HP TippingPoint Next Generation Firewall specification

Image 12

HP TippingPoint Next Generation Firewall manual

Contents

Version1.0.1 Page Table of Contents Page Log Configure Commands Edit Running Configuration CommandsDisplay email log-file-size log-storage log-test rotate Page CLI Reference Guide Page About This Guide This section covers the following topics Typefaces Document MessagesThis guide uses the following document conventions Web site addresses Customer Support Contact InformationPage Command Line Interface Syntax Parentheses indicate a mandatory argument Hierarchical Menu and Prompt display Shortcut Navigation Keys Root Command Mode Help Edit Configuration Mode Object statement Utilities Display Show Commit ExitHelp More DisplaySet session to display output page by Syntax Boot ClearManages software packages Syntax Clears system information Syntax Flushes the following configuration items Syntax DateEdit Flush Log-configure High-availabilityList Related Commands LogoutMaster-key Logs you out of the system Syntax Reboot Reboots the system SyntaxPing Ping6 Save-config Service-accessConfigure data collection for on-box reports Syntax Enable or disable service access Syntax Set Show 1Show command Command Description Mode PIM-SM routing informationShows the boot file Show network processor reassembly statistics Show aaa Show users informationShow device version information Show agglink Show arp Show ndpShow autoconf dhcpv4 client Show autoconf dhcpv6 client Show cluster Show dateShow dhcp relay Show dhcp server lease Show dhcpv6 Show dnsShow firewall Show high-availability Show interface ExamplesMTU Show ip bgp Show ip igmp Show ip mroute Show ip ospfShow ip pim-sm Shows the multicast routes Syntax Show ip rip Show ip routeShows the RIP routes Syntax Show ip smr Show ipv6 mldShow SMR routing information Syntax Show ipv6 mroute Show ipv6 ospfv3Show ipv6 pim-sm Shows IPv6 routing information for multicast routes Syntax Show ipv6 ripng Show ipv6 route ospfv3Shows the RIPng routes Syntax Show ipv6 route ripng Show ipipv6 routeShow key Show l2tp Show license Show log-fileShow log-file Filename Ngfw Command Line Interface Reference Root Commands Show log-file boot Show log-file Filename statShow log-file summary Example To tail the last 5 lines of the boot log file Show mfg-infoShow np engine Shows manufacturing information Syntax Show np general statistics Show np protocol-mixShows general network processor information Syntax Show np reassembly Show np rule-statsShow np softlinx Show np tier-stats Show service Shows the state of all the services SyntaxShow quarantine-list Show reports Show sms Show snmpShow system buffers Show system connections PID User Virt RES SHR S CPU MEM TIME+ Command Show system processesListen ACC Stream Listening Show system statistics Show system usageShow system virtual-memory Show system xms memory Show terminal Show traffic-fileShow tse connection-table Shows terminal type information Syntax Show tse Show user-diskShow users Show version Shutdown SmsSnapshot create Snapshot list Snapshot restore Restore system from saved snapshot SyntaxSnapshot remove Tcpdump Traceroute Traceroute6User-disk Trace IPv6 network routes Example Show user-diskmaster-key Root Commands Displays log configuration settings Syntax Allows you to set logging email daemon parameters Syntax # LOG File Allocation Settings # Internal Disk Log-file-sizeLog-storage Log-test Rotate Sets log rotation parameters Syntax Maxfilesize 1Monitor and System Commands 2Network CommandsMonitor/System Network 3Policy Commands Policy Authentication RoutingAaa Actionsets Addressgroups Application-filter-mgmtApplication-groups Enters address group context Enables or Disables application visibility Syntax Enters auto digital vaccine context mode SyntaxApplication-visibility Autodv Enters blockedStreams context mode Syntax Related commandEnters captive portal context mode Syntax BlockedStreams Enters certificates context mode Syntax Enters cluster context mode SyntaxCertificates Cluster Deletes file or configuration item Syntax Delete Enters Dhcp context mode Syntax Enters DNS context mode SyntaxDhcp Dns Enters destination NAT context mode Enters firewall context mode SyntaxDst-nat Firewall Enters general context mode Usage Gen Enters global-inspection context mode Enters high-availability context mode SyntaxGlobal-inspection Feature Interface IP configuration mode Enters IPS profile context mode Syntax Ips# IPV4 Routes IPv6 configuration Syntax Ipv6L2tp-serverX Distance Log Enters multicast registration context mode Enters notify contacts context mode SyntaxMulticast-registration Notifycontacts Enters NTP context mode Syntax Ntp Enters Reputation context mode Allows you to configure the route-map SyntaxReputation Route-map Enters schedules context mode Syntax RouterSchedules Enters the specified router protocol context Syntax SegmentX Services Enters services context modeEnters Snmp context mode Syntax Snmp Enters source NAT context mode Enters VPN context mode SyntaxSrc-nat Vpn Enters security zone context mode Zones Running-aaa Context Commands NGFWrunning-aaadeleteNGFWrunning-aaadisplay NGFWrunning-aaaldap-group NGFWrunning-aaaldap-schema NGFWrunning-aaaloginNGFWrunning-aaapassword NGFWrunning-aaaradius-group Running-aaa-ldap-group-X Context Commands NGFWrunning-aaaremote-login-groupNGFWrunning-aaarole NGFWrunning-aaauser Bind-dn DN Running-aaa-radius-group-X Context Commands NGFWrunning-aaa-ldap-group-mygroup1tls Configure TLS Syntax Running-actionsets Context Commands Immediate Commit Feature. Changes take effect immediatelyNGFWrunning-actionsetsactionset NGFWrunning-actionsetsdelete Running-actionsets-X Context Commands NGFWrunning-actionsetsrenameRename action set oldname newname Syntax NGFWrunning-actionsets-myactionset1http-block Http-showname enabledisable NGFWrunning-actionsets-myactionset1packet-trace enable Running-addressgroups Context Commands Running-addressgroups-X Context CommandsNGFWrunning-addressgroupsaddressgroup NGFWrunning-addressgroupsdelete Running-agglinkX Context Commands NGFWrunning-agglink0arp/ndpNGFWrunning-agglink0autoconfv6 NGFWrunning-agglink0bind NGFWrunning-agglink0delete Configure IP settings NGFWrunning-agglink0descriptionNGFWrunning-agglink0ip Enter description for the interface Syntax NGFWrunning-agglink0ipaddress NGFWrunning-agglink0ipv6NGFWrunning-agglink0load-balance NGFWrunning-agglink0mac-address NGFWrunning-agglink0mtu NGFWrunning-agglink0prefixNGFWrunning-agglink0ra-autoconf-level NGFWrunning-agglink0ra-interval NGFWrunning-agglink0ra-lifetime NGFWrunning-agglink0ra-mtuNGFWrunning-agglink0ra-transmit-mode NGFWrunning-agglink0shutdown Running-app-filter-mgmt Context Commands Running-app-groups Context CommandsNGFWrunning-agglink0tcp6mss NGFWrunning-application-filter-mgmtfilter Running-autodv Context Commands Running-app-groups-X Context CommandsNGFWrunning-app-groupsdelete NGFWrunning-app-groupsrename NGFWrunning-autodvdisable NGFWrunning-autodvenableNGFWrunning-autodvdelete NGFWrunning-autodvlist Running-autodv-calendar Context Commands NGFWrunning-autodvupdateNGFWrunning-autodvproxy Running-bgp-X Context Commands Running-autodv-periodic Context CommandsConfigure BGP aggregate entries Syntax NGFWrunning-bgp-1aggregate-address NGFWrunning-bgp-1always-compare-med NGFWrunning-bgp-1deleteAlways compare MEDs from neighbors in different AS Syntax C.D/M NGFWrunning-bgp-1disable NGFWrunning-bgp-1enableNGFWrunning-bgp-1deterministic-med NGFWrunning-bgp-1distance NGFWrunning-bgp-1graceful-restart NGFWrunning-bgp-1local-preferenceNGFWrunning-bgp-1neighbor NGFWrunning-bgp-1timers NGFWrunning-bgp-1networkNGFWrunning-bgp-1redistribute NGFWrunning-bgp-1router-id Running-blockedStreams Context Commands Running-bridgeX Context Commands NGFWrunning-bridge0delete NGFWrunning-bridge0descriptionNGFWrunning-bridge0ip Configure interface MTU Syntax NGFWrunning-bridge0ipaddressNGFWrunning-bridge0ipv6 NGFWrunning-bridge0mtu NGFWrunning-bridge0prefix NGFWrunning-bridge0ra-autoconf-levelNGFWrunning-bridge0ra-interval NGFWrunning-bridge0ra-interval-transmit NGFWrunning-bridge0ra-mtu NGFWrunning-bridge0ra-transmit-modeNGFWrunning-bridge0shutdown NGFWrunning-bridge0tcp4mss Running-captive-portal Context Commands Running-captive-portal-rule-X Context Commands NGFWrunning-captive-portalsetSet a Captive Portal parameter Syntax Move after RULEIDbefore RULEIDto position Value Running-certificates Context Commands NGFWrunning-certificatesca-certificateNGFWrunning-certificatescert-request NGFWrunning-certificatescertificate Add device certificate SyntaxBegin Certificate Request END Certificate Request Display file or configuration item Syntax NGFWrunning-certificatescrlNGFWrunning-certificatesdelete NGFWrunning-certificatesdisplay Running-certificates-crl Context Commands NGFWrunning-certificatesprivate-keyAdd device certificate private-key Syntax Running-cluster Context Commands NGFWrunning-clustercheckNGFWrunningcluster Perform consistency check Syntax NGFWrunning-clusterdisable NGFWrunning-clusterenableNGFWrunning-clustercluster-name NGFWrunning-clusterdelete Running-cluster-tct Context Commands NGFWrunning-clustermember-nameNGFWrunning-clusterstandby NGFWrunning-clustertct NGFWrunning-cluster-tctipaddress IPv4 address Syntax MD5SHA1 Passphrase NGFWrunning-cluster-tctmtu Apply MTU Syntax NGFWrunning-cluster-tctretry Apply retry interval SyntaxSPEED-MODE Running-dhcp-relay Context Commands NGFWrunning-dhcp-relaydisableNGFWrunning-dhcp-relayclient NGFWrunning-dhcp-relaydelete Running-dhcp-server Context Commands NGFWrunning-dhcp-relayenableNGFWrunning-dhcp-relayserver NGFWrunning-dhcp-serverdelete Running-dhcp-server-X Context Commands NGFWrunning-dhcp-serverdisableNGFWrunning-dhcp-serverenable NGFWrunning-dhcp-serverdisplay Default-gateway myselfA.B.C.D Xxxxxx Running-dnat Context Commands NGFWrunning-dnatdeleteNGFWrunningdst-nat Delete destination NAT rules Running-dnat-rule-X Context Commands NGFWrunning-dnatrenameNGFWrunning-dnatrule Rename destination NAT rule Syntax NGFWrunning-dnat-rule-dnat1move Move rule position Syntax Running-dns Context Commands NGFWrunning-dnsdeleteNGFWrunningdns NGFWrunning-dnsdomain-name NGFWrunning-dnsdomain-searchNGFWrunning-dnsname-server NGFWrunning-dnsproxy Running-ethernetX Context Commands NGFWrunning-ethernet1arp/ndpNGFWrunning-ethernet1autoconfv6 NGFWrunning-ethernet1delete NGFWrunning-ethernet1description NGFWrunning-ethernet1ip NGFWrunning-ethernet1ipaddress NGFWrunning-ethernet1ipv6 NGFWrunning-ethernet1mtu NGFWrunning-ethernet1physical-mediaNGFWrunning-ethernet1prefix NGFWrunning-ethernet1ra-autoconf-level NGFWrunning-ethernet1ra-interval NGFWrunning-ethernet1ra-interval-transmitNGFWrunning-ethernet1ra-lifetime NGFWrunning-ethernet1ra-mtu NGFWrunning-ethernet1restart NGFWrunning-ethernet1shutdownNGFWrunning-ethernet1tcp4mss NGFWrunning-ethernet1tcp6mss Running-firewall Context Commands Running-firewall-rule-X Context Commands Example NGFWrunning-firewall-rule-myrule1disable Disable rule Syntax NGFWrunning-firewall-rule-myrule1enable Enable rule Syntax NGFWrunning-firewall-rule-myrule1schedule Apply scheduleRepprofile Schedule includeexclude Schedulename Running-gen Context Commands NGFWrunning-genarpNGFWrunning-genauto-restart NGFWrunning-gendelete NGFWrunning-genephemeral-port-range NGFWrunning-genforwardingNGFWrunning-genhost NGFWrunning-genhttps NGFWrunning-genmanagement-service Configure static NDP entry SyntaxNGFWrunning-geninband-management NGFWrunning-genndp Running-global-inspection Context Commands NGFWrunning-global-inspectiondefault-inspectionNGFWrunning-genssh NGFWrunning-gentimezone Running-greX Context Commands NGFWrunning-gre0autoconfv6NGFWrunning-gre0bind NGFWrunning-gre0checksum NGFWrunning-gre0description Configure endpoints IP address Syntax NGFWrunning-gre0ipNGFWrunning-gre0ipaddress NGFWrunning-gre0ipv6 NGFWrunning-gre0keyNGFWrunning-gre0mtu NGFWrunning-gre0shutdown Running-high-availability Context Commands NGFWrunning-high-availabilitydisableNGFWrunning-gre0tcp4mss NGFWrunning-gre0tcp6mss Running-ips Context Commands NGFWrunning-high-availabilityenableNGFWrunning-high-availabilityfailover-group NGFWrunning-high-availabilitystate-sync NGFWrunning-ipsafc-severity NGFWrunning-ipsconnection-tableNGFWrunning-ipsdelete NGFWrunning-ipsdeployment-choices NGFWrunning-ipsdisplay-categoryrules NGFWrunning-ipsgzip-decompressionNGFWrunning-ipsprofile NGFWrunning-ipsquarantine-duration Running-ips-X Context Commands NGFWrunning-ipsrenameRenames a profile Syntax Filternumber Running-ipsec Context Commands NGFWrunning-ipsecdeleteNGFWrunning-ips-1deployment Change deployment Syntax NGFWrunningvpn ipsec NGFWrunning-ipsecphase1 NGFWrunning-ipsecipsecNGFWrunning-ipseclog NGFWrunning-ipsecmanual NGFWrunning-ipsecphase2 Enters phase2 proposal context SyntaxNGFWrunning-ipsecpolicy NGFWrunning-ipsecpre-shared-key NGFWrunning-ipsecretransmit-timeout NGFWrunning-ipsecretransmit-triesNGFWrunning-ipsectrust NGFWrunning-ipsecuser Running-ipsec-policy-X Context Commands and their Usage Running-ipsec-vpn-X Context Commands and their Usage Exchange-mode mainaggressive NGFWrunning-ipsec-vpn-myvpntype Configure VPN type Syntax Running-l2tp-serverX Context Commands NGFWrunning-l2tp-server0authNGFWrunning-l2tp-server0bind NGFWrunning-l2tp-server0delete Running-l2tpX Context Commands NGFWrunning-l2tp-server0sequencingNGFWrunning-l2tp0auth NGFWrunning-l2tp0autoconfv6 Configure IP DNS server address request Syntax NGFWrunning-l2tp0deleteNGFWrunning-l2tp0description NGFWrunning-l2tp0dns-request NGFWrunning-l2tp0ip NGFWrunning-l2tp0ipcpNGFWrunning-l2tp0ipv6 NGFWrunning-l2tp0ipv6cp NGFWrunning-l2tp0log-option NGFWrunning-l2tp0mruNGFWrunning-l2tp0mtu NGFWrunning-l2tp0prefix Modify IPv6 Router Advertisement autoconfiguration level NGFWrunning-l2tp0ra-autoconf-levelNGFWrunning-l2tp0ra-interval NGFWrunning-l2tp0ra-interval-transmit NGFWrunning-l2tp0ra-mtu NGFWrunning-l2tp0ra-transmit-modeNGFWrunning-l2tp0sequencing NGFWrunning-l2tp0shutdown Running-log Context Commands NGFWrunning-l2tp0tcp6mssNGFWrunning-logdelete NGFWrunninglog Add service log option Syntax NGFWrunning-loglogNGFWrunning-loglog-option 178 Edit Running Configuration Commands NGFWrunning-logsub-system Sets sub-system log level Syntax Running-loopbackX Context Commands NGFWrunning-loopback0deleteNGFWrunninginterface loopback0 Configure IP settings Syntax NGFWrunning-loopback0descriptionNGFWrunning-loopback0ip Running-manual-sa Context Commands NGFWrunning-loopback0ipaddressNGFWrunning-loopback0ipv6 NGFWrunning-loopback0mtu SPI CryptalgoAES Cryptkey Authalgo Running-mgmt Context Commands NGFWrunning-mgmtdeleteNGFWrunning-mgmtdescription NGFWrunning-mgmthost Configure physical-media settings Syntax NGFWrunning-mgmtipaddressNGFWrunning-mgmtphysical-media Running-multicast-registration Context Commands Running-notifycontacts email Context Commands NGFWrunning-notifycontactsdelete NGFWrunning-notifycontactsemail-from-addressNGFWrunning-notifycontactsemail-from-domain NGFWrunning-notifycontactsemail-server Running-notifycontacts-X Snmp Context Commands NGFWrunning-notifycontactsemail-to-default-addressDefault to email address Syntax NGFWrunning-notifycontactsrename Running-ntp Context Commands Configure NTP authentication key SyntaxNGFWrunning-ntpdelete NGFWrunning-ntpkey Running-phase1-proposal-X Context Commands and their Usage NGFWrunning-ntpntpNGFWrunning-ntppolling-interval NGFWrunning-ntpserver Dh-group Running-ospf Context Commands Configure an Ospf area, area range, or virtual link SyntaxNGFWrunning-ospfarea NGFWrunningrouter ospf NGFWrunning-ospfdefault-metric Set default metric of routes redistributed into Ospf SyntaxSIMPLE-PASSWORD NGFWrunning-ospfdelete NGFWrunning-ospfdisable NGFWrunning-ospfenableNGFWrunning-ospfdistance NGFWrunning-ospfpassive-interface Running-ospfv3 Context Commands NGFWrunning-ospfrfc1583-compatibleNGFWrunning-ospfrouter-id NGFWrunning-ospfv3area NGFWrunning-ospfv3disable NGFWrunning-ospfv3enableDisable Open Shortest Path First OSPFv3 Syntax Enable Open Shortest Path First OSPFv3 Syntax NGFWrunning-ospfv3nsf NGFWrunning-ospfv3passive-interfaceNGFWrunning-ospfv3redistribute NGFWrunning-ospfv3router-id Running-pim-smv4 Context Commands NGFWrunning-pim-smv4disableNGFWrunning-pim-smv4bsr-candidate NGFWrunning-pim-smv4delete NGFWrunning-pim-smv4enable NGFWrunning-pim-smv4rp-addressNGFWrunning-pim-smv4rp-candidate NGFWrunning-pim-smv4threshold Running-pim-smv6 Context Commands NGFWrunning-pim-smv6disableNGFWrunning-pim-smv6bsr-candidate NGFWrunning-pim-smv6delete NGFWrunning-pim-smv6enable Enable PIM-SM IPv6 on the device SyntaxNGFWrunning-pim-smv6rp-address NGFWrunning-pim-smv6rp-candidate Running-pppoeX Context Commands NGFWrunning-pppoe0authNGFWrunning-pppoe0autoconfv6 NGFWrunning-pppoe0bind NGFWrunning-pppoe0description NGFWrunning-pppoe0dns-requestNGFWrunning-pppoe0ip NGFWrunning-pppoe0ipcp NGFWrunning-pppoe0ipv6NGFWrunning-pppoe0ipv6cp NGFWrunning-pppoe0keep-alive NGFWrunning-pppoe0mru NGFWrunning-pppoe0mtuNGFWrunning-pppoe0prefix NGFWrunning-pppoe0ra-autoconf-level NGFWrunning-pppoe0ra-intervalNGFWrunning-pppoe0ra-interval-transmit NGFWrunning-pppoe0ra-lifetime NGFWrunning-pppoe0service Configure PPPoE service name SyntaxNGFWrunning-pppoe0ra-transmit-mode NGFWrunning-pppoe0shutdown Running-pptpX Context Commands NGFWrunning-pppoe0tcp6mssNGFWrunning-pptp0always-ack NGFWrunning-pptp0auth NGFWrunning-pptp0delayed-ack NGFWrunning-pptp0bindNGFWrunning-pptp0delete NGFWrunning-pptp0description NGFWrunning-pptp0dns-request NGFWrunning-pptp0ipNGFWrunning-pptp0ipcp NGFWrunning-pptp0ipv6 Configure interface MTU NGFWrunning-pptp0keep-aliveNGFWrunning-pptp0log-option NGFWrunning-pptp0mru NGFWrunning-pptp0prefix NGFWrunning-pptp0ra-autoconf-levelNGFWrunning-pptp0ra-interval NGFWrunning-pptp0ra-interval-transmit NGFWrunning-pptp0ra-lifetime NGFWrunning-pptp0ra-mtuNGFWrunning-pptp0ra-transmit-mode NGFWrunning-pptp0shutdown Running-rep Context Commands NGFWrunning-pptp0tcp6mssNGFWrunning-pptp0windowing NGFWrunning-repdelete Running-rep-X group X Context Commands NGFWrunning-repprofileNGFWrunning-reprename Create or enter reputation profile context Syntax Running-rep-X profile X Context Commands NGFWrunning-rep-1domain New domain name SyntaxNGFWrunning-rep-1ip IP address IPv4/IPv6 Syntax NGFWrunning-rep-abccheck-source-address enable Running-rip Context Commands NGFWrunning-ripdefault-metricSet default metric for imported routes Syntax NGFWrunning-ripdelete NGFWrunning-ripdisable NGFWrunning-ripenableNGFWrunning-ripdistance NGFWrunning-ripdistribute-list NGFWrunning-riptimers Suppress RIP routing updates on an interface SyntaxSet basic RIP timers Syntax NGFWrunning-rippassive-interface Running-ripng Context Commands NGFWrunning-riptriggered-updatesNGFWrunning-ripngdefault-metric NGFWrunning-ripversion NGFWrunning-ripngdisable NGFWrunning-ripngenableNGFWrunning-ripngdistance NGFWrunning-ripngdistribute-list NGFWrunning-ripngtimers Suppress RIPng routing updates on an interface SyntaxSet basic RIPng timers Syntax NGFWrunning-ripngpassive-interface Running-route-map Context Commands NGFWrunning-ripngtriggered-updatesNGFWrunning-route-mapdelete NGFWrunning-route-mapmatch Running-schedules Context Commands Running-schedules-X Context CommandsNGFWrunning-schedulesdelete NGFWrunning-schedulesrename Running-segmentX Context Commands NGFWrunning-segment0bindNGFWrunning-segment0delete NGFWrunning-segment0description Running-services Context Commands NGFWrunning-servicesdeleteNGFWrunning-segment0high-availability NGFWrunning-segment0link-down Running-services-X Context Commands NGFWrunning-servicesrenameNGFWrunning-servicesservice Rename service Syntax NGFWrunning-services-myservice1icmp Apply ICMPv4 Syntax NGFWrunning-services-myservice1icmpv6 Apply ICMPv6 Syntax Running-smr Context Commands NGFWrunning-smrdeleteNGFWrunning-smrdscp NGFWrunningrouter smr Running-snat Context Commands NGFWrunning-smrtimerNGFWrunning-smrmonitor NGFWrunning-smrttl Running-snat-rule-X Context Commands NGFWrunning-snatrenameNGFWrunning-snatrule Rename source NAT rule Syntax Srcnatruleid Running-snmp Context Commands NGFWrunning-snmpauthtrapNGFWrunning-snmpcommunity NGFWrunning-snmpdelete NGFWrunning-snmpengineIDNGFWrunning-snmpsnmp NGFWrunning-snmptrapsession Configure SNMPv3 USM read-only user Syntax NGFWrunning-snmpusername Running-vlanX Context Commands NGFWrunning-vlan0arp/ndpNGFWrunning-vlan0autoconfv6 NGFWrunning-vlan0bind NGFWrunning-vlan0description Enter description for the interface NGFWrunning-vlan0ip NGFWrunning-vlan0ipaddressNGFWrunning-vlan0ipv6 NGFWrunning-vlan0mtu NGFWrunning-vlan0prefixCost NGFWrunning-vlan0ra-autoconf-level NGFWrunning-vlan0ra-intervalNGFWrunning-vlan0ra-interval-transmit NGFWrunning-vlan0ra-lifetime NGFWrunning-vlan0ra-mtuNGFWrunning-vlan0ra-transmit-mode NGFWrunning-vlan0shutdown Running-zones Context Commands NGFWrunning-vlan0tcp6mssNGFWrunning-zonesdelete NGFWrunning-zonesrename Running-zones-X Context Commands