Show firewall policy | Allied Telesis AT-8700XL, RAPIER I specs

Software Version 2.8.1

163

show firewall

SHow FIREwall

Description This command displays a summary of all security policies that have been created and the interfaces assigned to each policy.

Figure 51: Example output from the show firewall command

Firewall Configuration
Status	enabled
Enabled Notify Options .... all
Notify Port	1
Notify Mail To	root@netman.company.com
Maximum Packet Fragments .. 20
Sessions:
Maximum	4000
Peak	2589
Active	400
.
.
.

Table 42: New parameters in output of the show firewall command

Parameter	Meaning

Sessions	Information about the firewall sessions.

Maximum	The maximum number of sessions that will be permitted
	though the firewall.

Peak	Peak usage: the maximum number of active sessions that
	have been opened at one time.

Active	The number of sessions currently in use.

show firewall policy

Syntax SHow FIREwall POLIcy[=policy-name] [COUnter]

[RUle=rule-id[-rule-id]][SUMmary]

where rule-idis a number or range from 1 to 4294967295

Description This new command displays detailed information about the specified policy or all policies. The new rule parameter allows you to display only a specific rule, or subset of rules, for each policy.

Software Version 2.8.1 C613-10477-00 REV B

Image 163

Allied Telesis AT-8700XL, RAPIER I, X900-48FE, AT-8900, AT-9900, AT-8600, AT-9800, AT-8800 manual Show firewall policy

Contents

Release Note Software Version Release Note Software Version Introduction IntroductionProduct series Models Upgrading to Software Version Backwards Compatibility Issue when UpgradingProduct name Release file GUI resource file CLI help file Overview of New Features Overview of New FeaturesQuickly AT-8600 AT-9800 AT-8900 X900-48FE AT-9900 Software Version AR400 AR7x5 AR750S Rapier AT-8800 Snmp MIBs Restart Log AR400 AR7x5 AR750S Rapier AT-8800 Extended Monitoring of CPU Utilisation Command ChangesSystem Enhancements Clearing System Parameters Activate cpu extended Disable cpu extendedEnable cpu extended Reset cpu utilisation Activate cpu extended Command Reference UpdatesDisable cpu extended Enable cpu extended Set system name Reset cpu utilisationSet system contact Set system location Show cpu Example output from the show cpu extended command Parameter Meaning Parts of a Command Command Line Interface CLI EnhancementsMore flexibility in Separating Parameters and Values Command Show command history Additional Shortcuts when EditingCreate config Command Line Interface CLI Enhancements Create configParameter Description Set command assignmentoperator Example output from the show command history command Show command history Add file File System Enhancement File System Enhancement Create file Software Version Parameter Description Reset file permanentredirectFile size Default 204 800 bytes Show file permanentredirect File System Enhancement Release Note Example output from the show file permanentredirect command Ordering Hardware Filters in 48-Port Switches Switching Enhancements Show switch hwfilter New mode parameter in output Switching EnhancementsCommandChange Set switch hwfilter mode New command Limiting Rapid MAC Movement PortDisable Set switch thrashlimit Create switch trunkEnable switch port vlan Set switch port Set switch hwrouteupdate Route Update Queue LengthNew command Securing a Single Vlan through Switch Filters Removing a Description from a Switch PortChanged description parameter Configuring vlansecure New DEV option in output Change of Debug Command SyntaxEthernet Protection Switching Ring Epsr Show switch debug Create switch trunk Debugging occurs on operations related to the switch chip Disable switch debugDisable switch filter vlansecure Disable switch port vlan Enable switch filter vlansecure Enable switch debugEnable switch port vlan Set lacp Set switch hwrouteupdate Set switch hwfilter mode Set switch port Set switch trunk Set switch thrashlimit Show lacp Example output from the show lacp commandAddress learn thrash action ..... Learn Disable Address learn thrash timeout ... second Show switch Switching Enhancements Whether the debugging option for the router or switch is Show switch debugARL, DMA, DEV, PHY, or None VlanSecure Show switch filterShow switch hwfilter New parameter in output of the show switch filter command Mode Show switch portNew parameters in output of the show switch port command Meaning Thrashaction is set to none Add ppp acservice PPPoE Access Concentrator Set ppp acservice Delete ppp acservicePPPoE Access Concentrator Interface New parameter in output of the show ppp pppoe commandShow ppp pppoe Eth0 Enable mstp port Disable mstp portEnable mstp port Disable mstp port New Port field in output STP EnhancementShow stp port Show stp port Show asyn Asynchronous Port EnhancementMaking Asynchronous Ports Respond More Quickly Set asyn Show asyn Set asyn Which characters are bundled Ten timer value 100Ten timer value Asynchronous Port Enhancement Release Note Internet Group Management Protocol Igmp Enhancements Igmp Proxy on x900 Series Switches Downstream interface GroupDownstream interfaces have members Multicast group Set ip igmp interface Igmp filtering extended to all Igmp message typesAdd ip interface Set ip interface Show igmp filter Internet Group Management Protocol Igmp EnhancementsAdd igmp filter Set igmp filter Monitoring reception of Igmp general query messages MSGType=QUEryREPortLEAVe Add igmp filter Set igmp filter Add ip interface Set ip igmp interface Set ip interface Attached to Show igmp filterLeaves Is attached to Recd Passed An Snmp trap are generated Upstream General Query Reception Timeout .... NoneNew parameters in the output of the show ip igmp command Show ip igmp IP Route Preference Options Expanded IP TroubleshootingInternet Protocol IP Enhancements Expanded number of Eth interfaces per physical interface Assigning the Filter Type IPv4 Filter Expansion Waiting for a Response to an ARP Request Enhancements to Display of UDP Connections over IPv4 Show ip Set ip arpwaittimeoutNew Arp wait timeout field Adding Static ARP Entries with Multicast MAC Addresses Enable ip macdisparity Disable ip macdisparityNew IP/MAC address disparity parameter Syntax Traffic filter Add ip filter Disable ip macdisparity Reset ip counter Enable ip macdisparitySet ip arpwaittimeout Set ip route preference Set ip filter Show ip Arp wait timeout SecsModified parameters on output of the show ip command With multicast MAC addresses. One of Enabled or Internet Protocol IP Enhancements Release Note Show ip cache Show ip counter When the entry is usedCount Number of times the entry was found Show ip udp Show ip filter Generation/reception of logs using the Net Manage protocol UDP on the router or switchTime synchronisation using the Network Time Protocol Generation/reception of logs using the Secure Router Log IPv6 Tunnel Expansion Show ipv6 udp New commandIPv6 Enhancements Display of UDP Connections over IPv6 Show ipv6 udp L2TP Enhancements L2TP Enhancements Handling PPP Link Negotiation Failures Resetting General L2TP CountersProxyauth=offon Add l2tp ip Disable l2tp debug Enable l2tp debug Reset l2tp counter Decode Proxy AuthenticationShow l2tp ip Show l2tp tunnel Syntax SHow L2TP TUNnel CALL=1..65535 Show l2tp tunnel call Add ospf interface Ospf Interface PasswordOpen Shortest Path First Enhancements Nssa Translator Role Set ospf area Add ospf areaShow ospf area Interaction with global Ospf parameters Redistributing External Routes Ospf backward compatibility Delete ospf redistribute Disable ospf debugEnable ospf debug Add ospf redistribute NSSAStability=1..3600 NSSATranslator=CANdidateALWays Add ospf area Add ospf redistribute Add ospf interface Enable ospf debug Disable ospf debugDelete ospf redistribute BGPImport=ONOFFTrueFalseYESNO Set ospf Set ospf interface Set ospf area Set ospf redistribute Role Show ospf areaStability Interval State Software Version 101 Show ospf redistribute BGP Enhancements BGP EnhancementsBGP Backoff Lower Threshold Upper and Lower Thresholds BGP Peer and Peer Template Enhancements Enable and Disable Backoff Displaying the Number of Routes from a Peer Displaying Routes Learned from a Specific BGP PeerDisplaying Information about Routes from a Peer Software Version 105 Add bgp peer Add bgp peertemplate Disable bgp backoff BACkoff Enable bgp backoffSet bgp backoff Software Version 107 Set bgp peer Software Version 109 Set bgp peertemplate Mem Lower Threshold Value 90% Mem Lower Notify Show bgp backoffBGP Enhancements Release Note Mem Upper Threshold Value 95% Mem Upper Notify Show bgp route Show bgp peerRoutes learned MLD and MLD Snooping Enhancements MLD and MLD Snooping EnhancementsMLD Packet Formats Icmp type for MLDv2 Reports Show mldsnooping More consistent output MLD Snooping Group Membership DisplayChange of Maximum Query Response Interval for Software Version 113 Set ipv6 mld Enable ipv6 mld interface V2 Draft Compatible Show ipv6 mldShow mldsnooping Software Version 115 MLD and MLD Snooping EnhancementsRelease Note Previous example output from the show mldsnooping command Show classifier Extension to Range of Classifier fields for x900 SwitchesCreate classifier Set classifier Create classifier Extension to Range of Classifier fields for x900 Switches Software Version 119 Set classifier Software Version 121 Show classifier Igmp type 0x17 V2LEAVE TCP FlagsIcmp code Icmp type Protocol 1234567890 Layer 3 Byte Offset Value Mask Classifier Rules 2222 MAC Address Aa-bb-cc-dd-ee-ff TypeVlan1234 Format One of URG, ACK, RST, SYN, or FIN Igmp TypeParameter option in brackets if available TCP Flags Port Groups QoS EnhancementsSoftware Version 125 Storm protection Show qos trafficclass Set qos policyCreate qos trafficclass Set qos trafficclass Create qos policy Add qos portgroup port With the enable switch port command Default portdisable Storm protection is inactive Protection is enabledCreate qos portgroup Create qos trafficclass STORMRate Is matching STORMTimeoutWith the enable switch port command, or Enable switch port vlan command Specific port that consists POrt Port to delete from this port group Default no defaultDelete qos portgroup port Destroy qos portgroup Set qos policy Reset qos portgroup countersSoftware Version 133 Uses Kbps. If you specify Mbps or Gbps, the rate Set qos portgroup Software Version 135 Parameter Description Set qos trafficclass QoS Enhancements Release Note Parameter Description With the enable switch port or enable switchIs disabled by storm protection Show qos policy Storm Protection Status Rate 1kbps Window 100ms Timeout NoneShow qos port Ports Assigned to Port Groups Assigned to 213-24 QoS EnhancementsRelease Note Show qos portgroupPort Group Trunk Group None Integer from 1 to Parameters in output of the show qos portgroup commandShow qos portgroup counters Software Version 139 140 Number of bytes that conforms with band with class Show qos trafficclassStorm Protection Secure Copy SCP Configuring Secure CopyConfiguring the Server Configuring the Client Software Version 143 Configuring UsersUse the show ssh session command to see current sessions Managing Secure Copy Sessions Loading Files to the Switch Loading using Secure Copy Software Version 145 Uploading using Secure CopyUploading from the Switch Loading Files from a Remote Machine Show loader Uploading Files from a Remote MachineLoad Set loader Software Version 147 Disable ssh debugDisable ssh server Delete ssh session Enable ssh server Enable ssh debugWhether the SSH server supports SCP connections Software Version 149 Load Default tftp Copy is the default method for loading and uploadingSet loader Software Version 151 Set ssh client Alice Set ssh serverShow loader 192.168.1.1 Debug SSH Server Enabled SCP ServiceShow ssh Software Version 153 Show ssh counter Reset loader command Failure Show ssh sessionSoftware Version 155 Parameter Meaning WriteFileFailed Parameter Meaning Secure Shell Session Secure Copy SCP Release Note Software Version 157 UploadCharacters long Show ssl counters SSL Counter EnhancementShow ssl counters SSL Counter Enhancement Client Counters for the SSL client BadSessionIdLen Software Version 159BadSessionIdLen Session ID longer than 32 bytes Firewall Enhancements Firewall EnhancementsFirewall Licencing Disabling SIP ALG Call ID Translation Software Version 161 Set firewall sipalg New commandDisplaying SIP ALG Session Details Firewall Policy Rules Expansion Show firewall policy Reset firewall sipalg counterDisplaying a Subset of Policy Rules Set firewall sipalg Show firewall policy Show firewall CALLId Valid with the ip or summary commandsIp or callid commands Show firewall sipalg Active SIP Sessions Parameters in output of the show firewall sipalg commandService Within the private network protected by the firewall Seen on the public side of the firewall Router or switch. The router or switch only translates IPFirewall Enhancements Release Note Gbl IP Current SIP sessions Start up or reset Current sessions Audio sessions createdSince start up or reset Past sessions Show firewall sipalg counter Them Total number of SIP messages received that the SIP ALG Responding to IPsec Packets from an Unknown Tunnel Enhancements to IPsec/VPNSoftware Version 169 Modifying the Message Retransmission Delay Retrying Isakmp Phase 1 and 2 Negotiations New usePolIkeRetryGood and usePolIkeRetryFailed VPN Tunnel LicencingNew retryikeattempts parameter New retryIkeAttemptsPh1 and retryIkeAttemptsPh2 Software Version 173 Create ipsec policy Msgbackoff parameter Default incrementalMsgtimeout value Create isakmp policy Occurs between attempts After the first 16 attempts, a five minute delayRETRYIKEattempts Attempted over new Isakmp SAs Set ipsec policy Software Version 177 Set isakmp policy VPNs Maximum Current Peak Show ipsecParameter Meaning VPNs Respond Bad SPI Show ipsec policySoftware Version 179 Respond Bad SPI To true and packets processed by that policy have an Show ipsec policy counterInBadSpiResponse InBadSpiResponse Software Version 181 Show isakmp countersRetryIkeAttemptsPh1 RetryIkeAttemptsPh2 UsePolIkeRetryGood UsePolIkeRetryFailed Same None Show isakmp exchangeSoftware Version 183 Message Back-off Incremental Show isakmp policy Iskamp policy command Software Version 185 Show isakmp saMessage Back-off None Shdsl Line MIB Snmp MIBsSnmp MIBs Snmp request not processed due to excessive memory Logging Snmp operationUsage Snmp Trap not sent due to excessive memory usage Traps on Ospf state changes Traps on Mstp state and topology changes Trap on Vrrp topology changesSoftware Version 189 Restart Log Trap on Login FailuresVLAN-based port state changes New Buffer level 0 field Trap on Memory LevelsSoftware Version 191 Show buffer Parameter Meaning Buffer level n New parameters in output of the show buffer commandShow buffer Buffer level 1500 CDP over WAN Interfaces CDP over WAN Interfaces Disable lldp cdp interfaceDisable lldp cdp ppptemplate Enable lldp cdp debug Software Version 195 Enable lldp cdp interfaceEnable lldp cdp ppptemplate Enables debugging of PPP events Ppp0 Ppp1 PPP Templates Enabled PPP Templates DisabledShow lldp cdp Show lldp cdp interface Software Version 197 Permanent Assignments on AR400 Series RoutersPage Chapter Introduction to Ethernet Protection Switching Ring Epsr Epsr Instances and Domains Introduction to Ethernet Protection Switching Ring Epsr Master Node Ethernet Protection Switching Ring EpsrControl Vlan Data Vlan Master Node Polling Fault Detection Fault Detection and RecoveryTransit Node Unsolicited Fault Detection Fault Recovery Procedure Restoring Normal Operation Epsr Single Domain, Single Ring Network Configuring Epsr # For Transit Nodes 1, 2 Example script for a 4 node ring network Single Ring, Dual Domain Network # Node 1 Master node for RingA Transit Node for RingB Example script for a Single Ring, Two Domain Network Node Example script for a Single Ring, Two Domain Network Nodes 2 # Node 3 Transit node for RingA Master Node for RingB Epsr and Spanning Tree Operation # For Transit Node # For Transit Nodes 2 Command Reference Add epsr datavlan Add epsr datavlan Create epsr Ethernet Protection Switching Ring Epsr Create epsr Default 2s RIngflaptime Only configured for the master nodeSeconds 32767s. Only configured for the master node Default 1s FAilovertime Vlan-name cannot be a number or ALL Delete epsr datavlanHyphen character -. The epsr-name cannot be ALL Unique name for the VLAN. This can be from 1 to Destroy epsr Destroy epsr String, 1 to 15 characters long. Valid characters are Disable epsrEthernet Protection Switching Ring Epsr Disable epsr Epsr instance to be disabled Disable epsr debug Disable epsr debug Ethernet Protection Switching Ring Epsr Enable epsr Enable epsrEpsr instance to be enabled OUTput Enable epsr debugEnable epsr debug Epsr instance whose debugging is to be enabled Purge epsr Ethernet Protection Switching Ring Epsr Purge epsr Set epsr Set epsr VLANs within the ring domain Ethernet Protection Switching Ring Epsr Set epsr portSet epsr port Epsr to be set for the port Show epsr Show epsrEpsr instance whose details are displayed Ethernet Protection Switching Ring Epsr Show epsr Second Port Status Disabled. This parameter is only shown for a transit nodeSecond Port Shown for a transit node Epsr instances Ethernet Protection Switching Ring Epsr Show epsr counterShow epsr counter COUnter Related Commands show epsr Show epsr debug Show epsr debug