Manuals / Force10 Networks / Computer Equipment / Network Card

Force10 Networks 100-00055-01 manual Enabling the Firewall, Enabling and Disabling Drop Mode

Models: 100-00055-01

1 132

Download 132 pages 61.04 Kb

Page 76

Enabling the Firewall

Enabling the Firewall

Enable Drop mode using the command pnic default-drop-enable. Disable Drop mode using the command pnic default-drop-disable. These commands are shown in Figure 39.

Figure 39 Enabling and Disabling Drop Mode

[root@localhost ~]# pnic default-drop-disable

No device number specified. Assuming device 0

***Disabling Default-Packet-Drop on card:0 successful!

***Temporary memory enabled.

[root@localhost ~]# pnic default-drop-enable

No device number specified. Assuming device 0

***Enabling Default-Packet-Drop on card:0 successful.

***Temporary memory disabled.

[root@localhost SW]# pnic showconf

No device number specified. Assuming device 0

Drop mode Disabled

Drop mode Enabled

DMA Capture	: on
MAC Rewrite state	: CH0 - disabled; CH1 - disabled		Verify Drop mode is Enabled
Default Drop Packet	: enabled

Temporary memory	: disabled
Aggregate mode	: enabled
PHY passive mode	: disabled
####################### On MASTER FPGA #######################
Per Flow Packet Limit	: unlimited
Timeout for Flow Garbage Collection : 16
Truncation after Match Packet	: full packet
####################### On PCI FPGA #######################
DMA Burst Size	: 1024 (Bytes)
DMA Flush Timer	: 1 (ms)
Interrupt Frequency Timer	: 5 (ms)

Version : P2.3.0.2 [root@localhost SW]#

76

Firewall

Image 76

Force10 Networks 100-00055-01 manual Enabling the Firewall, Enabling and Disabling Drop Mode, Verify Drop mode is Enabled

Contents

Version P-Series Installation and Operation GuideMay 27 Copyright 2008 Force10 Networks TrademarksStatement of Conditions USA Federal Communications Commission FCC StatementContents ContentsInstallation PrefaceCommand Line Interface Graphical User InterfaceChapter Web-based ManagementCommand Line Reference Basic Unix CommandsCompiling Rules Writing RulesAppendix E GlossaryAppendix F Technical SupportPreface About this GuideObjectives AudienceInformation Symbols Related DocumentsAdditional Resources P-Series Release NotesInstallation ChapterPhysical Connections System SpecificationsPB-10GE-2P Step Task Booting ConfigurationSecurity Check Upgrading Softwaremkdir ~/upgradedirectory filename ~/upgradedirectorycd upgradedirectory scp username@serverabsolutepathCommand cd upgradedirectory/pnic-compilercd upgradedirectory/firmware gmake installReturning to the Default Configuration Getting StartedChapter To begin inspecting and filtering traffic you mustGetting Started Hardware Architecture Overview IntroductionChapter Types of Rules Sample Rules and FirmwareDeploying the P-Series Rule ManagementFirewall Deployment” on page Inline Deployment Fail-safe Deployment10-Gigabit Optical Bypass 10-GigabitHighly-available Deployment Passive DeploymentP1P0 10-GigabitCapturing Matched Traffic Network Switch with SPAN portNetwork Tap 10-Gigabit 10-Gigabit P-Series P10Capturing to a Host CPU Mirroring to Another Device PB-10GE-2PM1 P1 P0 M0 Traffic to MonitorChapter 4 Graphical User Interface GUI Commands Command DescriptionManaging Rules, Policies, and Firmware PNIC0 Not ActiveEditing Dynamic Rules with the GUI directory see “Editing Dynamic Rules with the GUI” on pageGUI” on page To manage firmware, see “Selecting Firmware with the GUI” on pageTo modify dynamic rules Managing Capture/Forward Policies with the GUITo change capture/forward policies fn9000013 Selecting Firmware with the GUIfn9000014 Runtime Statistics Figure 19 Runtime Statistics for Channel 0 and 1-FPGA Loaded Graphical User InterfaceReloading Firmware Graphical User Interface Launching the P-Series Node Manager Chapter 5 Web-based ManagementTo launch the P-Series Node Manager Figure 21 Lauching the P-Series Node Manager Web-based ManagementManaging the P-Series using Node Manager Web-browser Security CertificatesMonitoring System Performance on page Managing Firmware Images on pageMonitoring System Performance Managing Firmware Images Managing the Network Interface CardFigure 25 P-Series Node Manager Card Management Panel Web-based ManagementManaging Policies Figure 26 P-Series Node Manager Policy Managment Panel Web-based ManagementChapter 6 Network Security Monitoring P-Series SensorsSguil Server Sguil ClientInstalling the Sguil System Installing the Sguil SensorInstalling the Sguil Server Hardware and Software RequirementsUninstalling the Sguil Server Installing the Sguil ClientWireshark Installation Files # win32 example set TLSPATH c/progra~1/Tcl/lib/tls1.4.1/tls14.dllRunning the Sguil Sensor Running the Sguil SystemWriting New Rules Running the Sguil Server Running the Sguil Client To run the Sguil Clientfn90028mp fn90027mpChapter 7 Command Line Interface CLI CommandsCLI commands are given in Command Line Reference on page Editing Dynamic Rules with the CLIIn Figure To enable MAC rewritingRemoving VLAN Tags Command Line Interface Compiling Rules Creating Rules FilesRules Capacity Compiling RulesTarget Device Match non-IP Trafficpage 3 Match Fragmented IPv4 Packets or IPv4 Packets w/ OptionsSegmentation Evasion Rules see Figure 36 on pageMaximum String see Figure 37 on pageEnter command gmake from pnic-compiler directory P-Series Installation and Operation Guide, version Figure 36 pnic-Compiler OptionSummary of configuration Starting and Stopping the pnic-Compilerwhich the .bit files in /usr/local/pnic/0 are Configuration and Generated Filesto which the .mapping files in /usr/local/pnic Compiler Errors Firmware FilenamesWriting Rules Snort Rule SyntaxSnort Rule Headers ActionProtocol Source AddressesPorts Direction OperatorP-Series Rule Syntax P-Series Supported Snort KeywordsSnort Rule Options Destination Address and PortKeyword StaticDynamic protocolWriting Stateful Rules Stateful MatchingEquation ∧ si= si ⎬ then cpiStateful Rule Examples In TableHandling Segmentation Evasion Support for Snorts flow KeywordThe meta.rules File Support for Snorts within Keyword Anomalous TCP Flags Writing Rules Deploying the P-Series as a Firewall FirewallChapter Enabling the Firewall Drop mode Disabled Drop mode EnabledVerify Drop mode is Enabled Figure 39 Enabling and Disabling Drop ModeAllowing Traffic through the Firewall Writing Rules for a Firewall Deployment#permit let through and do not log to the host Appendix A Command Line Reference pnic aggregate-mode-disable on pagepnic aggregate-mode-enable on page pnic apply-firmware on page pnic default-drop-disable on page pnic default-drop-enable on pagepnic aggregate-mode-disable pnic temp-mem-disable on page pnic temp-mem-enable on pagepnic updatemacvalue on page pnic vlan-remove-disable on page pnic vlan-remove-enable on page pnic web-gui-start on pagepnic aggregate-mode-enable pnic apply-firmwareParameters Command History Example Commandspnic show-firmwares Display the available firmwarepnic capture-off pnic capture-onEnable the capturing of packets via direct memory access Syntax Parameters Command History Examplepnic cardstatus CommandsSyntax Parameters Command History Example Commandspnic default-drop-disable pnic compilerulespnic default-drop-enable Temporary memory is disabled while the firewall is enabledpnic diag Parameters Command History ExampleUsage Information Parameters Command History ExampleVersion PMAIN2.3.0.014 root@localhost SW# pnic flow-teardown-disable pnic flow-teardown-enablepnic flow-teardown-disable pnic flow-teardown-enablepnic getmachashindex value for an IP address pairspnic gui Enable MAC rewritingDisable MAC rewriting pnic updatemacvalueP-Series Installation and Operation Guide, version pnic gui Command ExampleExample pnic help Syntax Command History Examplepnic help output omittedpnic linkdown pnic linkupSyntax Parameters Command History Example Commandspnic loadconf Parameters Command History ExampleCommands Syntax Parameters Command HistoryAddress Corresponding Parameterpnic loadeproms pnic loadparams deprecatedpnic loadeproms number pnic loadparams numberAddress Corresponding ParameterCommand History Example Usage Information pnic loadrulesSyntax Parameters pnic macrewrite-off pnic macrewrite-onpnic off deprecated Syntax pnic offpnic on deprecated Usage Information Related CommandsSyntax Parameters Command History Example pnic on deprecatedpnic passive-mode-disable pnic paramspnic passive-mode-enable pnic passive-mode-enableCommand Commandspnic resetconf pnic restartSyntax Parameters Command History Example Stop capturing and matchingpnic sguil-sensor-start Disable the network interfaceEnable the network interface Syntax Command History ExampleStop the Sguil sensor using the command pnic sguil-sensor-stop Syntax Parameters Command History ExampleCommands pnic sguil-sensor-start -fpnic sguil-sensor-stop Syntax Parameters Command History ExampleCommands pnic sguil-sensor-start Start the Sguil sensorpnic showconf pnic show-firmwaresSyntax Parameters Command History Example Commandspnic showtech Command History ExampleCommands Syntax Parameters Command Historypnic start Load the capture/block configuration Load the runtime parametersEnable the network interface Disable the network interface using the command pnic stoppnic stop Enable the network interfaceCommands Syntax Parameters Command History Examplepnic temp-mem-disable pnic temp-mem-enablepnic updatemacvalue Use this command with the MAC rewrite featurepnic temp-mem-disable Enable MAC rewritingpnic vlan-remove-disable pnic vlan-remove-enablepnic vlan-remove-disable pnic vlan-remove-enablepnic version pnic web-gui-startDisable the web server using the command pnic web-gui-stop Display the driver versionEnable the web server using the command pnic web-gui-start pnic web-gui-stopCommands CommandCommands pnic web-gui-startExample RelatedAppendix A Appendix B Snort Keywordsack number dsize number numberKeyword uricontent ! “datastring” KeywordDescription Rule SyntaxAppendix B meta Rules Appendix C Meta and Evasion RulesEvasion Rules Appendix C Appendix D Basic Unix Commands Unix CommandsCommand Descriptionvi Commands CommandDescription ? textAppendix E GlossarySnort SPAN PortState Static RulesAccessing iSupport Services Appendix FTechnical Support Manual PagesLocating P-Series Serial Numbers Contacting the Technical Assistance CenterSerial Number see Locating P-Series Serial Numbers on page Requesting a Hardware Replacement To request replacement hardware, follow these stepsTechnical Support