Enabling the Firewall | Force10 Networks 100-00055-01 instruction

Enabling the Firewall

Enable Drop mode using the command pnic default-drop-enable. Disable Drop mode using the command pnic default-drop-disable. These commands are shown in Figure 39.

Figure 39 Enabling and Disabling Drop Mode

[root@localhost ~]# pnic default-drop-disable

No device number specified. Assuming device 0

***Disabling Default-Packet-Drop on card:0 successful!

***Temporary memory enabled.

[root@localhost ~]# pnic default-drop-enable

No device number specified. Assuming device 0

***Enabling Default-Packet-Drop on card:0 successful.

***Temporary memory disabled.

[root@localhost SW]# pnic showconf

No device number specified. Assuming device 0

Drop mode Disabled

Drop mode Enabled

DMA Capture	: on
MAC Rewrite state	: CH0 - disabled; CH1 - disabled		Verify Drop mode is Enabled
Default Drop Packet	: enabled

Temporary memory	: disabled
Aggregate mode	: enabled
PHY passive mode	: disabled
####################### On MASTER FPGA #######################
Per Flow Packet Limit	: unlimited
Timeout for Flow Garbage Collection : 16
Truncation after Match Packet	: full packet
####################### On PCI FPGA #######################
DMA Burst Size	: 1024 (Bytes)
DMA Flush Timer	: 1 (ms)
Interrupt Frequency Timer	: 5 (ms)

Version : P2.3.0.2 [root@localhost SW]#

76

Firewall

Image 76

Force10 Networks 100-00055-01 manual Enabling the Firewall

Contents

Series Installation and Operation Guide Copyright 2008 Force10 Networks Contents Contents Graphical User Interface Command Line Reference Glossary Objectives AudienceConventions Convention Description Keyword Information Symbols Symbol Warning DescriptionRelated Documents Additional Resources This LED is blue when the hard disk is accessed This LED is green when the power is onLabel Description This LED is not used Physical Connections System SpecificationsPB-10GE-2P Step Task Booting ConfigurationOnce the appliance is booted Security Check Gmake install Cp -Rf /usr/local/pnic/ /homeTar xvzf PTPS-PMAIN Cd SW Cd upgradedirectory/pnic-compiler Install pre-compiled firmware if neededRe-compile all rules firmware with the new compiler Located in the directory pnic-compiler Returning to the Default Configuration Chapter Getting Started Getting Started Chapter Introduction Hardware Architecture Overview Types of Rules Sample Rules and FirmwareRx1 Tx1 Mirror Introduction Rule Management Deploying the P-SeriesSample Rules Files Rule Set Description Inline Deployment Fail-safe Deployment Highly-available Deployment Passive Deployment Capturing Matched Traffic Series supports capturing matched traffic for analysis Capturing to a Host CPU Capturing Matched Traffic via the libpcap Interface Mirroring to Another Device Creating an IDS Accelerator with the P-Series Invoke the GUI by entering the command pnic gui Graphical User Interface GUI Commands GUI CommandsCommand Description Managing Rules, Policies, and Firmware Rule Management GUI Editing Dynamic Rules with the GUI Option DescriptionPolicy Capture Permit Deny Managing Capture/Forward Policies with the GUI To modify dynamic rules Selecting Firmware with the GUI Managing Capture/Forward Policies GUI To select firmware Runtime StatisticsSelect Manage Firmware see Figure Runtime Statistics for Channel 0 and 1-FPGA Loaded Runtime Statistics Description Reloading FirmwareStatistic Description Graphical User Interface Web-based Management Launching the P-Series Node Manager Lauching the P-Series Node Manager Web-based Management Web-browser Security Certificates Managing the P-Series using Node ManagerSeries Node Manager has four major management capabilities Monitoring System Performance Series Node Manager Home Panel Web-based Management Managing Firmware Images Managing the Network Interface CardPage Managing Policies Page Network Security Monitoring Installing the Sguil Sensor Installing the Sguil SystemInstalling the Sguil Server Installing the Sguil Client To uninstall the serverSource the server configuration file. The default Wish Installation Files Sguil Files and DirectoriesFile Location Sensor Server Running the Sguil System Running the Sguil Sensor Running the Sguil Server Task Script Running the Sguil Client To run the Sguil Client Selecting the Sensor to Monitor CLI Commands Editing Dynamic Rules with the CLIMAC Rewriting Change directories to /usr/local/pnic/0 Command Line Interface Rewriting Destination MAC Addresses to Load Balance Removing Vlan Tags Command Line Interface Creating Rules Files Rules CapacityCompiling Rules To complile rules Compilation Option Description Content matching Positives Enter command gmake from pnic-compilerdirectory Pnic-Compiler Option Summary of configuration Starting and Stopping the pnic-Compiler Configuration and Generated Files Configuration and Generated FilesFile Description Location Compiler Errors Firmware FilenamesDescribes each of the elements in this format Firmware Filename Description Snort Rule Headers Snort Rule SyntaxSnort Rule Syntax Protocol Ports Series Rule Syntax Series Supported Snort KeywordsSnort Rule Options Keyword Static Dynamic Yes Only /8/16/24/32 masks Seq YesYes Yes, no ranges Writing Stateful Rules Stateful Matching Pre-match Condition the S Value Stateful Rule Examples Support for Snorts flow Keyword Handling Segmentation Evasion Support for Snorts within Keyword Anomalous TCP Flags Writing Rules Chapter Firewall Deploying the P-Series as a Firewall Enabling the Firewall Firewall Allowing Traffic through the Firewall Writing Rules for a Firewall Deployment Sample Firewall Rules Appendix a Command Line Reference Pnic aggregate-mode-disable number Pnic aggregate-mode-disableAppendix a Pnic aggregate-mode-enable Pnic aggregate-mode-enable numberDifferent ports. This is the default behavior Pnic apply-firmware Pnic apply-firmware Command Example Display the available firmware Pnic capture-off Pnic capture-onPnic capture-off Syntax pnic capture-on Display the configuration parameters of the system Pnic cardstatusPnic cardstatus number Display the driver version Pnic default-drop-disable Pnic default-drop-disable numberPnic compilerules Pnic compilerules number Pnic default-drop-enable Enable firewall functionalityRun diagnostic tests on the card Pnic diag Pnic diag Command Example Example pnic diag Command Example Pnic flow-teardown-disable Pnic flow-teardown-enablePnic flow-teardown-disable Pnic flow-teardown-enable Pnic getmachashindex Example pnic flow-teardown-enable Command ExamplePnic getmachashindex number Launch the graphical user interface Pnic guiSyntax pnic gui Pnic gui Command Example Pnic help Pnic help Pnic linkdown Pnic linkup Pnic loadconf Pnic loadconf number Pnic loadconf Address Mapping Address Corresponding Parameter Pnic loadeproms Pnic loadparams deprecatedLoad the PCI-X and front-end EEPROMs Pnic loadeproms number Pnic loadparams Command Example Loadparams Address Mapping Pnic loadrules Pnic loadrules channel Disable MAC rewriting. This is the default behavior Enable MAC rewriting using the command pnic macrewrite-onDisable MAC rewriting using the command pnic macrewrite-off Pnic macrewrite-off Syntax pnic off Pnic off deprecated100 Appendix a Example pnic off Command Example Enable the capturing of packets via direct memory accessPnic on deprecated Pnic on Pnic passive-mode-disable Syntax pnic passive-mode-disable numberPnic params Pnic params number Pnic passive-mode-enable Configure the ports to only receive trafficExample pnic passive-mode-disable Command Example Configure the ports to only receive traffic Pnic resetconf Pnic resetconf numberPnic restart Stop capturing and matching Series Installation and Operation Guide, version 105 Pnic sguil-sensor-startStart the Sguil sensor Pnic restart Pnic sguil-sensor-start -f Series Installation and Operation Guide, version 107 Pnic sguil-sensor-stopStop the Sguil sensor Pnic sguil-sensor-stop -f Display configuration parameters of the card Pnic showconfPnic show-firmwares List the available firmware images Series Installation and Operation Guide, version 109 Pnic showtechApply a specific firmware to the card Pnic showtech number filename.dat Disable the network interface using the command pnic stop Example pnic showtech Command ExamplePnic start Pnic start number Turn off capture and disable the network interface Enable the network interface using the command pnic startDisable the network interface Pnic stop Pnic temp-mem-disable Pnic temp-mem-enableDisable temporary memory Enable temporary memory. This is the default behavior Pnic updatemacvalue Disable temporary memoryPnic updatemacvalue number Specifies an LSB value for a particular hash index Pnic vlan-remove-disable Pnic vlan-remove-enableDisable the Vlan Tag Remove feature Vlan Tag Remove feature is disabled by default Disable the web server using the command pnic web-gui-stop Pnic versionPnic web-gui-start Display the driver version Pnic web-gui-stop Stop the web serverStop the web server Pnic web-gui-stop -f Series Installation and Operation Guide, version 117 Start the web server 118 Appendix a Description of P-Series Snort Keywords Keyword Description Rule SyntaxAck Checks for a specific TCP acknowledgment number Flags!*+ FSRPAU120 Flow establishedstateless Icmp idnumberIcmp seq number Ipproto ! name number Uricontent ! datastring Ttl This keyword checks for the specified IP time-to-live 122 Appendix B Meta Rules Meta Rules for Channel 0 and ChannelEvasion Rules 124 Appendix C Unix Commands LogoutPasswd Pwd Vi Commands ? textSet number no Number Dynamic Rules FlowGarbage Collection Snort Span PortState Static Rules Accessing iSupport Services Series Installation and Operation Guide, version 129Manual Pages ISupport Website Contacting the Technical Assistance Center Locating P-Series Serial Numbers Requesting a Hardware Replacement To request replacement hardware, follow these steps 132 Technical Support