actions are evaluated and possible actions taken. Properties Index The index of the object, starting at 1. (Identifier) Name Specifies a symbolic name for the rule.
  • Page 129 3.26.1. IDPRuleAction Chapter 3. Configuration Reference Properties Action Specifies what action to take if the given signature is found. (Default: Protect) Signatures Specifies what signature(s) to search for in the network traffic. (Optional) BlackList Activate BlackList. (Default: No) BlackListTimeToBlock The number of seconds that the dynamic black list should re- main.

  • Page 130: Igmprule

    3.27. IGMPRule Chapter 3. Configuration Reference 3.27. IGMPRule Description An IGMP rule specifies how to handle inbound IGMP reports and outbound IGMP queries. Properties Index The index of the object, starting at 1. (Identifier) Name Specifies a symbolic name for the rule. (Optional) Type The type of IGMP messages the rule applies to.
  • Page 131 3.27. IGMPRule Chapter 3. Configuration Reference Note If no Index is specified when creating an instance of this type, the object will be placed last in the list and the Index will be equal to the length of the list.

  • Page 132: Igmpsetting

    3.28. IGMPSetting Chapter 3. Configuration Reference 3.28. IGMPSetting Description IGMP parameters can be tuned for one, or a group of interfaces in order to match the characteristics of a network. Properties Name Specifies a symbolic name for the object. (Identifier) Interface The interfaces that these settings should apply to.

  • Page 133: Ikealgorithms

    3.29. IKEAlgorithms Chapter 3. Configuration Reference 3.29. IKEAlgorithms Description Configure algorithms which are used in the IKE phase of an IPsec session. Properties Name Specifies a symbolic name for the object. (Identifier) NULLEnabled Enable plaintext. (Default: No) DESEnabled Enable DES encryption algorithm. (Default: No) DES3Enabled Enable 3DES encryption algorithm.

  • Page 134: Interface

    3.30. Interface Chapter 3. Configuration Reference 3.30. Interface This is a category that groups the following object types. 3.30.1. DefaultInterface Description A special interface used to represent internal mechanisms in the system as well as an abstract "any" interface. Properties Name Specifies a symbolic name for the interface.

  • Page 135: Gretunnel

    3.30.3. GRETunnel Chapter 3. Configuration Reference added automatically for this interface. (Default: No) AutoInterfaceNetworkRoute Automatically add a route for this interface using the given network. (Default: Yes) AutoDefaultGatewayRoute Automatically add a default route for this interface using the given default gateway. (Default: Yes) DHCPDNS1 IP of the primary DNS server.

  • Page 136: Interfacegroup

    3.30.4. InterfaceGroup Chapter 3. Configuration Reference Network Specifies the network address of the GRE interface. RemoteEndpoint Specifies the IP address of the remote endpoint. EncapsulationChecksum Add an extra level of checksum above the one provided by the IPv4 layer. (Default: No) OriginatorIPType Specifies what IP address to use as source IP in e.g.
  • Page 137 3.30.5. IPsecTunnel Chapter 3. Configuration Reference system. Properties Index The index of the object, starting at 1. (Identifier) Name Specifies a symbolic name for the interface. (Identifier) LocalNetwork The network on "this side" of the IPsec tunnel. The IPsec tun- nel will be established between this network and the remote network.
  • Page 138 3.30.6. L2TPClient Chapter 3. Configuration Reference XAuth. XAuthPassword Specifies the password to pass to the remote gateway vie IKE XAuth. DHCPOverIPsec Allow DHCP over IPsec from single-host clients. (Default: AddRouteToRemoteNet Dynamically add route to the remote networks when a tunnel is established.

  • Page 139: L2Tpclient

    3.30.6. L2TPClient Chapter 3. Configuration Reference 3.30.6. L2TPClient Description A PPTP/L2TP client interface is a PPP (Point-to-Point Protocol) tunnel over an existing IP network. Its IP address and DNS servers are dynamically assigned. Properties Name Specifies a symbolic name for the interface. (Identifier) The host name to store the assigned IP address in, if this net- work object exists and have a value other then 0.0.0.0 the PPTP/L2TP client will try to get that one from the PPTP/...

  • Page 140: L2Tpserver

    3.30.7. L2TPServer Chapter 3. Configuration Reference MPPERC4128 Use an RC4 128 bit MPPE session key with MS-CHAP or MS-CHAP v2 authentication protocol. (Default: Yes) DialOnDemand Enable Dial-on-demand which means that the L2TP/PPTP tunnel will not be setup until traffic is sent on the interface. (Default: No) ActivitySensing Specifies if the dial-on-demand should trigger on inbound or...

  • Page 141: Loopbackinterface

    3.30.8. LoopbackInterface Chapter 3. Configuration Reference CHAP v2 authentication protocol. (Default: Yes) MPPERC456 Use an RC4 56 bit MPPE session key with MS-CHAP or MS- CHAP v2 authentication protocol. (Default: Yes) MPPERC4128 Use an RC4 128 bit MPPE session key with MS-CHAP or MS- CHAP v2 authentication protocol.

  • Page 142: Pppoetunnel

    3.30.9. PPPoETunnel Chapter 3. Configuration Reference Interface address. Network The network of the interface. Broadcast The broadcast address of the connected network. (Optional) Metric Specifies the metric for the auto-created route. (Default: 100) AutoInterfaceNetworkRoute Automatically add a route for this virtual LAN interface using the given network.

  • Page 143: Vlan

    3.30.10. VLAN Chapter 3. Configuration Reference PPPAuthMSCHAP Use MS-CHAP authentication protocol for this tunnel. (Default: Yes) PPPAuthMSCHAPv2 Use MS-CHAP v2 authentication protocol for this tunnel. (Default: Yes) DialOnDemand Enable Dial-on-demand which means that the PPPoE tunnel will not be setup until traffic is sent on the interface. (Default: ActivitySensing Specifies if the dial-on-demand should trigger on inbound or outbound traffic or both.
  • Page 144 3.30.10. VLAN Chapter 3. Configuration Reference Network Specifies the network address of the virtual LAN interface. DefaultGateway The default gateway of the virtual LAN interface. (Optional) Broadcast Specifies the broadcast address of the virtual LAN interface. (Optional) PrivateIP The private IP address of this high availability node. (Optional) Metric Specifies the metric for the auto-created route.

  • Page 145: Ippool

    3.31. IPPool Chapter 3. Configuration Reference 3.31. IPPool Description An IP Pool is a dynamic object which consists of IP leases that are fetched from a DHCP Server. The IP Pool is used as an address source by subsystems that may need to distribute addresses, e.g. by IPsec in Configuration mode.

  • Page 146: Ipruleset

    3.32. IPRuleSet Chapter 3. Configuration Reference 3.32. IPRuleSet Description An IP Rule Set is a self-contained set of IP Rules. Default action is Drop. Properties Name A name to uniquely identify this IPRuleSet. (Identifier) Comments Text describing the current object. (Optional) 3.32.1.
  • Page 147 3.32.1. IPRule Chapter 3. Configuration Reference SATTranslateToPort Translate to this port. (Optional) SATAllToOne Rewrite all destination IPs to a single IP. (Default: No) SLBAddresses The IP addresses of the servers in the server farm. SLBStickiness Specifies stickiness mode. (Default: None) SLBIdleTimeOut New connections that arrive within the idle timeout are as- signed to the same real server as previous connections from...

  • Page 148: Iprulefolder

    3.32.2. IPRuleFolder Chapter 3. Configuration Reference SLBHTTPMaxAverageLatency Specifies the max average latency for the sample attempts. (Default: 800) SLBHTTPURLType Defines how the request URL should be interpreted. (Default: FQDN) SLBHTTPRequestURL Specifies the HTTP URL to monitor. SLBHTTPExpectedResponse Expected HTTP response. SLBDistribution Specifies the algorithm used for the load distribution tasks.
  • Page 149 3.32.2. IPRuleFolder Chapter 3. Configuration Reference 3.32.2.1. IPRule The definitions here are the same as in Section 3.32.1, “IPRule” .

  • Page 150: Ipsecalgorithms

    3.33. IPsecAlgorithms Chapter 3. Configuration Reference 3.33. IPsecAlgorithms Description Configure algorithms which are used in the IPsec phase of an IPsec session. Properties Name Specifies a symbolic name for the object. (Identifier) NULLEnabled Enable plaintext. (Default: No) DESEnabled Enable DES encryption algorithm. (Default: No) DES3Enabled Enable 3DES encryption algorithm.

  • Page 151: Ldapdatabase

    3.34. LDAPDatabase Chapter 3. Configuration Reference 3.34. LDAPDatabase Description External LDAP server used to verify user names and passwords. Properties Name Specifies a symbolic name for the server. (Identifier) The IP address of the server. Port The TCP port of the server. (Default: 389) Timeout The timeout, in milliseconds, used when processing requests.

  • Page 152: Ldapserver

    3.35. LDAPServer Chapter 3. Configuration Reference 3.35. LDAPServer Description An LDAP server is used as a central repository of certificates and CRLs that the security gateway can download when necessary. Properties Host Specifies the IP address or hostname of the LDAP server. Username Specifies the username to use when accessing the LDAP server.

  • Page 153: Linkmonitor

    3.36. LinkMonitor Chapter 3. Configuration Reference 3.36. LinkMonitor Description The Link Monitor allows the system to monitor one or more hosts and take action if they are un- reachable. Properties Action Specifies what action the system should take. Addresses Specifies the addresses that should be monitored. MaxLoss A single host is considered unreachable if this number of consecutive ping responses to that host are not replied to.

  • Page 154: Localuserdatabase

    3.37. LocalUserDatabase Chapter 3. Configuration Reference 3.37. LocalUserDatabase Description A local user database contains user accounts used for authentication purposes. Properties Name Specifies a symbolic name for the object. (Identifier) Comments Text describing the current object. (Optional) 3.37.1. User Description User credentials may be used in User Authentication Rules, which in turn are used in e.g.

  • Page 155: Logreceiver

    3.38. LogReceiver Chapter 3. Configuration Reference 3.38. LogReceiver This is a category that groups the following object types. 3.38.1. EventReceiverSNMP2c Description A SNMP2c event receiver is used to receive SNMP events from the system. Properties Name Specifies a symbolic name for the log receiver. (Identifier) IPAddress Destination IP address.

  • Page 156: Logreceivermemory

    3.38.3. LogReceiverSMTP Chapter 3. Configuration Reference 3.38.2. LogReceiverMemory Description A memory log receiver is used to receive and keep log events in system RAM. Properties Name Specifies a symbolic name for the log receiver. (Identifier) LogSeverity Specifies with what severity log events will be sent to the specified log receiv- ers.

  • Page 157: Logreceiversyslog

    3.38.4. LogReceiverSyslog Chapter 3. Configuration Reference Comments Text describing the current object. (Optional) 3.38.4. LogReceiverSyslog Description A Syslog receiver is used to receive log events from the system in the standard Syslog format. Properties Name Specifies a symbolic name for the log receiver. (Identifier) IPAddress Specifies the IP address of the log receiver.

  • Page 158: Natpool

    3.39. NATPool Chapter 3. Configuration Reference 3.39. NATPool Description A NAT Pool is used for NATing multiple concurrent connections to using different source IP ad- dresses. Properties Name Specifies a symbolic name for the NAT Pool. (Identifier) Type Specifies how NAT'ed connections are assigned a NAT IP ad- dress.

  • Page 159: Ospfprocess

    3.40. OSPFProcess Chapter 3. Configuration Reference 3.40. OSPFProcess Description An OSPF Router Process defines a group of routers exchanging routing information via the Open Shortest Path First routing protocol. Properties Name Specifies a symbolic name for the OSPF process. (Identifier) RouterID Specifies the IP address that is used to identify the router.

  • Page 160: Ospfarea

    3.40.1. OSPFArea Chapter 3. Configuration Reference cifies the details of the log. (Default: Off) DebugRoute Enables or disabled logging of routing table manipulation events and also specifies the details of the log. (Default: Off) AuthType Specifies the authentication type for the OSPF protocol exchanges. (Default: None) AuthPassphrase Specifies the passphrase used for authentication.
  • Page 161 3.40.1. OSPFArea Chapter 3. Configuration Reference Properties Interface Specifies which interface in the security gateway will be used for this OS- PF interface. (Identifier) Type Auto, Broadcast, Point-to-point or Point-to-multipoint. (Default: Auto) Network Specifies the network related to the configured OSPF interface. (Optional) MetricType Metric value or Bandwidth.
  • Page 162 3.40.1. OSPFArea Chapter 3. Configuration Reference Description For point-to-point and point-to-multipoint networks, specify the IP addresses of directly connected routers. Properties Interface Specifies the OSPF interface of the neighbor. IPAddress IP Address of the neighbor. Metric Specifies the metric of the neighbor. (Optional) Comments Text describing the current object.
  • Page 163 3.40.1. OSPFArea Chapter 3. Configuration Reference RouterID The ID of the router on the other side of the virtual link. UseDefaultAuth Use the authentication configuration specified in the OSPF process. (Default: Yes) AuthType Specifies the authentication type for the OSPF protocol exchanges. (Default: None) AuthPassphrase Specifies the passphrase used for authentication.

  • Page 164: Pipe

    3.41. Pipe Chapter 3. Configuration Reference 3.41. Pipe Description A pipe defines basic traffic shaping parameters. The pipe rules then determines which traffic goes through which pipes. Properties Name Specifies a symbolic name for the pipe. (Identifier) LimitKbpsTotal Total bandwidth limit for this pipe in kilobits per second. (Optional) LimitPPSTotal Total packet per second limit for this pipe.
  • Page 165 3.41. Pipe Chapter 3. Configuration Reference UserLimitPPS0 Specifies the throughput limit per group in PPS for precedence 0 (the lowest precedence). (Optional) UserLimitKbps1 Specifies the bandwidth limit per group in kbps for precedence 1. (Optional) UserLimitPPS1 Specifies the throughput limit per group in PPS for precedence 1. (Optional) UserLimitKbps2 Specifies the bandwidth limit per group in kbps for precedence 2.
  • Page 166 3.41. Pipe Chapter 3. Configuration Reference (Default: 7) Comments Text describing the current object. (Optional)

  • Page 167: Piperule

    3.42. PipeRule Chapter 3. Configuration Reference 3.42. PipeRule Description A Pipe Rule determines traffic shaping policy - which Pipes to use - for one or more types of traffic with the same granularity as the standard ruleset. Properties Index The index of the object, starting at 1. (Identifier) Name Specifies a symbolic name for the object.

  • Page 168: Psk

    3.43. PSK Chapter 3. Configuration Reference 3.43. PSK Description PSK (Pre-Shared Key) authentication is based on a shared secret that is known only by the parties involved. Properties Name Specifies a symbolic name for the pre-shared key. (Identifier) Type Specifies the type of the shared key. PSKAscii Specifies the PSK as a passphrase.

  • Page 169: Radiusaccounting

    3.44. RadiusAccounting Chapter 3. Configuration Reference 3.44. RadiusAccounting Description External RADIUS server used to collect user statistics. Properties Name Specifies a symbolic name for the server. (Identifier) IPAddress The IP address of the server. Port The UDP port of the server. (Default: 1813) RetryTimeout The retry timeout, in seconds, used when trying to contact the RADIUS ac- counting server.

  • Page 170: Radiusserver

    3.45. RadiusServer Chapter 3. Configuration Reference 3.45. RadiusServer Description External RADIUS server used to verify user names and passwords. Properties Name Specifies a symbolic name for the server. (Identifier) IPAddress The IP address of the server. Port The UDP port of the server. (Default: 1812) RetryTimeout The retry timeout, in seconds, used when trying to contact the RADIUS ac- counting server.

  • Page 171: Realtimemonitoralert

    3.46. RealTimeMonitorAlert Chapter 3. Configuration Reference 3.46. RealTimeMonitorAlert Description Monitors a statistical value. Log messages are generated if the value goes below the lower threshold or above the high threshold. Properties Index The index of the object, starting at 1. (Identifier) Monitor Statistical value.

  • Page 172: Remoteidlist

    3.47. RemoteIDList Chapter 3. Configuration Reference 3.47. RemoteIDList Description List of Remote IDs that are allowed access when using Pre Shared Keys as authentication method. Properties Type Specifies the type of the shared key. PSKAscii Specifies the PSK as a passphrase. PSKHex Specifies the PSK as a hexadecimal key.

  • Page 173: Remotemanagement

    3.48. RemoteManagement Chapter 3. Configuration Reference 3.48. RemoteManagement This is a category that groups the following object types. 3.48.1. RemoteMgmtHTTP Description Configure HTTP/HTTPS management to enable remote management to the system. Properties Name Specifies a symbolic name for the object. (Identifier) Interface Specifies the interface for which remote access is granted.

  • Page 174: Remotemgmtsnmp

    3.48.3. RemoteMgmtSNMP Chapter 3. Configuration Reference Note This object type does not have an identifier and is identified by the name of the type only. There can only be one instance of this type. 3.48.3. RemoteMgmtSNMP Description Configure SNMP management to enable SNMP polling. Properties Name Specifies a symbolic name for the object.
  • Page 175 3.48.4. RemoteMgmtSSH Chapter 3. Configuration Reference AllowAES256 Allow AES-256 encryption algorithm. (Default: Yes) AllowBlowfish Allow Blowfish encryption algorithm. (Default: Yes) Allow3DES Allow 3DES encryption algorithm. (Default: Yes) AllowMACSHA1 Allow SHA1 integrity algorithm. (Default: Yes) AllowMACMD5 Allow MD5 integrity algorithm. (Default: Yes) AllowMACSHA196 Allow SHA1-96 integrity algorithm.

  • Page 176: Routebalancinginstance

    3.49. RouteBalancingInstance Chapter 3. Configuration Reference 3.49. RouteBalancingInstance Description A route balancing instance is assoicated with a routingtable and defines how to make use of multiple routes to the same destination. Properties RoutingTable Specify routingtable to deploy route load balancing in. (Identifier) Algorithm Specify which algorithm to use when balancing the routes.

  • Page 177: Routebalancingspilloversettings

    3.50. RouteBalancingSpilloverSetting Chapter 3. Configuration Reference 3.50. RouteBalancingSpilloverSettings Description Settings associated with the spillover algorithm. Properties Interface Interface to threshold limit. (Identifier) HoldTime Number of consecutive seconds over/under the threshold limit to trig- ger state change for the affected routes. (Default: 30) OutboundThreshold Outbound threshold limit.

  • Page 178: Routingrule

    3.51. RoutingRule Chapter 3. Configuration Reference 3.51. RoutingRule Description A Routing Rule forces the use of a routing table in the forward and/or return direction of traffic on a connection. The ordering parameter of the routing table determines if it is consulted before or after the main routing table.

  • Page 179: Routingtable

    3.52. RoutingTable Chapter 3. Configuration Reference 3.52. RoutingTable Description The system has a predefined main routing table. Alternate routing tables can be defined by the user. Properties Name Specifies a symbolic name for the routing table. (Identifier) Ordering Specifies how a route lookup is done in a named routing ta- ble.
  • Page 180 3.52.1. Route Chapter 3. Configuration Reference 1000) EnableHostMonitoring Enables the Host Monitoring functionality. (Default: No) Reachability Specifies the number of hosts that are required to be reach- able to consider the route to be active. (Default: ALL) GracePeriod Specifies the time to wait after a reconfiguration until the monitoring begins.

  • Page 181: Switchroute

    3.52.2. SwitchRoute Chapter 3. Configuration Reference RequestURL Specifies the HTTP URL to monitor. ExpectedResponse Expected HTTP response. Comments Text describing the current object. (Optional) Note If no Index is specified when creating an instance of this type, the object will be placed last in the list and the Index will be equal to the length of the list.

  • Page 182: Scheduleprofile

    3.53. ScheduleProfile Chapter 3. Configuration Reference 3.53. ScheduleProfile Description A Schedule Profile defines days and dates and are then used by the various policies in the system. Properties Name Specifies a symbolic name for the service. (Identifier) Specifies during which intervals the schedule profile is active on Mondays. (Optional) Specifies during which intervals the schedule profile is active on Tuesdays.

  • Page 183: Service

    3.54. Service Chapter 3. Configuration Reference 3.54. Service This is a category that groups the following object types. 3.54.1. ServiceGroup Description A Service Group is a collection of service objects, which can then be used by different policies in the system. Properties Name Specifies a symbolic name for the service.

  • Page 184: Serviceipproto

    3.54.3. ServiceIPProto Chapter 3. Configuration Reference EchoReplyCodes Specifies which Echo Reply message codes should be matched. (Default: 0-255) SourceQuenching Enable matching of Source Quenching messages. (Default: SourceQuenchingCodes Specifies which Source Quenching message codes should be matched. (Default: 0-255) TimeExceeded Enable matching of Time Exceeded messages. (Default: No) TimeExceededCodes Specifies which Time Exceeded message codes should be matched.
  • Page 185 3.54.4. ServiceTCPUDP Chapter 3. Configuration Reference Properties Name Specifies a symbolic name for the service. (Identifier) DestinationPorts Specifies the destination port or the port ranges applicable to this ser- vice. Type Specifies whether this service uses the TCP or UDP protocol or both. (Default: TCP) SourcePorts Specifies the source port or the port ranges applicable to this service.

  • Page 186: Settings

    3.55. Settings Chapter 3. Configuration Reference 3.55. Settings This is a category that groups the following object types. 3.55.1. ARPTableSettings Description Advanced ARP-table settings. Properties ARPMatchEnetSender The Ethernet Sender address matching the hardware address in the ARP data. (Default: DropLog) ARPQueryNoSenderIP If the IP source address of an ARP query (NOT response!) is "0.0.0.0".

  • Page 187: Authenticationsettings

    3.55.3. ConnTimeoutSettings Chapter 3. Configuration Reference 3.55.2. AuthenticationSettings Description Settings related to Authentication and Accounting. Properties LogoutAccUsersAtShutdown Logout authenticated accounting users and send Accounting- Stop packets prior to shutdown. (Default: Yes) AllowAuthIfNoAccountingRe- Allow an authenticated user to still have access even if no re- sponse sponse is received by the Accounting Server.

  • Page 188: Dhcprelaysettings

    3.55.4. DHCPRelaySettings Chapter 3. Configuration Reference Note This object type does not have an identifier and is identified by the name of the type only. There can only be one instance of this type. 3.55.4. DHCPRelaySettings Description Advanced DHCP relay settings. Properties MaxTransactions Maximum number of concurrent BOOTP/DHCP transactions.

  • Page 189: Ethernetsettings

    3.55.6. EthernetSettings Chapter 3. Configuration Reference Note This object type does not have an identifier and is identified by the name of the type only. There can only be one instance of this type. 3.55.6. EthernetSettings Description Settings for Ethernet interface. Properties DHCP_MinimumLeaseTime Minimum lease time (seconds) accepted from the DHCP...

  • Page 190: Fragsettings

    3.55.7. FragSettings Chapter 3. Configuration Reference above this percentage. (Default: 80) IfaceMon_BelowIfaceLoad Temporarily disable interface monitor on an interface if net- work load on the interface goes above this percentage. (Default: 70) IfaceMon_MinInterval Minimum interval between two resets of the same interface. (Default: 30) IfaceMon_RxErrorPerc At what percentage of errors to received packets to declare a...

  • Page 191: Hwmsettings

    3.55.8. HWMSettings Chapter 3. Configuration Reference ReassDoneLinger How long to remember a completed reassembly (watching for old dups). (Default: 20) ReassIllegalLinger How long to remember an illegal reassembly (watching for more fragments). (Default: 60) Note This object type does not have an identifier and is identified by the name of the type only.

  • Page 192: Ipsectunnelsettings

    3.55.10. IPsecTunnelSettings Chapter 3. Configuration Reference ICMPSendPerSecLimit Maximum number of ICMP responses that will be sent each second. (Default: 500) SilentlyDropStateICMPErrors Silently drop ICMP errors regarding statefully tracked open connections. (Default: Yes) Note This object type does not have an identifier and is identified by the name of the type only.

  • Page 193: Ipsettings

    3.55.11. IPSettings Chapter 3. Configuration Reference (Default: No) Note This object type does not have an identifier and is identified by the name of the type only. There can only be one instance of this type. 3.55.11. IPSettings Description Settings related to the IP protocol. Properties LogCheckSumErrors Log IP packets with bad checksums.

  • Page 194: L2Tpserversettings

    3.55.12. L2TPServerSettings Chapter 3. Configuration Reference IPOPT_TS How to handle IP packets with contained Timestamps. (Default: DropLog) IPOPT_RTRALT How to handle IP packets with contained route alert. (Default: ValidateLogBad) IPOPT_OTHER How to handle IP options not specified above. (Default: DropLog) DirectedBroadcasts How to handle directed broadcasts being passed from one in- terface to another.

  • Page 195: Localreasssettings

    3.55.14. LocalReassSettings Chapter 3. Configuration Reference Description Length limitations for various protocols. Properties MaxTCPLen TCP; Sometimes has to be increased if tunneling protocols are used. (Default: 1480) MaxUDPLen UDP; Many interactive applications use large UDP packets, may otherwise be decreased to 1480. (Default: 60000) MaxICMPLen ICMP;...

  • Page 196: Logsettings

    3.55.15. LogSettings Chapter 3. Configuration Reference LocalReass_NumLarge Number of large (>2K) local reassembly buffers (of the above size). (Default: 32) Note This object type does not have an identifier and is identified by the name of the type only. There can only be one instance of this type. 3.55.15.

  • Page 197: Multicastsettings

    3.55.17. MulticastSettings Chapter 3. Configuration Reference HighBuffers_Dynamic Allocate the HighBuffers value dynamically. (Default: Yes) HighBuffers Number of packet buffers to allocate in addition to the ~200 initial buffers. (Default: 1024) LocalUndelivered How to treat (allowed) packets to the Security Gateway that do not match open ports (snmp, scp, netcon, etc).

  • Page 198: Remotemgmtsettings

    3.55.18. RemoteMgmtSettings Chapter 3. Configuration Reference IGMPStartupQueryCount The number of startup queries to send during the startup phase. (Default: 2) IGMPLastMemberQueryInter- The maximum time (ms) until a host/client has to send an an- swer to a group and group-and-source specific query. (Default: 5000) IGMPUnsolicatedReportInterval The time between repetitions (ms) of an initial membership...

  • Page 199: Routingsettings

    3.55.19. RoutingSettings Chapter 3. Configuration Reference each second. (Default: 100) SNMPSysContact The contact person for this managed node. (Default: N/A) SNMPSysName The name for this managed node. (Default: N/A) SNMPSysLocation The physical location of this node. (Default: N/A) SNMPIfDescription What to display in the SNMP MIB-II ifDescr variables. (Default: Name) SNMPIfAlias What to display in the SNMP ifMIB ifAlias variables.

  • Page 200: Sslsettings

    3.55.20. SSLSettings Chapter 3. Configuration Reference Transp_CAMSize_Dynamic Allocate the CAM Size value dynamically. (Default: Yes) Transp_CAMSize Maximum number of entries in each CAM table. (Default: 8192) Transp_L3CSize_Dynamic Allocate the L3 Cache Size value dynamically. (Default: Yes) Transp_L3CSize Maximum number of entries in each Layer 3 Cache. (Default: 8192) Transp_RelaySTP Relay Spanning-Tree (STP, RSTP and MSTP) Bridge Pro-...

  • Page 201: Statesettings

    3.55.21. StateSettings Chapter 3. Configuration Reference _RC4_56_SHA1 Enable cipher TLS_RSA_EXPORT1024_WITH_RC4_56_SHA1. (Default: Yes) TLS_RSA_EXPORT512_WITH_ Enable cipher RC4_40_MD5 TLS_RSA_EXPORT1024_WITH_RC4_40_MD5. (Default: TLS_RSA_EXPORT512_WITH_ Enable cipher RC2_40_MD5 TLS_RSA_EXPORT1024_WITH_RC2_40_MD5. (Default: TLS_RSA_EXPORT_WITH_NU Enable cipher TLS_RSA_EXPORT_WITH_NULL_SHA1 LL_SHA1 (no encryption, just message validation). (Default: No) TLS_RSA_EXPORT_WITH_NU Enable cipher TLS_RSA_EXPORT_WITH_NULL_MD5 (no LL_MD5 encryption, just message validation).

  • Page 202: Tcpsettings

    3.55.22. TCPSettings Chapter 3. Configuration Reference Note This object type does not have an identifier and is identified by the name of the type only. There can only be one instance of this type. 3.55.22. TCPSettings Description Settings related to the TCP protocol. Properties TCPOptionSizes Validity of TCP header option sizes.

  • Page 203: Vlansettings

    3.55.23. VLANSettings Chapter 3. Configuration Reference TCPSynUrg The TCP URG flag together with SYN; normally invalid (strip=strip URG). (Default: DropLog) TCPSynPsh The TCP PSH flag together with SYN; normally invalid but always used by some IP stacks (strip=strip PSH). (Default: StripSilent) TCPSynRst The TCP RST flag together with SYN;...

  • Page 204: Sshclientkey

    3.56. SSHClientKey Chapter 3. Configuration Reference 3.56. SSHClientKey Description The public key of the client connecting to the SSH server. Properties Name Specifies a symbolic name for the key. (Identifier) Type DSA or RSA. (Default: DSA) Subject Value of the Subject header tag of the public key file. (Optional) PublicKey Specifies the public key.

  • Page 205: Thresholdrule

    3.57. ThresholdRule Chapter 3. Configuration Reference 3.57. ThresholdRule Description A Threshold Rule defines a filter for matching specific network traffic. When the filter criterion is met, the Threshold Rule Actions are evaluated and possible actions taken. Properties Index The index of the object, starting at 1. (Identifier) Name Specifies a symbolic name for the rule.
  • Page 206 3.57.1. ThresholdAction Chapter 3. Configuration Reference ThresholdUnit Specifies the threshold unit. (Default: ConnsSec) BlackList Activate BlackList. (Default: No) BlackListTimeToBlock The number of seconds that the dynamic black list should re- main. (Optional) BlackListBlockOnlyService Only block the service that triggered the blacklisting. (Default: No) BlackListIgnoreEstablished Do not drop existing connection.

  • Page 207: Updatecenter

    3.58. UpdateCenter Chapter 3. Configuration Reference 3.58. UpdateCenter Description Configure automatical updates. Properties AVEnabled Automatic updates of antivirus definitions and engine. (Default: No) IDPEnabled Automatic updates of IDP maintenance signatures. (Default: No) AdvancedIDPEnabled Automatic updates of Advanced IDP signatures. (Default: No) UpdateInterval Specifies the interval at which the automatic update runs.

  • Page 208: Userauthrule

    3.59. UserAuthRule Chapter 3. Configuration Reference 3.59. UserAuthRule Description The User Authentication Ruleset specifies from where users are allowed to authenticate to the sys- tem, and how. Properties Index The index of the object, starting at 1. (Identifier) Name Specifies a symbolic name for the rule. (Optional) Agent HTTP, HTTPS, XAUTH, PPP or EAP.
  • Page 209 3.59. UserAuthRule Chapter 3. Configuration Reference PPPAuthMSCHAP Use MS-CHAP authentication protocol. (Default: Yes) PPPAuthMSCHAPv2 Use MS-CHAP v2 authentication protocol. (Default: Yes) IdleTimeout If a user has successfully been authenticated, and no traffic has been seen from his IP address for this number of seconds, he/she will automatically be logged out.
  • Page 210 3.59. UserAuthRule Chapter 3. Configuration Reference...

  • Page 211: Index

    Index idppipes, 46 ifstat, 47 Commands igmp, 47 ikesnoop, 48 ippool, 49 ipsecglobalstats, 49 ipseckeepalive, 50 about, 31 ipsecstats, 50 activate, 20 ipsectunnels, 51 add, 20 alarm, 31 arp, 31 arpsnoop, 32 killsa, 51 ats, 33 languagefiles, 52 blacklist, 33 ldap, 52 buffers, 34 license, 53...
  • Page 212 Index settings, 69 DateTime, 107 show, 27 DefaultInterface, 134 shutdown, 70 Device, 108 sipalg, 70 DHCPRelay, 109 sshserver, 72 DHCPRelaySettings, 188 stats, 73 DHCPServer, 110 sysmsgs, 73 DHCPServerCustomOption, 111 DHCPServerPoolStaticHost, 110 DHCPServerSettings, 188 DNS, 112 techsupport, 73 DynamicRoutingRule, 118 time, 74 DynamicRoutingRuleAddRoute, 119 DynamicRoutingRuleExportOSPF, 119 DynDnsClientCjbNet, 102...
  • Page 213 Index IPsecTunnel, 136 RouteBalancingSpilloverSettings, 177 IPsecTunnelSettings, 192 RoutingRule, 178 IPSettings, 193 RoutingSettings, 199 IXP4NPEEthernetDriver, 114 RoutingTable, 179 L2TPClient, 139 ScheduleProfile, 182 L2TPServer, 140 ServiceGroup, 183 L2TPServerSettings, 194 ServiceICMP, 183 LDAPDatabase, 151 ServiceIPProto, 184 LDAPServer, 152 ServiceTCPUDP, 184 LengthLimSettings, 194 SSHClientKey, 204 LinkMonitor, 153 SSLSettings, 200 LocalReassSettings, 195...

This manual is also suitable for:

Dfl-800Netdefend dfl-260Dfl-1600Netdefend dfl-860Netdefend dfl-1660Netdefend dfl-2560 ... Show all

Table of Contents

Save PDF