D-Link NetDefend DFL-210 Cli Reference Manual
  1. Manuals
  2. Brands
  3. D-Link Manuals
  4. Firewall
  5. DFL-210 - NetDefend - Security Appliance
  6. Cli reference manual

D-Link NetDefend DFL-210 Cli Reference Manual

Network security firewall ver. 1.03
Hide thumbs Also See for NetDefend DFL-210:
Table of Contents

Advertisement

Quick Links

Download this manual See also: User Manual, Cli Reference Manual
Network Security Firewall
CLI Reference Guide
DFL-210/ 800/1600/ 2500
DFL-260/ 860
Ver.
1.03
curity
curity
Network Security Solution
ity
ity
S
S
S
S
S
S
S
S
S
S
S
S
cu
u
u
u
u
u
u
u
u
u
u
u
u
u
u
u
u
u
r
r
r
r
r
r
r r
r
r
r
r
r
r
r
r
ity
http://www.dlink.com

Advertisement

Table of Contents
loading

Related Manuals for D-Link NetDefend DFL-210

Summary of Contents for D-Link NetDefend DFL-210

  • Page 1 Network Security Firewall CLI Reference Guide DFL-210/ 800/1600/ 2500 DFL-260/ 860 curity curity Ver. 1.03 Network Security Solution http://www.dlink.com...
  • Page 2 CLI Reference Guide DFL-210/260/800/860/1600/2500 NetDefendOS version 2.25.01 D-Link Corporation No. 289, Sinhu 3rd Rd, Neihu District, Taipei City 114, Taiwan R.O.C. http://www.DLink.com Published 2009-04-08 Copyright © 2009...
  • Page 3 OF THE POSSIBILITY OF SUCH DAMAGES. FURTHERMORE, D-LINK WILL NOT BE LI- ABLE FOR THIRD-PARTY CLAIMS AGAINST CUSTOMER FOR LOSSES OR DAMAGES. D-LINK WILL IN NO EVENT BE LIABLE FOR ANY DAMAGES IN EXCESS OF THE AMOUNT D-LINK RECEIVED FROM THE END-USER FOR THE PRODUCT.

  • Page 4: Table Of Contents

    Table of Contents Preface ........................ 9 1. Introduction .....................11 1.1. Running a command ................11 1.2. Help ....................12 1.2.1. Help for commands ..............12 1.2.2. Help for object types ..............12 1.3. Function keys ..................13 1.4. Command line history ................14 1.5. Tab completion ..................15 1.5.1.
  • Page 5 CLI Reference Guide 2.2.30. ikesnoop ...................46 2.2.31. ippool ..................46 2.2.32. ipsecglobalstats ................47 2.2.33. ipseckeepalive ................47 2.2.34. ipsecstats ..................48 2.2.35. ipsectunnels ................48 2.2.36. killsa ..................49 2.2.37. license ..................49 2.2.38. linkmon ..................50 2.2.39. lockdown ..................50 2.2.40. logout ..................51 2.2.41. memory ..................51 2.2.42. natpool ..................51 2.2.43.
  • Page 6 CLI Reference Guide 3.4.8. ALG_TLS ..................88 3.5. ARP ....................89 3.6. BlacklistWhiteHost .................90 3.7. Certificate .....................91 3.8. Client ....................92 3.8.1. DynDnsClientCjbNet ..............92 3.8.2. DynDnsClientDLink ..............92 3.8.3. DynDnsClientDLinkChina ............92 3.8.4. DynDnsClientDyndnsOrg ..............93 3.8.5. DynDnsClientDynsCx ..............93 3.8.6. DynDnsClientPeanutHull ..............94 3.8.7. LoginClientBigPond ..............94 3.9. COMPortDevice ..................95 3.10.
  • Page 7 CLI Reference Guide 3.36.3. LogReceiverSMTP ..............139 3.36.4. LogReceiverSyslog ..............140 3.37. NATPool ..................141 3.38. OSPFProcess ..................142 3.38.1. OSPFArea ................143 3.39. Pipe ....................147 3.40. PipeRule ................... 150 3.41. PSK ....................151 3.42. RadiusAccounting ................152 3.43. RadiusServer ..................153 3.44.
  • Page 8 List of Examples 1. Command option notation ................... 9 1.1. Help for commands ..................12 1.2. Help for object types ..................12 1.3. Command line history ..................14 1.4. Tab completion ....................15 1.5. Inline help ....................15 1.6. Edit an existing property value ................16 1.7.

  • Page 9: Preface

    Administrators that are responsible for configuring and managing the D-Link Firewall. • Administrators that are responsible for troubleshooting the D-Link Firewall. This guide assumes that the reader is familiar with the D-Link Firewall, and has the necessary basic knowledge in network security. Notation...
  • Page 10 Notation Preface Because the table name option is followed by ellipses it is possible to specify more than one routing table. Since table name is optional as well, the user can specify zero or more policy-based routing tables. gw-world:/> routes Virroute Virroute2...

  • Page 11: Introduction

    Chapter 1. Introduction • Running a command, page 11 • Help, page 12 • Function keys, page 13 • Command line history, page 14 • Tab completion, page 15 • User roles, page 17 This guide is a reference for all commands and configuration object types that are available in the command line interface for NetDefendOS.

  • Page 12: Help

    1.2. Help Chapter 1. Introduction 1.2. Help 1.2.1. Help for commands There are two ways of getting help about a command. A brief help is displayed if the command name is typed followed by -? or -h. This applies to all commands and is therefore not listed in the option list for each command in this guide.

  • Page 13: Function Keys

    1.3. Function keys Chapter 1. Introduction 1.3. Function keys In addition to the return key there are a number of function keys that are used in the CLI. Backspace Delete the character to the left of the cursor. Complete current word. Ctrl-A or Home Move the cursor to the beginning of the line.

  • Page 14: Command Line History

    1.4. Command line history Chapter 1. Introduction 1.4. Command line history Every time a command is run, the command line is added to a history list. The up and down arrow keys are used to access previous command lines (up arrow for older command lines and down arrow to move back to a newer command line).

  • Page 15: Tab Completion

    1.5. Tab completion Chapter 1. Introduction 1.5. Tab completion By using the tab function key in the CLI the names of commands, options, objects and object prop- erties can be automatically completed. If the text entered before pressing tab only matches one pos- sible item, e.g.

  • Page 16: Configuration Object Type Categories

    1.5.3. Configuration object type cat- Chapter 1. Introduction egories value of that property. This is useful when editing an existing list of items or a long text value. The "<" character before a tab can be used to automatically fill in the default value for a parameter if no value has yet been set.

  • Page 17: User Roles

    1.6. User roles Chapter 1. Introduction 1.6. User roles Some commands and options cannot be used unless the logged in user has administrator priviege. This is indicated in this guide by a note following the command or "Admin only" written next to an option.
  • Page 18 1.6. User roles Chapter 1. Introduction...

  • Page 19: Command Reference

    Chapter 2. Command Reference • Configuration, page 19 • Runtime, page 30 • Utility, page 69 • Misc, page 70 2.1. Configuration 2.1.1. activate Activate changes. Description Activate the latest changes. This will issue a reconfiguration, using the new configuration. If the reconfiguration is successful a commit command must be issued within the configured timeout interval in order to save the changes to media.

  • Page 20: Cancel

    2.1.3. cancel Chapter 2. Command Reference Example 2.1. Create a new object Add objects with an identifier property (not index): gw-world:/> add Address IP4Address example_ip Address=1.2.3.4 Comments="This is an example" gw-world:/> add IP4Address example_ip2 Address=2.3.4.5 Add an object with an index: gw-world:/main>...

  • Page 21: Change Context

    2.1.4. cc Chapter 2. Command Reference Note Requires Administrator privilege. 2.1.4. cc Change the current context. Description Change the current configuration context. A context is a group of objects that are dependent on and grouped by a parent object. Many objects lie in the "root"...

  • Page 22: Commit

    2.1.5. commit Chapter 2. Command Reference <Identifier> The property that identifies the configuration object. May not be applicable depending on the specified <Type>. <Type> Type of configuration object to perform operation on. 2.1.5. commit Save new configuration to media. Description Save the new configuration to media.

  • Page 23: Pskgen

    2.1.7. pskgen Chapter 2. Command Reference Options -force Force object to be deleted even if it's used by other objects or has children. <Category> Category that groups object types. <Identifier> The property that identifies the configuration object. May not be applicable depending on the specified <Type>.

  • Page 24: Reject Changes

    2.1.8. reject Chapter 2. Command Reference All changes made to the object will be lost. If the object is added after the last commit, it will be re- moved. To reject the changes in more than one object, use either the -recursive flag to delete a context and all its children recursively or the -all flag to reject the changes in all objects in the configura- tion.

  • Page 25: Reset

    2.1.9. reset Chapter 2. Command Reference Note Requires Administrator privilege. 2.1.9. reset Reset unit configuration and/or binaries. Description Reset configuration or binaries to factory defaults. Usage reset [-configuration] [-unit] Options -configuration Reset configuration to factory default. -unit Reset unit to factory defaults. Note Requires Administrator privilege.

  • Page 26: Show

    2.1.11. show Chapter 2. Command Reference Comments=comment_without_whitespace gw-world:/main> set Route 1 Comment="A route" gw-world:/> set IPRule 12 Index=1 Set properties for an object without identifier: gw-world:/> set DynDnsClientDyndnsOrg Username=example Usage set [<Category>] <Type> [<Identifier>] [-disable] [-enable] [<key-value pair>]... Options -disable Disable object.

  • Page 27: Show Objects

    2.1.11. show Chapter 2. Command Reference The object is disabled. The object has errors. The object is newly created. The object is modified. Unchanged objects are not indicated by a flag. When listing categories and object types, categories are indicated by [] and types where objects may be contexts by /.

  • Page 28: Undelete

    2.1.12. undelete Chapter 2. Command Reference -errors Show all errors in the current configuration. -references Show all references to this object from other objects. -verbose Show error details. <Category> Category that groups object types. <Identifier> The property that identifies the configuration object. May not be applicable depending on the specified <Type>.
  • Page 29 2.1.12. undelete Chapter 2. Command Reference Note Requires Administrator privilege.

  • Page 30: Runtime

    2.2. Runtime Chapter 2. Command Reference 2.2. Runtime 2.2.1. about Show copyright/build information. Description Show copyright and build information. Usage about 2.2.2. alarm Show alarm information. Description Show list of currently active alarms. Usage alarm [-history] [-active] Options -active Show the currently active alarms. -history Show the 20 latest alarms.

  • Page 31: Arpsnoop

    2.2.4. arpsnoop Chapter 2. Command Reference Show all ARP entries. arp -show [<Interface>] [-ip=<pattern>] [-hw=<pattern>] [-num=<n>] Show ARP entries. arp -hashinfo [<Interface>] Show information on hash table health. arp -flush [<Interface>] Flush ARP cache of all specified interfaces. arp -notify=<ip> [<Interface>] [-hwsender=<Ethernet Address>] Send gratuitous ARP for IP.

  • Page 32: Ats

    2.2.5. ats Chapter 2. Command Reference Show snooped interfaces. arpsnoop {* | <interface>} [-verbose] Snoop specified interface. arpsnoop -disable Disable all snooping. Options -disable Disable all snooping. -verbose Verbose. {* | <interface>} Interface name. 2.2.5. ats Show active ARP Transaction States. Description Show active ARP Transaction States.

  • Page 33: Blacklist

    2.2.7. blacklist Chapter 2. Command Reference Options <interface> Interface to show BigPond information. 2.2.7. blacklist Blacklist. Description Block and unblock hosts on the black and white list. Note: Static blacklist hosts cannot be unblocked. If -force is not specified, only the exact host with the service, protocol/port and destiny specified is unblocked.

  • Page 34: Buffers

    2.2.8. buffers Chapter 2. Command Reference -dest=<ip address> Destination address to block/unblock (ExceptExtablished flag is set on). -dynamic Show dynamic hosts only. -force Unblock all services for the host that matches to options. -info Show detailed information. -listtime Show time in list (for dynamic hosts). -port=<port number>...

  • Page 35: Cam

    2.2.10. certcache Chapter 2. Command Reference 2.2.9. cam CAM table information. Description Show information about the CAM table(s) and their entries. Usage cam [-num=<n>] [<Interface>] [-flush] Options -flush Flush CAM table. If interface is specified, only entries using this interface are flushed.

  • Page 36: Connections

    2.2.13. cpuid Chapter 2. Command Reference 2.2.12. connections List current state-tracked connections. Description List current state-tracked connections. Usage connections -show [-num=<n>] [-verbose] [-srciface=<interface>] [-destiface=<interface>] [-protocol=<name/num>] [-srcport=<port>] [-destport=<port>] [-srcip=<ip addr>] [-destip=<ip addr>] List connections. connections Same as "connections -show". connections -close [-all] [-srciface=<interface>] [-destiface=<interface>] [-protocol=<name/num>] [-srcport=<port>] [-destport=<port>] [-srcip=<ip addr>] [-destip=<ip addr>]...

  • Page 37: Crashdump

    2.2.14. crashdump Chapter 2. Command Reference Display info about the cpu. Description Display the make and model of the machine's CPU. Usage cpuid 2.2.14. crashdump Show the contents of the crash.dmp file. Description Show the contents of the crash.dmp file, if it exists. Usage crashdump 2.2.15.

  • Page 38: Dhcp

    2.2.17. dhcprelay Chapter 2. Command Reference 2.2.16. dhcp Display information about DHCP-enabled interfaces or modify/update their leases. Description Display information about a DHCP-enabled interface. Usage dhcp List DHCP enabled interfaces. dhcp -list List DHCP enabled interfaces. dhcp -show [<interface>] Show information about DHCP enabled interface. dhcp -lease={RENEW | RELEASE} <interface>...

  • Page 39: Dhcpserver

    2.2.18. dhcpserver Chapter 2. Command Reference dhcprelay -show [-rules] [-routes] [<display filter>]... Show DHCP/BOOTP relayer ruleset. dhcprelay -release <ip address> [-interface=<Interface>] Terminate relayed session. Options -interface=<Interface> Interface. -release Terminate relayed session <[interface:]ip>. (Admin only) -routes Show the currently relayed DHCP sessions. -rules Show the DHCP/BOOTP relayer ruleset.

  • Page 40: Dns

    2.2.19. dns Chapter 2. Command Reference -leases Show DHCP server leases. -mappings Show DHCP server IP mappings. -release={BLACKLIST} Release specific type of IPs. (Admin only) -releaseip Release an active IP. (Admin only) -rules Show DHCP server rules. -show Show ruleset. <display filter>...

  • Page 41: Dynroute

    2.2.21. dynroute Chapter 2. Command Reference dnsbl [-show] [<SMTP ALG>] [-clean] Options -clean Clear DNSBL statistics for ALG. -show Show DNSBL statistics for ALG. <SMTP ALG> Name of SMTP ALG. 2.2.21. dynroute Show dynamic routing policy. Description Show the dynamic routing policy filter ruleset and current exports. In the "Flags"...

  • Page 42: Hostmon

    2.2.23. ha Chapter 2. Command Reference All reassemblies 0..1023 Assembly 'N' Example 2.9. frags frags NEW frags 254 Usage frags [{NEW | ALL | <reassembly id>}] [-free] [-done] [-num=<n>] Options -done List done (lingering) reassemblies. -free List free instead of active. -num=<n>...

  • Page 43: Httpposter

    2.2.25. httpposter Chapter 2. Command Reference Show Host Monitor statistics. Description Show active Host Monitor sessions. Usage hostmon [-verbose] [-num=<n>] Options -num=<n> Limit list to <n> entries. (Default: 20) -verbose Verbose output. 2.2.25. httpposter Display HTTPPoster_URLx status. Description Display configuration and status of configured HTTPPoster_URLx targets. Usage httpposter [-repost] [-display] Options...

  • Page 44: Idppipes

    2.2.27. idppipes Chapter 2. Command Reference hwaccel 2.2.27. idppipes Show and remove hosts that are piped by IDP. Description Show list of currently piped hosts. Usage idppipes -show [-host=<ip addr>] Lists hosts for which new connections are piped by IDP. idppipes -unpipe [-all] [-host=<ip addr>] Remove piping for the specified host.

  • Page 45: Igmp

    2.2.29. igmp Chapter 2. Command Reference Options -allindepth Show in-depth information about all interfaces. -filter=<expr> Filter list of interfaces. -num=<n> Limit list to <n> lines. (Default: 20) -pbr=<table name> Only list members of given PBR table(s). -restart Stop and restart the interface. (Admin only) <Interface>...

  • Page 46: Ikesnoop

    2.2.30. ikesnoop Chapter 2. Command Reference -query Simulate an incoming IGMP query message. -state Show the current IGMP state. <host address> Host IP address. <Interface> Interface. <MC address> Multicast Address. <router address> Router IP address. 2.2.30. ikesnoop Enable or disable IKE-snooping. Description Turn IKE on-screen snooping on/off.

  • Page 47: Ipsecglobalstats

    2.2.32. ipsecglobalstats Chapter 2. Command Reference Usage ippool -release [<ip address>] [-all] Forcibly free IP assigned to subsystem. ippool -show [-verbose] Show IP pool information. Options -all Free all IP addresses. -release Forcibly free IP assigned to subsystem. (Admin only) -show Show IP pool information.

  • Page 48: Ipsecstats

    2.2.34. ipsecstats Chapter 2. Command Reference Usage ipseckeepalive [-num=<n>] Options -num=<n> Maximum number of entries to display (default: 48). 2.2.34. ipsecstats Show the SAs in use. Description List the currently active IKE and IPsec SAs, optionally only showing SAs matching the pattern giv- en for the argument "tunnel".

  • Page 49: Killsa

    2.2.36. killsa Chapter 2. Command Reference ipsectunnels -iface=<recv iface> Show specific interface. ipsectunnels -num={ALL | <Integer>} Show specific number if interface. ipsectunnels Show interfaces. Options -iface=<recv iface> IPsec interface to show information about. -num={ALL | <Integer>} Maximum number of entries to show (default: 40). 2.2.36.

  • Page 50: Linkmon

    2.2.38. linkmon Chapter 2. Command Reference Description Show contents of the license file. Usage license 2.2.38. linkmon Display link montitoring statistics. Description . If link monitor hosts have been configured, linkmon will monitor host reachability to detect link/ NIC problems. Usage linkmon 2.2.39.

  • Page 51: Logout

    2.2.40. logout Chapter 2. Command Reference {ON | OFF} Enable / disable lockdown. Note Requires Administrator privilege. 2.2.40. logout Logout user. Description Logout current user. Usage logout 2.2.41. memory Show memory information. Description Show core memory consumption. Also show detailed memory use of some components and lists. Usage memory 2.2.42.

  • Page 52: Ospf

    2.2.43. ospf Chapter 2. Command Reference -num=<Integer> Maximum number of items to list (default: 20). -verbose Verbose (more information). <IP Address> Translated IP. <pool name> NAT Pool name. 2.2.43. ospf Show runtime OSPF information. Description Show runtime information about the OSPF router process(es). Note: -process is only required if there are >1 OSPF router processes.

  • Page 53: Pcapdump

    2.2.44. pcapdump Chapter 2. Command Reference ospf -ifaceup <interface> [-process=<OSPF Router Process>] Take specified interface online. ospf -execute={STOP | START | RESTART} [-process=<OSPF Router Process>] Start/stop/restart OSPF process. Options -area Show area information. -database Show the LSA database. -execute={STOP | START | RE- Start/stop/restart OSPF process.
  • Page 54 2.2.44. pcapdump Chapter 2. Command Reference pcapdump Show capture status. pcapdump -start [<interface(s)>] [-size=<value>] [-snaplen=<value>] [-count=<value>] [-out] [-out-nocap] [-eth=<Ethernet Address>] [-ethsrc=<Ethernet Address>] [-ethdest=<Ethernet Address>] [-ip=<IP Address>] [-ipsrc=<IP Address>] [-ipdest=<IP Address>] [-port=<0...65535>] [-srcport=<0...65535>] [-destport=<0...65535>] [-proto=<0...255>] [-icmp] [-tcp] [-udp] [-promisc] Start capture. pcapdump -stop [<interface(s)>] Stop capture.

  • Page 55: Pipes

    2.2.45. pipes Chapter 2. Command Reference -ipdest=<IP Address> Destination IP address filter. -ipsrc=<IP Address> Source IP address filter. -out Realtime packet brief dumped to console. -out-nocap Unbuffered (not stored in memory) realtime packet brief dumped to console. -port=<0...65535> TCP/UDP port filter. -promisc Set iface in promiscuous mode.

  • Page 56: Reconfigure

    2.2.46. reconfigure Chapter 2. Command Reference List all pipes. pipes -users [<Pipe>] [-expr=<String>] List users of a given pipe. pipes -show [<Pipe>] [-expr=<String>] Show pipe details. Options -expr=<String> Pipe wildcard(*) expression. -show Show pipe details. -users List users of a given pipe. <Pipe>...

  • Page 57: Routes

    2.2.48. routes Chapter 2. Command Reference 2.2.48. routes Display routing lists. Description Display information about the routing table(s): Contents of a (named) routing table. The list of routing tables, along with a total count of route entries in each table, as well as how many of the entries are single-host routes.

  • Page 58: Rules

    2.2.49. rules Chapter 2. Command Reference <table name> Name of routing table. 2.2.49. rules Show rules lists. Description Shows the content of the various types of rules, i.e. main ruleset, pipe ruleset, etc. Example 2.10. Show a range of rules rules -verbose 1-5 7-9 Usage rules [-type={IP | ROUTING | PIPE | IDP | THRESHOLD | IGMP}]...

  • Page 59: Settings

    2.2.51. settings Chapter 2. Command Reference Usage sessionmanager Show Session Manager status. sessionmanager -status Show Session Manager status. sessionmanager -list [-num=<n>] List active sessions. sessionmanager -info <session name> <database> Show in-depth information about session(s). sessionmanager -message <session name> <database> <message text> Send message to session with console.

  • Page 60: Shutdown

    2.2.52. shutdown Chapter 2. Command Reference Description Show the contents of the settings section, category by category. Usage settings Show list of categories. settings <category> Show settings in category. Options <category> Show settings in category. 2.2.52. shutdown Initiate core or system shutdown. Description Initiate restart of the core/system.
  • Page 61 2.2.54. sshserver Chapter 2. Command Reference Description List running SIP-ALG configurations, SIP registration and call information. Usage sipalg -definition <alg> Show running ALG configuration parameters. sipalg -registration[={SHOW | FLUSH}] <alg> Show or flush current registration table. sipalg -calls <alg> Show active calls table. sipalg -session <alg>...

  • Page 62: Sshserver

    2.2.55. stats Chapter 2. Command Reference 2.2.54. sshserver SSH Server. Description Show SSH Server status, or start/stop/restart SSH Server. Usage sshserver Show server status and list all connected clients. sshserver -status [-verbose] Show server status and list all connected clients. sshserver -keygen [-b=<bits>] [-t={RSA | DSA}] Generate SSH Server private keys.

  • Page 63: Sysmsgs

    2.2.56. sysmsgs Chapter 2. Command Reference and other performance data. Usage stats 2.2.56. sysmsgs System messages. Description Show contents of the FWLoader sysmsg buffer. Usage sysmsgs 2.2.57. techsupport Technical Support information. Description Generate information useful for technical support. Due to the large amount of output, this command might show a truncated result when execute from the local console.

  • Page 64: Uarules

    2.2.59. uarules Chapter 2. Command Reference Display current system time. time -set <date> <time> Set system local time: <YYYY-MM-DD> <HH:MM:SS>. time -sync [-force] Synchronize time with timeserver(s) (specified in settings). Options -force Force synchronization regardless of the MaxAdjust setting. -set Set system local time: <YYYY-MM-DD>...

  • Page 65: Urlcache

    2.2.61. urlcache Chapter 2. Command Reference Description Show autoupdate mechanism status or force an update. Usage updatecenter -update[={ANTIVIRUS | IDP | ALL}] Initiate an update check of the specified database. updatecenter -removedb={ANTIVIRUS | IDP} Remove the specified signature database. updatecenter -status[={ANTIVIRUS | IDP | ALL}] Show update status and database information.

  • Page 66: Userauth

    2.2.62. userauth Chapter 2. Command Reference -count Only display cache count. -num=<n> Limit list to <n> entries. (Default: 20) -server[={STATUS | CONNECT | Web Content Filtering Server options. (Default: status) DISCONNECT}] -verbose Verbose. 2.2.62. userauth Show logged-on users. Description Show currently logged-on users and other information. Also allows logged-on users to be forcibly logged out.

  • Page 67: Vlan

    2.2.63. vlan Chapter 2. Command Reference <user ip> IP address for user(s). 2.2.63. vlan Show information about VLAN. Description Show list of attached Virtual LAN Interfaces, or in-depth information about a specified VLAN. Usage vlan [<Interface>] Options <Interface> Display VLAN information about this interface. 2.2.64.
  • Page 68 2.2.65. zonedefense Chapter 2. Command Reference -save Save the current zonedefense state on all switches. -show Show the current block database. -status Show the current status of the zonedefense state machine.

  • Page 69: Utility

    2.3. Utility Chapter 2. Command Reference 2.3. Utility 2.3.1. ping Ping host. Description Sends one or more ICMP ECHO, TCP SYN or UDP datagrams to the specified IP address of a host. All datagrams are sent preloaded-style (all at once). The data size -length given is the ICMP or UDP data size.

  • Page 70: Misc

    2.4. Misc Chapter 2. Command Reference 2.4. Misc 2.4.1. echo Print text. Description Print text to the console. Example 2.12. Hello World echo Hello World Usage echo [<String>]... Options <String> Text to print. 2.4.2. help Show help for selected topic. Description The help system contains information about commands and configuration object types.

  • Page 71: History

    2.4.3. history Chapter 2. Command Reference Display help about selected topic from any category. help -category={COMMANDS | TYPES} [<Topic>] Display help from a specific topic category. Options -category={COMMANDS | Topic category. TYPES} <Topic> Help topic. 2.4.3. history Dump history to screen. Description List recently typed commands that have been stored in the command history.

  • Page 72: Script

    2.4.5. script Chapter 2. Command Reference Example 2.15. Upload certificate data scp certificate.cer user@sgw-ip:certificate/certificate_name scp certificate.key user@sgw-ip:certificate/certificate_name Example 2.16. Upload ssh public key data scp sshkey.pub user@sgw-ip:sshclientkey/sshclientkey_name Usage ls [-la] [<File>] [-al] [-long] Options -long Enable long listing format. <File> File to list.
  • Page 73 2.4.5. script Chapter 2. Command Reference Create configuration script from specified object, class or category. script -execute [-verbose] [-force] [-quiet] -name=<Name> [<Parameters>]... Execute script. script -show [-all] [-name=<Name>] Show script in console window. script -store [-all] [-name=<Name>] Store a script to persistent storage. script -remove [-all] [-name=<Name>] Remove script.
  • Page 74 2.4.5. script Chapter 2. Command Reference...

  • Page 75: Configuration Reference

    Chapter 3. Configuration Reference • Access, page 76 • Address, page 78 • AdvancedScheduleProfile, page 81 • ALG, page 82 • ARP, page 89 • BlacklistWhiteHost, page 90 • Certificate, page 91 • Client, page 92 • COMPortDevice, page 95 •...

  • Page 76: Access

    3.1. Access Chapter 3. Configuration Reference • IPsecAlgorithms, page 134 • LDAPDatabase, page 135 • LDAPServer, page 136 • LocalUserDatabase, page 137 • LogReceiver, page 138 • NATPool, page 141 • OSPFProcess, page 142 • Pipe, page 147 • PipeRule, page 150 •...
  • Page 77 3.1. Access Chapter 3. Configuration Reference Index The index of the object, starting at 1. (Identifier) Name Specifies a symbolic name for the object. Action Accept, Expect or Drop. (Default: Drop) Interface The interface the packet must arrive on for this rule to be carried out. Excep- tion: the Expect rule.

  • Page 78: Address

    3.2. Address Chapter 3. Configuration Reference 3.2. Address This is a category that groups the following object types. 3.2.1. AddressFolder Description An address folder can be used to group related address objects for better overview. Properties Name Specifies a symbolic name for the network object. (Identifier) Comments Text describing the current object.
  • Page 79 3.2.1. AddressFolder Chapter 3. Configuration Reference Name Specifies a symbolic name for the network object. (Identifier) Members Group members. Exclude Addresses that will be excluded from the group. (Optional) UserAuthGroups Groups and user names that belong to this object. Objects that fil- ter on credentials can only be used as source networks and destin- ations networks in rules.

  • Page 80: Ethernetaddress

    3.2.2. EthernetAddress Chapter 3. Configuration Reference ations networks in rules. (Optional) NoDefinedCredentials If this property is enabled the object requires user authentication, but has no credentials (user names or groups) defined. This means that the object only requires that a user is authenticated, but ig- nores any kind of group membership.

  • Page 81: Advancedscheduleprofile

    3.3. AdvancedScheduleProfile Chapter 3. Configuration Reference 3.3. AdvancedScheduleProfile Description An advanced schedule profile contains definitions of occurrences used by various policies in the system. Properties Name Specifies a symbolic name for the service. (Identifier) Comments Text describing the current object. (Optional) 3.3.1.

  • Page 82: Alg

    3.4. ALG Chapter 3. Configuration Reference 3.4. ALG This is a category that groups the following object types. 3.4.1. ALG_FTP Description Use an FTP Application Layer Gateway to manage FTP traffic through the system. Properties Name Specifies a symbolic name for the ALG. (Identifier) AllowServerPassive Allow server to use passive mode (unsafe for server).

  • Page 83: Alg_H323

    3.4.2. ALG_H323 Chapter 3. Configuration Reference VerifyContentMimetype Verify that file extentions correspond to the MIME type. (Default: No) Comments Text describing the current object. (Optional) 3.4.2. ALG_H323 Description Use an H.323 Application Layer Gateway to manage H.323 multimedia traffic. Properties Name Specifies a symbolic name for the ALG.
  • Page 84 3.4.4. ALG_POP3 Chapter 3. Configuration Reference FileListType Specifies if the file list contains files to allow or deny. (Default: Block) FailModeBehavior Standard behaviour on error: Allow or Deny. (Default: Deny) File List of file types to allow or deny. (Optional) VerifyContentMimetype Verify that file extentions correspond to the MIME type.

  • Page 85: Alg_Pop3

    3.4.5. ALG_SIP Chapter 3. Configuration Reference 3.4.4. ALG_POP3 Description Use an POP3 Application Layer Gateway to manage POP3 traffic through the system. Properties Name Specifies a symbolic name for the ALG. (Identifier) BlockUserPass Block clients from sending USER and PASS command. (Default: No) HideUser Prevent server from revealing that a user name do not exist.

  • Page 86: Alg_Smtp

    3.4.6. ALG_SMTP Chapter 3. Configuration Reference MaxRegistrationTime The maximum allowed time between registration requests. (Default: 3600) SipSignalTmout Timeout value for last seen SIP message. (Default: 43200) DataChannelTmout Timeout value for data channel. (Default: 120) AllowMediaByPass Allow clients to exchange media directly when possible. (Default: Yes) AllowTCPDataChannels Allow TCP data channels.

  • Page 87: Alg_Tftp

    3.4.7. ALG_TFTP Chapter 3. Configuration Reference DNSBL Disable or Enable DNSBL. (Default: No) SpamThreshold Spam Threshold defines when an email should be considered as Spam. (Default: 10) DropThreshold Drop Threshold defines when an email should be considered malicious and be dropped. (Default: 20) SpamTag Spam Tag that is inserted into the subject for an email con- sidered as Spam or malicious.

  • Page 88: Alg_Tls

    3.4.8. ALG_TLS Chapter 3. Configuration Reference Use an TFTP Application Layer Gateway to manage TFTP traffic through the system. Properties Name Specifies a symbolic name for the ALG. (Identifier) AllowedCommands Specifies allowed commands. (Default: ReadWrite) RemoveOptions Remove option part from request packet. (Default: No) AllowUnknownOptions Allow unknown options in request packet.

  • Page 89: Arp

    3.5. ARP Chapter 3. Configuration Reference 3.5. ARP Description Use an ARP entry to publish additional IP addresses and/or MAC addresses on a specified interface. Properties Mode Static, Publish or XPublish. (Default: Publish) Interface Indicates the interface to which the ARP entry applies; e.g. the interface the ad- dress shall be published on.

  • Page 90: Blacklistwhitehost

    3.6. BlacklistWhiteHost Chapter 3. Configuration Reference 3.6. BlacklistWhiteHost Description Hosts and networks added to this whitelist can never be blacklisted by IDP or Threshold Rules. Properties Addresses Specifies the addresses that will be whitelisted. Service Specifies the service that will be whitelisted. Schedule The schedule when the whitelist should be active.

  • Page 91: Certificate

    3.7. Certificate Chapter 3. Configuration Reference 3.7. Certificate Description An X. 509 certificate is used to authenticate a VPN client or gateway when establishing an IPsec tunnel. Properties Name Specifies a symbolic name for the certificate. (Identifier) Type Local, Remote or Request. CertificateData Certificate data.

  • Page 92: Client

    This object type does not have an identifier and is identified by the name of the type only. There can only be one instance of this type. 3.8.3. DynDnsClientDLinkChina Description Configure the parameters used to connect to the D-Link DynDNS service (China only).

  • Page 93: Dyndnsclientdyndnsorg

    3.8.4. DynDnsClientDyndnsOrg Chapter 3. Configuration Reference Properties DNSName The DNS name excluding the .dlinkddns.com suffix. Username Username. Password The password for the specified username. (Optional) Comments Text describing the current object. (Optional) Note This object type does not have an identifier and is identified by the name of the type only.

  • Page 94: Dyndnsclientpeanuthull

    3.8.6. DynDnsClientPeanutHull Chapter 3. Configuration Reference Note This object type does not have an identifier and is identified by the name of the type only. There can only be one instance of this type. 3.8.6. DynDnsClientPeanutHull Description Configure the parameters used to connect to the Peanut Hull DynDNS service. Properties DNSNames Specifies the DNS names separated by ";".

  • Page 95: Comportdevice

    3.9. COMPortDevice Chapter 3. Configuration Reference 3.9. COMPortDevice Description A serial communication port, that is used for accessing the CLI. Properties Port Port. (Identifier) BitsPerSecond Bits per second. (Default: 9600) DataBits Data bits. (Default: 8) Parity Parity. (Default: None) StopBits Stop bits.

  • Page 96: Configmodepool

    3.10. ConfigModePool Chapter 3. Configuration Reference 3.10. ConfigModePool Description An IKE Config Mode Pool will dynamically assign the IP address, DNS server, WINS server etc. to the VPN client connecting to this gateway. Properties IPPoolType Specifies whether a predefined IP Pool or a static set of IP addresses should be used as IP address source.

  • Page 97: Datetime

    3.11. DateTime Chapter 3. Configuration Reference 3.11. DateTime Description Set the date, time and time zone information for this system. Properties TimeZone Specifies the time zone. (Default: GMT) DSTEnabled Enable daylight saving time. (Default: Yes) DSTOffset Daylight saving time offset in minutes. (Default: 60) DSTStartMonth What month daylight saving time starts.

  • Page 98: Device

    3.12. Device Chapter 3. Configuration Reference 3.12. Device Description Global parameters for this device. Properties Name Name of the device. (Default: Device) ConfigVersion Version number of the configuration. (Default: 1) ConfigUser Name of the user who committed the current configuration. (Default: BaseConfiguration) ConfigSession Session type used when the current configuration was committed.

  • Page 99: Dhcprelay

    3.13. DHCPRelay Chapter 3. Configuration Reference 3.13. DHCPRelay Description Use a DHCP Relay to dynamically alter the routing table according to relayed DHCP leases. Properties Name Specifies a symbolic name for the relay rule. (Identifier) Action Ignore, Relay or BootpFwd. (Default: Ignore) SourceInterface The source interface of the DHCP packet.

  • Page 100: Dhcpserver

    3.14. DHCPServer Chapter 3. Configuration Reference 3.14. DHCPServer Description A DHCP Server determines a set of IP addresses and host configuration parameters to hand out to DHCP clients attached to a given interface. Properties Index The index of the object, starting at 1. (Identifier) Name Specifies a symbolic name for the DHCP Server rule.

  • Page 101: Dhcpservercustomoption

    3.14.2. DHCPServerCustomOption Chapter 3. Configuration Reference Static DHCP Server host entry Properties Host IP Address of the host. StaticHostType Identifier for host. (Default: MACAddress) MACAddress The hardware address of the host. ClientIdentType Type of client identifier specified. (Default: Ascii) ClientIdent The client identifier for the host.

  • Page 102: Dns

    3.15. DNS Chapter 3. Configuration Reference 3.15. DNS Description Configure the DNS (Domain Name System) client settings. Properties DNSServer1 IP of the primary DNS Server. (Optional) DNSServer2 IP of the secondary DNS Server. (Optional) DNSServer3 IP of the tertiary DNS Server. (Optional) Comments Text describing the current object.

  • Page 103: Driver

    3.16. Driver Chapter 3. Configuration Reference 3.16. Driver This is a category that groups the following object types. 3.16.1. IXP4NPEEthernetDriver Description Intel (IXP4xxNPE) Fast Ethernet Adaptor. Properties Comments Text describing the current object. (Optional) Note This object type does not have an identifier and is identified by the name of the type only.

  • Page 104: R8169Ethernetpcidriver

    3.16.4. R8169EthernetPCIDriver Chapter 3. Configuration Reference Note This object type does not have an identifier and is identified by the name of the type only. There can only be one instance of this type. 3.16.4. R8169EthernetPCIDriver Description RealTek (8169,8110) Gigabit Ethernet Adaptor. Properties Comments Text describing the current object.

  • Page 105: Dynamicroutingrule

    3.17. DynamicRoutingRule Chapter 3. Configuration Reference 3.17. DynamicRoutingRule Description A Dynamic Routing Policy rule creates a filter to catch statically configured or OSPF learned routes. The matched routes can be controlled by the action rules to be either exported to OSPF processes or to be added to one or more routing tables.

  • Page 106: Dynamicroutingruleexportospf

    3.17.2. DynamicRoutingRuleAddRoute Chapter 3. Configuration Reference 3.17.1. DynamicRoutingRuleExportOSPF Description An OSPF action is used to manipulate and export new or changed routes to an OSPF Router Pro- cess. Properties ExportToProcess Specifies to which OSPF Process the route change should be exported. SetTag Specifies a tag for this route.
  • Page 107 3.17.2. DynamicRoutingRuleAddRoute Chapter 3. Configuration Reference ProxyARPAllInterfaces Always select all interfaces, including new ones, for publishing routes via Proxy ARP. (Default: No) ProxyARPInterfaces Specifies the interfaces on which the security gateway should publish routes via Proxy ARP. (Optional) Comments Text describing the current object. (Optional) Note If no Index is specified when creating an instance of this type, the object will be placed last in the list and the Index will be equal to the length of the list.

  • Page 108: Ethernetdevice

    3.18. EthernetDevice Chapter 3. Configuration Reference 3.18. EthernetDevice Description Hardware settings for an Ethernet interface. Properties Name Specifies a symbolic name for the device. (Identifier) EthernetDriver The Ethernet PCI driver that should be used by the interface. PCIBus PCI bus number where the Ethernet adapter is installed. PCISlot PCI slot number used by the Ethernet adapter.

  • Page 109: Highavailability

    3.19. HighAvailability Chapter 3. Configuration Reference 3.19. HighAvailability Description Configure the High Availability cluster parameters for this system. Properties Enabled Enable high availability. (Default: No) ClusterID A (locally) unique cluster ID to use in identifying this group of HA security gateways. (Default: 0) SyncIface Specifies the interface used for state synchronization.

  • Page 110: Httpalgbanners

    3.20. HTTPALGBanners Chapter 3. Configuration Reference 3.20. HTTPALGBanners Description HTTP banner files specifies the look and feel of HTTP ALG restriction web pages. Properties Name Specifies a symbolic name for the HTTP Banner Files. (Identifier) CompressionForbidden HTML for the CompressionForbidden.html web page. ContentForbidden HTML for the ContentForbidden.html web page.

  • Page 111: Httpauthbanners

    3.21. HTTPAuthBanners Chapter 3. Configuration Reference 3.21. HTTPAuthBanners Description HTTP banner files specifies the look and feel of HTML authentication web pages. Properties Name Specifies a symbolic name for the HTTP Banner Files. (Identifier) FormLogin HTML for the FormLogin.html web page. LoginSuccess HTML for the LoginSuccess.html web page.

  • Page 112: Httpposter

    3.22. HTTPPoster Chapter 3. Configuration Reference 3.22. HTTPPoster Description Use the HTTP poster for dynamic DNS or automatic logon to services using web-based authentica- tion. Properties URL1 The first URL that will be posted when the security gateway is loaded. (Optional) URL2 The second URL that will be posted when the security gateway is loaded.

  • Page 113: Idlist

    3.23. IDList Chapter 3. Configuration Reference 3.23. IDList Description An ID list contains IDs, which are used within the authentication process when establishing an IPsec tunnel. Properties Name Specifies a symbolic name for the ID list. (Identifier) Comments Text describing the current object. (Optional) 3.23.1.

  • Page 114: Idprule

    3.24. IDPRule Chapter 3. Configuration Reference 3.24. IDPRule Description An IDP Rule defines a filter for matching specific network traffic. When the filter criterion is met, the IDP Rule Actions are evaluated and possible actions taken. Properties Index The index of the object, starting at 1. (Identifier) Name Specifies a symbolic name for the rule.
  • Page 115 3.24.1. IDPRuleAction Chapter 3. Configuration Reference BlackList Activate BlackList. (Default: No) BlackListTimeToBlock The number of seconds that the dynamic black list should re- main. (Optional) BlackListBlockOnlyService Only block the service that triggered the blacklisting. (Default: No) BlackListIgnoreEstablished Do not drop existing connection. (Default: No) PipeLimit Specifies the bandwidth limit in kbps for hosts triggered by this action.

  • Page 116: Igmprule

    3.25. IGMPRule Chapter 3. Configuration Reference 3.25. IGMPRule Description An IGMP rule specifies how to handle inbound IGMP reports and outbound IGMP queries. Properties Index The index of the object, starting at 1. (Identifier) Name Specifies a symbolic name for the rule. (Optional) Type The type of IGMP messages the rule applies to.
  • Page 117 3.25. IGMPRule Chapter 3. Configuration Reference Note If no Index is specified when creating an instance of this type, the object will be placed last in the list and the Index will be equal to the length of the list.

  • Page 118: Igmpsetting

    3.26. IGMPSetting Chapter 3. Configuration Reference 3.26. IGMPSetting Description IGMP parameters can be tuned for one, or a group of interfaces in order to match the characteristics of a network. Properties Name Specifies a symbolic name for the object. (Identifier) Interface The interfaces that these settings should apply to.

  • Page 119: Ikealgorithms

    3.27. IKEAlgorithms Chapter 3. Configuration Reference 3.27. IKEAlgorithms Description Configure algorithms which are used in the IKE phase of an IPsec session. Properties Name Specifies a symbolic name for the object. (Identifier) NULLEnabled Enable plaintext. (Default: No) DESEnabled Enable DES encryption algorithm. (Default: No) DES3Enabled Enable 3DES encryption algorithm.

  • Page 120: Interface

    3.28. Interface Chapter 3. Configuration Reference 3.28. Interface This is a category that groups the following object types. 3.28.1. DefaultInterface Description A special interface used to represent internal mechanisms in the system as well as an abstract "any" interface. Properties Name Specifies a symbolic name for the interface.

  • Page 121: Gretunnel

    3.28.3. GRETunnel Chapter 3. Configuration Reference AutoSwitchRoute Enable transparent mode, which means that a switch route is added automatically for this interface. (Default: No) AutoInterfaceNetworkRoute Automatically add a route for this interface using the given network. (Default: Yes) AutoDefaultGatewayRoute Automatically add a default route for this interface using the given default gateway.

  • Page 122: Interfacegroup

    3.28.5. IPsecTunnel Chapter 3. Configuration Reference 3.28.4. InterfaceGroup Description Use an interface group to combine several interfaces for a simplified security policy. Properties Name Specifies a symbolic name for the interface. (Identifier) Equivalent Specifies if the interfaces should be considered security equivalent, that means that if enabled the interface group can be used as a destination interface in rules where connections might need to be moved between the two interfaces.
  • Page 123 3.28.5. IPsecTunnel Chapter 3. Configuration Reference IPsecLifeTimeSeconds The lifetime of the IPsec connection in seconds. Whenever it's exceeded, a re-key will be initiated, providing new IPsec encryption and authentication session keys. (Default: 3600) IPsecLifeTimeKilobytes The lifetime of the IPsec connection in kilobytes. (Default: 0) EncapsulationMode Specifies if the IPsec tunnel should use Tunnel or Transport mode.

  • Page 124: L2Tpclient

    3.28.6. L2TPClient Chapter 3. Configuration Reference SetupSAPer Setup security association per network, host or port. (Default: Net) DeadPeerDetection Enable Dead Peer Detection. (Default: Yes) NATTraversal Enable or disable NAT traversal. (Default: OnIfNeeded) KeepAlive Disabled, Auto or Manual. (Default: Disabled) KeepAliveSourceIP Source IP address used when sending keep-alive ICMP pings.

  • Page 125: L2Tpserver

    3.28.7. L2TPServer Chapter 3. Configuration Reference PPPAuthNoAuth Allow no authentication for this tunnel. (Default: No) PPPAuthPAP Use PAP authentication protocol for this tunnel. User name and password are sent in plaintext. (Default: Yes) PPPAuthCHAP Use CHAP authentication protocol for this tunnel. (Default: Yes) PPPAuthMSCHAP Use MS-CHAP authentication protocol for this tunnel.

  • Page 126: Pppoetunnel

    3.28.8. PPPoETunnel Chapter 3. Configuration Reference The IP address of the PPTP/L2TP server interface. TunnelProtocol Specifies if PPTP or L2TP should be used for this tunnel. (Default: PPTP) Interface The interface that the PPTP/L2TP Server should be listening on. ServerIP Specifies the IP that the PPTP/L2TP server should listen on, this can be an IP of a interface, or for example an ARP published IP.
  • Page 127 3.28.8. PPPoETunnel Chapter 3. Configuration Reference Properties Name Specifies a symbolic name for the interface. (Identifier) EthernetInterface The physical Ethernet interface that connects to the PPPoE server network. The host name to store the assigned IP address in. Network The network from which traffic should be routed into the tun- nel.

  • Page 128: Vlan

    3.28.9. VLAN Chapter 3. Configuration Reference Comments Text describing the current object. (Optional) 3.28.9. VLAN Description Use a VLAN to define a virtual interface compatible with the IEEE 802.1Q Virtual LAN standard. Properties Name Specifies a symbolic name for the interface. (Identifier) Ethernet Specifies on which Ethernet interface the virtual LAN is defined.

  • Page 129: Ippool

    3.29. IPPool Chapter 3. Configuration Reference 3.29. IPPool Description An IP Pool is a dynamic object which consists of IP leases that are fetched from a DHCP Server. The IP Pool is used as an address source by subsystems that may need to distribute addresses, e.g. by IPsec in Configuration mode.

  • Page 130: Iprule

    3.30. IPRule Chapter 3. Configuration Reference 3.30. IPRule Description An IP rule specifies what action to perform on network traffic that matches the specified filter criter- Properties Index The index of the object, starting at 1. (Identifier) Name Specifies a symbolic name for the rule. (Optional) Action Reject, Drop, FwdFast, Allow, NAT, SAT or SLB_SAT.
  • Page 131 3.30. IPRule Chapter 3. Configuration Reference SLBMaxSlots Specifies maximum number of slots for IP and network stick- iness. (Default: 2048) SLBNetSize Specifies network size for network stickiness. (Default: 24) SLBNewPort Rewrite destination port to this port. (Optional) SLBMonitorPing Enable monitoring using ICMP Ping packets. (Default: No) SLBPingPollingInterval Delay in milliseconds between each ping interval.
  • Page 132 3.30. IPRule Chapter 3. Configuration Reference seconds back in time to summarize the number of new con- nections for connection-rate algorithm. (Default: 10) RequireIGMP Multicast traffic must have been requested using IGMP be- fore it is forwarded. (Default: Yes) MultiplexArgument Specifies how the traffic should be forwarded and translated.

  • Page 133: Iprulefolder

    3.31. IPRuleFolder Chapter 3. Configuration Reference 3.31. IPRuleFolder Description An IP Rule Folder can be used to group IP Rules into logical groups for better overview and simpli- fied management. Properties Index The index of the object, starting at 1. (Identifier) Name Specifies the name of the folder.

  • Page 134: Ipsecalgorithms

    3.32. IPsecAlgorithms Chapter 3. Configuration Reference 3.32. IPsecAlgorithms Description Configure algorithms which are used in the IPsec phase of an IPsec session. Properties Name Specifies a symbolic name for the object. (Identifier) NULLEnabled Enable plaintext. (Default: No) DESEnabled Enable DES encryption algorithm. (Default: No) DES3Enabled Enable 3DES encryption algorithm.

  • Page 135: Ldapdatabase

    3.33. LDAPDatabase Chapter 3. Configuration Reference 3.33. LDAPDatabase Description External LDAP server used to verify user names and passwords. Properties Name Specifies a symbolic name for the server. (Identifier) The IP address of the server. Port The TCP port of the server. (Default: 389) Timeout The error timeout, in milliseconds, used when processing requests.

  • Page 136: Ldapserver

    3.34. LDAPServer Chapter 3. Configuration Reference 3.34. LDAPServer Description An LDAP server is used as a central repository of certificates and CRLs that the security gateway can download when necessary. Properties Host Specifies the IP address or hostname of the LDAP server. Username Specifies the username to use when accessing the LDAP server.

  • Page 137: Localuserdatabase

    3.35. LocalUserDatabase Chapter 3. Configuration Reference 3.35. LocalUserDatabase Description A local user database contains user accounts used for authentication purposes. Properties Name Specifies a symbolic name for the object. (Identifier) Comments Text describing the current object. (Optional) 3.35.1. User Description User credentials may be used in User Authentication Rules, which in turn are used in e.g.

  • Page 138: Logreceiver

    3.36. LogReceiver Chapter 3. Configuration Reference 3.36. LogReceiver This is a category that groups the following object types. 3.36.1. EventReceiverSNMP2c Description A SNMP2c event receiver is used to receive SNMP events from the system. Properties Name Specifies a symbolic name for the log receiver. (Identifier) IPAddress Destination IP address.

  • Page 139: Logreceivermemory

    3.36.3. LogReceiverSMTP Chapter 3. Configuration Reference 3.36.2. LogReceiverMemory Description A memory log receiver is used to receive and keep log events in system RAM. Properties Name Specifies a symbolic name for the log receiver. (Identifier) LogSeverity Specifies with what severity log events will be sent to the specified log receiv- ers.

  • Page 140: Logreceiversyslog

    3.36.4. LogReceiverSyslog Chapter 3. Configuration Reference Comments Text describing the current object. (Optional) 3.36.4. LogReceiverSyslog Description A Syslog receiver is used to receive log events from the system in the standard Syslog format. Properties Name Specifies a symbolic name for the log receiver. (Identifier) IPAddress Specifies the IP address of the log receiver.

  • Page 141: Natpool

    3.37. NATPool Chapter 3. Configuration Reference 3.37. NATPool Description A NAT Pool is used for NATing multiple concurrent connections to using different source IP ad- dresses. Properties Name Specifies a symbolic name for the NAT Pool. (Identifier) Type Specifies how NAT'ed connections are assigned a NAT IP ad- dress.

  • Page 142: Ospfprocess

    3.38. OSPFProcess Chapter 3. Configuration Reference 3.38. OSPFProcess Description An OSPF Router Process defines a group of routers exchanging routing information via the Open Shortest Path First routing protocol. Properties Name Specifies a symbolic name for the OSPF process. (Identifier) RouterID Specifies the IP address that is used to identify the router.

  • Page 143: Ospfarea

    3.38.1. OSPFArea Chapter 3. Configuration Reference cifies the details of the log. (Default: Off) DebugRoute Enables or disabled logging of routing table manipulation events and also specifies the details of the log. (Default: Off) AuthType Specifies the authentication type for the OSPF protocol exchanges. (Default: None) AuthPassphrase Specifies the passphrase used for authentication.
  • Page 144 3.38.1. OSPFArea Chapter 3. Configuration Reference Properties Interface Specifies which interface in the security gateway will be used for this OS- PF interface. (Identifier) Type Auto, Broadcast, Point-to-point or Point-to-multipoint. (Default: Auto) MetricType Metric value or Bandwidth. (Default: MetricValue) Metric Specifies the routing metric for this OSPF interface.
  • Page 145 3.38.1. OSPFArea Chapter 3. Configuration Reference For point-to-point and point-to-multipoint networks, specify the IP addresses of directly connected routers. Properties Interface Specifies the OSPF interface of the neighbor. IPAddress IP Address of the neighbor. Metric Specifies the metric of the neighbor. (Optional) Comments Text describing the current object.
  • Page 146 3.38.1. OSPFArea Chapter 3. Configuration Reference (Default: Yes) AuthType Specifies the authentication type for the OSPF protocol exchanges. (Default: None) AuthPassphrase Specifies the passphrase used for authentication. (Optional) AuthMD5ID Specifies the MD5 key ID used for MD5 digest authentication. AuthMD5Key A 128-bit key used to produce the MD5 digest.

  • Page 147: Pipe

    3.39. Pipe Chapter 3. Configuration Reference 3.39. Pipe Description A pipe defines basic traffic shaping parameters. The pipe rules then determines which traffic goes through which pipes. Properties Name Specifies a symbolic name for the pipe. (Identifier) LimitKbpsTotal Total bandwidth limit for this pipe in kilobits per second. (Optional) LimitPPSTotal Total packet per second limit for this pipe.
  • Page 148 3.39. Pipe Chapter 3. Configuration Reference UserLimitPPS0 Specifies the throughput limit per group in PPS for precedence 0 (the lowest precedence). (Optional) UserLimitKbps1 Specifies the bandwidth limit per group in kbps for precedence 1. (Optional) UserLimitPPS1 Specifies the throughput limit per group in PPS for precedence 1. (Optional) UserLimitKbps2 Specifies the bandwidth limit per group in kbps for precedence 2.
  • Page 149 3.39. Pipe Chapter 3. Configuration Reference (Default: 7) Comments Text describing the current object. (Optional)

  • Page 150: Piperule

    3.40. PipeRule Chapter 3. Configuration Reference 3.40. PipeRule Description A Pipe Rule determines traffic shaping policy - which Pipes to use - for one or more types of traffic with the same granularity as the standard ruleset. Properties Index The index of the object, starting at 1. (Identifier) Name Specifies a symbolic name for the object.

  • Page 151: Psk

    3.41. PSK Chapter 3. Configuration Reference 3.41. PSK Description PSK (Pre-Shared Key) authentication is based on a shared secret that is known only by the parties involved. Properties Name Specifies a symbolic name for the pre-shared key. (Identifier) Type Specifies the type of the shared key. PSKAscii Specifies the PSK as a passphrase.

  • Page 152: Radiusaccounting

    3.42. RadiusAccounting Chapter 3. Configuration Reference 3.42. RadiusAccounting Description External RADIUS server used to collect user statistics. Properties Name Specifies a symbolic name for the server. (Identifier) IPAddress The IP address of the server. Port The UDP port of the server. (Default: 1813) RetryTimeout The retry timeout, in seconds, used when trying to contact the RADIUS ac- counting server.

  • Page 153: Radiusserver

    3.43. RadiusServer Chapter 3. Configuration Reference 3.43. RadiusServer Description External RADIUS server used to verify user names and passwords. Properties Name Specifies a symbolic name for the server. (Identifier) IPAddress The IP address of the server. Port The UDP port of the server. (Default: 1812) RetryTimeout The retry timeout, in seconds, used when trying to contact the RADIUS ac- counting server.

  • Page 154: Remotemanagement

    3.44. RemoteManagement Chapter 3. Configuration Reference 3.44. RemoteManagement This is a category that groups the following object types. 3.44.1. RemoteMgmtHTTP Description Configure HTTP/HTTPS management to enable remote management to the system. Properties Name Specifies a symbolic name for the object. (Identifier) Interface Specifies the interface for which remote access is granted.
  • Page 155 3.44.3. RemoteMgmtSSH Chapter 3. Configuration Reference Properties Name Specifies a symbolic name for the SSH server. (Identifier) Interface Specifies the interface for which remote access is granted. Port The listening port for the SSH server. (Default: 22) AllowAuthMethodPassword Allow password client authentication. (Default: Yes) AllowAuthMethodPublicKey Allow public key client authentication.
  • Page 156 3.44.3. RemoteMgmtSSH Chapter 3. Configuration Reference Comments Text describing the current object. (Optional)

  • Page 157: Routebalancinginstance

    3.45. RouteBalancingInstance Chapter 3. Configuration Reference 3.45. RouteBalancingInstance Description A route balancing instance is assoicated with a routingtable and defines how to make use of multiple routes to the same destination. Properties RoutingTable Specify routingtable to deploy route load balancing in. (Identifier) Algorithm Specify which algorithm to use when balancing the routes.

  • Page 158: Routebalancingspilloversettings

    3.46. RouteBalancingSpilloverSetting Chapter 3. Configuration Reference 3.46. RouteBalancingSpilloverSettings Description Settings associated with the spillover algorithm. Properties Interface Interface to threshold limit. (Identifier) HoldTime Number of consecutive seconds over/under the threshold limit to trig- ger state change for the affected routes. (Default: 30) OutboundThreshold Outbound threshold limit.

  • Page 159: Routingrule

    3.47. RoutingRule Chapter 3. Configuration Reference 3.47. RoutingRule Description A Routing Rule forces the use of a routing table in the forward and/or return direction of traffic on a connection. The ordering parameter of the routing table determines if it is consulted before or after the main routing table.

  • Page 160: Routingtable

    3.48. RoutingTable Chapter 3. Configuration Reference 3.48. RoutingTable Description The system has a predefined main routing table. Alternate routing tables can be defined by the user. Properties Name Specifies a symbolic name for the routing table. (Identifier) Ordering Specifies how a route lookup is done in a named routing ta- ble.
  • Page 161 3.48.1. Route Chapter 3. Configuration Reference 1000) EnableHostMonitoring Enables the Host Monitoring functionality. (Default: No) Reachability Specifies the number of hosts that are required to be reach- able to consider the route to be active. (Default: ALL) GracePeriod Specifies the time to wait after a reconfiguration until the monitoring begins.

  • Page 162: Switchroute

    3.48.2. SwitchRoute Chapter 3. Configuration Reference RequestURL Specifies the HTTP URL to monitor. ExpectedResponse Expected HTTP response. Comments Text describing the current object. (Optional) Note If no Index is specified when creating an instance of this type, the object will be placed last in the list and the Index will be equal to the length of the list.

  • Page 163: Scheduleprofile

    3.49. ScheduleProfile Chapter 3. Configuration Reference 3.49. ScheduleProfile Description A Schedule Profile defines days and dates and are then used by the various policies in the system. Properties Name Specifies a symbolic name for the service. (Identifier) Specifies during which intervals the schedule profile is active on Mondays. (Optional) Specifies during which intervals the schedule profile is active on Tuesdays.

  • Page 164: Service

    3.50. Service Chapter 3. Configuration Reference 3.50. Service This is a category that groups the following object types. 3.50.1. ServiceGroup Description A Service Group is a collection of service objects, which can then be used by different policies in the system. Properties Name Specifies a symbolic name for the service.

  • Page 165: Serviceipproto

    3.50.3. ServiceIPProto Chapter 3. Configuration Reference EchoReplyCodes Specifies which Echo Reply message codes should be matched. (Default: 0-255) SourceQuenching Enable matching of Source Quenching messages. (Default: SourceQuenchingCodes Specifies which Source Quenching message codes should be matched. (Default: 0-255) TimeExceeded Enable matching of Time Exceeded messages. (Default: No) TimeExceededCodes Specifies which Time Exceeded message codes should be matched.
  • Page 166 3.50.4. ServiceTCPUDP Chapter 3. Configuration Reference Properties Name Specifies a symbolic name for the service. (Identifier) DestinationPorts Specifies the destination port or the port ranges applicable to this ser- vice. Type Specifies whether this service uses the TCP or UDP protocol or both. (Default: TCP) SourcePorts Specifies the source port or the port ranges applicable to this service.

  • Page 167: Settings

    3.51. Settings Chapter 3. Configuration Reference 3.51. Settings This is a category that groups the following object types. 3.51.1. AccountingSettings Description Settings related to accounting. Properties LogoutAccUsersAtShutdown Logout authenticated accounting users and send Accounting- Stop packets prior to shutdown. (Default: Yes) AllowAuthIfNoAccountingRe- Allow an authenticated user to still have access even if no re- sponse...

  • Page 168: Conntimeoutsettings

    3.51.3. ConnTimeoutSettings Chapter 3. Configuration Reference ARPMulticast ARP packets claiming to be multicast addresses; may need to be enabled for some load balancers/redundancy solutions. (Default: DropLog) ARPBroadcast ARP packets claiming to be broadcast addresses; should never need to be enabled. (Default: DropLog) ARPCacheSize Number of ARP entries in cache, total.

  • Page 169: Dhcpserversettings

    3.51.5. DHCPServerSettings Chapter 3. Configuration Reference Advanced DHCP relay settings. Properties MaxTransactions Maximum number of concurrent BOOTP/DHCP transactions. (Default: 32) TransactionTimeout Timeout for each transaction (in seconds). (Default: 10) MaxPPMPerIface Maximum packets per minute that are relayed from clients to the server, per interface.

  • Page 170: Icmpsettings

    3.51.7. ICMPSettings Chapter 3. Configuration Reference Settings related to fragmented packets. Properties PseudoReass_MaxConcurrent Maximum number of concurrent fragment reassemblies. Set to 0 to drop all fragments. (Default: 1024) IllegalFrags Illegaly constructed fragments; partial overlaps, bad sizes, etc. (Default: DropLog) DuplicateFragData On receipt of duplicate fragments, verify matching data...

  • Page 171: Ipsectunnelsettings

    3.51.8. IPsecTunnelSettings Chapter 3. Configuration Reference Note This object type does not have an identifier and is identified by the name of the type only. There can only be one instance of this type. 3.51.8. IPsecTunnelSettings Description Settings for the IPsec tunnel interfaces used for establishing IPsec VPN connections to and from this system.
  • Page 172 3.51.9. IPSettings Chapter 3. Configuration Reference Description Settings related to the IP protocol. Properties LogCheckSumErrors Log IP packets with bad checksums. (Default: Yes) LogNonIP4 Log occurrences of non-IPv4 packets. (Default: Yes) LogReceivedTTL0 Log received packets with TTL=0; this should never happen! (Default: Yes) Block0000Src Block 0.0.0.0 as source address.

  • Page 173: L2Tpserversettings

    3.51.10. L2TPServerSettings Chapter 3. Configuration Reference IPRF How to handle the IP Reserved Flag, if set; it should never be. (Default: DropLog) StripDFOnSmall Strip the "DontFragment" flag for packets of this size or smal- ler. (Default: 65535) MulticastIPEnetOnMismatch What action to take when ethernet and IP multicast addresses does not match.

  • Page 174: Localreasssettings

    3.51.12. LocalReassSettings Chapter 3. Configuration Reference MaxAHLen IPsec AH; Authenticated communication. (Default: 2000) MaxSKIPLen SKIP; Simple Key management for IP, VPN protocol. (Default: 2000) MaxOSPFLen OSPF; Open Shortest Path First, routing protocol. (Default: 1480) MaxIPIPLen IPIP/FWZ; Encapsulated (tunneled) transport, used by VPN-1. (Default: 2000) MaxIPCompLen IPsec IPComp;...

  • Page 175: Miscsettings

    3.51.14. MiscSettings Chapter 3. Configuration Reference LogSendPerSecLimit Limits how many log packets the security gateway may send out per second. (Default: 2000) Note This object type does not have an identifier and is identified by the name of the type only.

  • Page 176: Remotemgmtsettings

    3.51.16. RemoteMgmtSettings Chapter 3. Configuration Reference IGMPQueryInterval The interval (ms) between general queries sent by the Secur- ity Gateway. (Default: 125000) IGMPQueryResponseInterval The maximum time (ms) until a host/client has to send an an- swer to a query. (Default: 10000) IGMPStartupQueryInterval The general query interval (ms) to use during the startup phase (default: 1/4 of the 'IGMP Query Interval' parameter.

  • Page 177: Routingsettings

    3.51.17. RoutingSettings Chapter 3. Configuration Reference configured IP Rules. (Default: Yes) SNMPRequestLimit Maximum number of SNMP packets that will be processed each second. (Default: 100) SNMPSysContact The contact person for this managed node. (Default: N/A) SNMPSysName The name for this managed node. (Default: N/A) SNMPSysLocation The physical location of this node.

  • Page 178: Sslsettings

    3.51.18. SSLSettings Chapter 3. Configuration Reference Transp_CAMSize_Dynamic Allocate the CAM Size value dynamically. (Default: Yes) Transp_CAMSize Maximum number of entries in each CAM table. (Default: 8192) Transp_L3CSize_Dynamic Allocate the L3 Cache Size value dynamically. (Default: Yes) Transp_L3CSize Maximum number of entries in each Layer 3 Cache. (Default: 8192) Transp_RelaySTP Relay Spanning-Tree (STP, RSTP and MSTP) Bridge Pro-...

  • Page 179: Statesettings

    3.51.19. StateSettings Chapter 3. Configuration Reference Note This object type does not have an identifier and is identified by the name of the type only. There can only be one instance of this type. 3.51.19. StateSettings Description Parameters for the state engine in the system. Properties ConnReplace What to do when the connection table is full.
  • Page 180 3.51.20. TCPSettings Chapter 3. Configuration Reference TCPMSSOnLow How to handle too low MSS values. (Default: DropLog) TCPMSSMax Maximum allowed TCP MSS (Maximum Segment Size). (Default: 1460) TCPMSSVPNMax Limits TCP MSS for VPN connections; minimizes fragmentation. (Default: 1400) TCPMSSOnHigh How to handle too high MSS values. (Default: Adjust) TCPMSSLogLevel When to log regarding too high TCP MSS, if not logged by "TCP MSS on high".

  • Page 181: Vlansettings

    3.51.21. VLANSettings Chapter 3. Configuration Reference TCPRF The TCP Reserved field: should be zero. Used in OS fingerprinting. Also part of ECN extension. (Default: StripLog) TCPNULL TCP "NULL" packets without SYN, ACK, FIN or RST; normally in- valid, used by scanners. (Default: DropLog) TCPSequenceNumbers Validation of TCP sequence numbers.

  • Page 182: Sshclientkey

    3.52. SSHClientKey Chapter 3. Configuration Reference 3.52. SSHClientKey Description The public key of the client connecting to the SSH server. Properties Name Specifies a symbolic name for the key. (Identifier) Type DSA or RSA. (Default: DSA) Subject Value of the Subject header tag of the public key file. (Optional) PublicKey Specifies the public key.

  • Page 183: Thresholdrule

    3.53. ThresholdRule Chapter 3. Configuration Reference 3.53. ThresholdRule Description A Threshold Rule defines a filter for matching specific network traffic. When the filter criterion is met, the Threshold Rule Actions are evaluated and possible actions taken. Properties Index The index of the object, starting at 1. (Identifier) Name Specifies a symbolic name for the rule.
  • Page 184 3.53.1. ThresholdAction Chapter 3. Configuration Reference ThresholdUnit Specifies the threshold unit. (Default: ConnsSec) ZoneDefense Activate ZoneDefense. (Default: No) BlackList Activate BlackList. (Default: No) BlackListTimeToBlock The number of seconds that the dynamic black list should re- main. (Optional) BlackListBlockOnlyService Only block the service that triggered the blacklisting. (Default: No) BlackListIgnoreEstablished Do not drop existing connection.

  • Page 185: Updatecenter

    3.54. UpdateCenter Chapter 3. Configuration Reference 3.54. UpdateCenter Description Configure automatical updates. Properties AVEnabled Automatic updates of antivirus definitions and engine. (Default: No) IDPEnabled Automatic updates of IDP maintenance signatures. (Default: No) AdvancedIDPEnabled Automatic updates of Advanced IDP signatures. (Default: No) UpdateInterval Specifies the interval at which the automatic update runs.

  • Page 186: Userauthrule

    3.55. UserAuthRule Chapter 3. Configuration Reference 3.55. UserAuthRule Description The User Authentication Ruleset specifies from where users are allowed to authenticate to the sys- tem, and how. Properties Index The index of the object, starting at 1. (Identifier) Name Specifies a symbolic name for the rule. (Optional) Agent HTTP, HTTPS, XAUTH, PPP or EAP.
  • Page 187 3.55. UserAuthRule Chapter 3. Configuration Reference PPPAuthMSCHAP Use MS-CHAP authentication protocol. (Default: Yes) PPPAuthMSCHAPv2 Use MS-CHAP v2 authentication protocol. (Default: Yes) IdleTimeout If a user has successfully been authenticated, and no traffic has been seen from his IP address for this number of seconds, he/she will automatically be logged out.

  • Page 188: Zonedefenseblock

    3.56. ZoneDefenseBlock Chapter 3. Configuration Reference 3.56. ZoneDefenseBlock Description Manually configured blocks are used to block a host/network on the switches either by default or based on schedule. Properties Addresses Specifies the addresses to block. Protocol All, TCP, UDP or ICMP. (Default: All) Port Specifies which UDP or TCP port to use.

  • Page 189: Zonedefenseexcludelist

    3.57. ZoneDefenseExcludeList Chapter 3. Configuration Reference 3.57. ZoneDefenseExcludeList Description The exclude list is used exclude certain hosts/networks from being blocked out by IDP/Threshold rule violations. Properties Addresses Specifies the addresses that should not be blocked. (Optional) Comments Text describing the current object. (Optional) Note This object type does not have an identifier and is identified by the name of the type only.

  • Page 190: Zonedefenseswitch

    3.58. ZoneDefenseSwitch Chapter 3. Configuration Reference 3.58. ZoneDefenseSwitch Description A ZoneDefense switch will have its ACLs controlled and hosts/networks violating the IDP/ Threshold rules will be blocked directly on the switch. Properties Name Specifies a symbolic name for the ZoneDefense switch. (Identifier) SwitchModel Specifies the switch model type.
  • Page 191 3.58. ZoneDefenseSwitch Chapter 3. Configuration Reference...

  • Page 192: Index

    ifstat, 44 igmp, 45 Index ikesnoop, 46 ippool, 46 ipsecglobalstats, 47 Commands ipseckeepalive, 47 ipsecstats, 48 ipsectunnels, 48 about, 30 activate, 19 killsa, 49 add, 19 alarm, 30 arp, 30 arpsnoop, 31 license, 49 ats, 32 linkmon, 50 lockdown, 50 logout, 51 ls, 71 bigpond, 32...
  • Page 193 Index DynamicRoutingRuleAddRoute, 106 DynamicRoutingRuleExportOSPF, 106 DynDnsClientCjbNet, 92 uarules, 64 DynDnsClientDLink, 92 undelete, 28 DynDnsClientDLinkChina, 92 updatecenter, 64 DynDnsClientDyndnsOrg, 93 urlcache, 65 DynDnsClientDynsCx, 93 userauth, 66 DynDnsClientPeanutHull, 94 vlan, 67 Ethernet, 120 vpnstats, 67 EthernetAddress, 79, 80 (see also ipsecstats) EthernetAddressGroup, 79, 80 EthernetDevice, 108 EventReceiverSNMP2c, 138 zonedefense, 67...
  • Page 194 Index LoginClientBigPond, 94 ThresholdAction, 183 LogReceiverMemory, 139 ThresholdRule, 183 LogReceiverMessageException, 138, 139, 140 LogReceiverSMTP, 139 LogReceiverSyslog, 140 UpdateCenter, 185 LogSettings, 174 User, 137 UserAuthRule, 186 MarvellEthernetPCIDriver, 103 MiscSettings, 175 VLAN, 128 MonitoredHost, 161 VLANSettings, 181 MulticastSettings, 175 ZoneDefenseBlock, 188 NATPool, 141 ZoneDefenseExcludeList, 189 ZoneDefenseSwitch, 190 OSPFAggregate, 145...

This manual is also suitable for:

Dfl-800Netdefend dfl-860Dfl-1600Netdefend dfl-2500Netdefend dfl-260Netdefend dfl-800 ... Show all

Table of Contents