M.2. Objects

M.2. Objects
	Appendix M. Configuration Objects

M.2.1. system: System settings

The system settings are the top level attributes of the system which apply globally.

Table M.3. system: Attributes

Attribute	Type	Default	Description
acme-directory	string	https://acme-v02.api.letsencrypt.org/directory	ACME server directory
acme-hostname	List of string	-	Public hostname(s) for FireBrick for HTTPS
acme-keygen	boolean	true	Automatically obtain private keys as needed
acme-profile	NMTOKEN	-	Profile for when to do ACME renewals
acme-renew	positiveInteger	30	Renewal before expiry (days)
acme-terms-agreed-email	string	-	Put your email if you agree CA terms
busy-threshold	unsignedInt	200	Max non-idle time before damping eth rx (millisec)
comment	string	-	Comment
contact	string	-	Contact name
cpu-int-reserved	(unsignedByte 0-100) percentage	95	Min percentage of CPU earmarked for int processing
email	string	-	Contact email
eth-rx-qsize	unsignedInt	256	Size of eth driver Rx queue
eth-tx-qsize	unsignedInt	512	Size of eth driver Tx queue
home-status	boolean	true	Port status on home page
intro	string	-	Home page text
location	string	-	Location description
log	NMTOKEN	Web/console	Log system events
log-acme	NMTOKEN	-	Log ACME
log-acme-debug	NMTOKEN	-	Log ACME debug
log-acme-error	NMTOKEN	-	Log ACME errors
log-config	NMTOKEN	Web/Flash/console	Log config load
log-debug	NMTOKEN	Not logging	Log system debug messages
log-error	NMTOKEN	Web/Flash/console	Log system errors
log-eth	NMTOKEN	Web/console	Log Ethernet messages
log-eth-debug	NMTOKEN	Not logging	Log Ethernet debug
log-eth-error	NMTOKEN	Web/Flash/console	Log Ethernet errors
log-hal	NMTOKEN	Not logging	Log HAL
log-ppp-dump	ppp-dump	-	PPP dump format
log-route-nexthop	NMTOKEN	Not logged	Log next hop changes
log-stats	NMTOKEN	Not logging	Log one second stats
log-support	NMTOKEN	Web logs	Log support messages (e.g. stack trace)
log-tcp-debug	NMTOKEN	Not logging	Log TCP/TLS debug messages
mirror-led-brightness	(unsignedByte 0-100) percentage	100	Brightness of mirror side LEDs
name	string	-	System hostname
port-led-brightness	(unsignedByte 0-100) percentage	100	Brightness of port side LEDs
port-status	boolean	true	Live port LEDs on status
pre-reboot-url	string	-	URL to GET prior to s/w reboot (typically to warn nagios)
soft-watchdog	boolean	false	Debug - use only if advised; do not use on an unattended FireBrick
source	string	-	Source of data, used in automated config management
status-led-colour	Colour	green	Default status LED colour
sw-update	autoloadtype	factory	Load new software automatically
sw-update-profile	NMTOKEN	-	Profile name for when to load new s/w
table	(unsignedByte 0-99) routetable	0	Routing table number for system functions (s/w updates, etc)

Table M.4. system: Elements

Element	Type	Instances	Description
link	link	Optional, unlimited	Home page links

M.2.2. link: Web links

Links to other web pages

Table M.5. link: Attributes

Attribute	Type	Default	Description
comment	string	-	Comment
name	string	-	Link name
profile	NMTOKEN	-	Profile name
source	string	-	Source of data, used in automated config management
text	string	-	Link text
url	string	-	Link address

M.2.3. user: Admin users

User names, passwords and abilities for admin users

Table M.6. user: Attributes

Attribute	Type	Default	Description
allow	List of IPNameRange	-	Restrict logins to be from specific IP addresses
comment	string	-	Comment
config	config-access	full	Config access level
full-name	string	-	Full name
level	user-level	ADMIN	Login level
name	(NMTOKEN) username	Not optional	User name
otp-seed	OTP	-	OTP seed (do not edit by hand)
password	Password	Not optional	User password
profile	NMTOKEN	-	Profile name
source	string	-	Source of data, used in automated config management
table	(unsignedByte 0-99) routetable	0	Restrict login to specific routing table
timeout	duration	5:00	Login idle timeout (zero to stay logged in, not recommended)

M.2.4. eap: User access controlled by EAP

Identities, passwords and access methods for access controlled with EAP

Table M.7. eap: Attributes

Attribute	Type	Default	Description
comment	string	-	Comment
full-name	string	-	Full name
methods	Set of eap-method	Not optional	Allowed methods
name	string	Not optional	User or account name
password	Secret	Not optional	User password
profile	NMTOKEN	-	Profile name
source	string	-	Source of data, used in automated config management
subsystem	eap-subsystem	Not optional	Access controlled subsystem

M.2.5. log: Log target controls

Named logging target

Table M.8. log: Attributes

Attribute	Type	Default	Description
colour	Colour	-	Colour used in web display
comment	string	-	Comment
console	boolean	-	Log immediately to console
flash	boolean	-	Log immediately to slow flash memory (use with care)
jtag	boolean	-	Log immediately jtag (development use only)
name	NMTOKEN	Not optional	Log target name
profile	NMTOKEN	-	Profile name
source	string	-	Source of data, used in automated config management
system	boolean	-	Include system logs on web/cli view

Table M.9. log: Elements

Element	Type	Instances	Description
email	log-email	Optional, unlimited	Email settings
syslog	log-syslog	Optional, unlimited	Syslog settings

M.2.6. log-syslog: Syslog logger settings

Logging to a syslog server

Table M.10. log-syslog: Attributes

Attribute	Type	Default	Description
comment	string	-	Comment
facility	syslog-facility	LOCAL0	Facility setting
port	unsignedShort	514	Server port
profile	NMTOKEN	-	Profile name
server	IPNameAddr	Not optional	Syslog server
severity	syslog-severity	NOTICE	Severity setting
source	string	-	Source of data, used in automated config management
source-ip	IPAddr	-	Use specific source IP
system-logs	boolean	-	Include generic system log messages as well
table	(unsignedByte 0-99) routetable	0	Routing table number for sending syslogs

M.2.7. log-email: Email logger settings

Logging to email

Table M.11. log-email: Attributes

Attribute	Type	Default	Description
comment	string	-	Comment
delay	duration	1:00	Delay before sending, since first event to send
from	string	One made up using serial number	Source email address
hold-off	duration	1:00:00	Delay before sending, since last email
log	NMTOKEN	Not logging	Log emailing process
log-debug	NMTOKEN	Not logging	Log emailing debug
log-error	NMTOKEN	Not logging	Log emailing errors
port	unsignedShort	25	Server port
profile	NMTOKEN	-	Profile name
retry	duration	10:00	Delay before sending, since failed send
server	IPNameAddr	-	Smart host to use rather than MX
source	string	-	Source of data, used in automated config management
subject	string	From first line being logged	Subject
table	(unsignedByte 0-99) routetable	0	Routing table number for sending email
to	string	Not optional	Target email address

M.2.8. services: System services

System services are various generic services that the system provides, and allows access controls and settings for these to be specified. The service is only active if the corresponding element is included in services, otherwise it is disabled.

Table M.12. services: Elements

Element	Type	Instances	Description
dns	dns-service	Optional	DNS service settings
http	http-service	Optional	Web server settings
radius	radius-service	Optional	RADIUS server/proxy settings
snmp	snmp-service	Optional	SNMP server settings
telnet	telnet-service	Optional	Telnet server settings
time	time-service	Optional	System time server settings

M.2.9. http-service: Web service settings

Web management pages

Table M.13. http-service: Attributes

Attribute	Type	Default	Description
access-control-allow-origin	string	-	Additional HTTP header
allow	List of IPNameRange	Allow from anywhere	List of IP ranges from which service can be accessed
allow-acme	boolean	true	Allow limited port 80 HTTP access for ACME during renewal
certlist	List of NMTOKEN	use any suitable	Certificate(s) to be used for HTTPS sessions
comment	string	-	Comment
content-security-policy	string	-	Additional HTTP header
css-url	string	-	Additional CSS for web control pages
https-port	unsignedShort	443	Service port for HTTPS access
js-url	string	-	Additional javascript for web control pages (logged in/trusted-ip)
local-only	boolean	true	Restrict access to locally connected Ethernet subnets only
log	NMTOKEN	Not logging	Log events
log-client	NMTOKEN	Not logging	Log client accesses
log-client-debug	NMTOKEN	Not logging	Log client accesses (debug)
log-debug	NMTOKEN	Not logging	Log debug
log-error	NMTOKEN	Log as event	Log errors
mode	http-mode	redirect-to-https-if-acme	Security mode
port	unsignedShort	80	Service port for HTTP access
profile	NMTOKEN	-	Profile name
referrer-policy	string	no-referrer	Additional HTTP header
self-sign	boolean	true	Create self signed certificate for HTTPS when necessary
source	string	-	Source of data, used in automated config management
table	(unsignedByte 0-99) routetable	All	Routing table number for access to service
trusted	List of IPNameRange	-	List of allowed IP ranges from which additional access to certain functions is available
x-content-type-options	string	nosniff	Additional HTTP header
x-frame-options	string	SAMEORIGIN	Additional HTTP header
x-xss-protection	string	1; mode=block	Additional HTTP header

M.2.10. dns-service: DNS service settings

DNS forwarding resolver service

Table M.14. dns-service: Attributes

Attribute	Type	Default	Description
allow	List of IPNameRange	Allow from anywhere	List of IP ranges from which service can be accessed
auto-dhcp	boolean	-	Forward and reverse DNS for names in DHCP using this domain
caching	boolean	true	Cache relayed DNS entries locally
comment	string	-	Comment
domain	string	-	Our domain
fallback	boolean	true	For incoming requests, if no server in required table, relay to any DNS available
fallback-table	(unsignedByte 0-99) routetable	Don't fallback	For incoming requests, if no server in requesting table, relay to any DNS available in this table
local-only	boolean	true	Restrict access to locally connected Ethernet subnets only
log	NMTOKEN	Not logging	Log events
log-debug	NMTOKEN	Not logging	Log debug
log-error	NMTOKEN	Log as event	Log errors
log-interface	List of NMTOKEN	All interfaces	Only do normal log for specific interface(s)
profile	NMTOKEN	-	Profile name
resolvers	List of IPAddr	-	Recursive DNS resolvers to use
resolvers-table	(unsignedByte 0-99) routetable	as table / 0	Routing table for specified resolvers
source	string	-	Source of data, used in automated config management
table	(unsignedByte 0-99) routetable	All	Routing table number for access to service

Table M.15. dns-service: Elements

Element	Type	Instances	Description
block	dns-block	Optional, unlimited	Fixed local DNS host blocks
host	dns-host	Optional, unlimited	Fixed local DNS host entries

M.2.11. dns-host: Fixed local DNS host settings

DNS forwarding resolver service

Table M.16. dns-host: Attributes

Attribute	Type	Default	Description
comment	string	-	Comment
ip	List of IPAddr	Our IP	IP addresses to serve (or our IP if omitted)
name	List of string	Not optional	Host names (can use * as a part of a domain)
profile	NMTOKEN	-	Profile name
restrict-interface	List of NMTOKEN	-	Only apply on certain interface(s)
restrict-to	List of IPNameRange	-	List of IP ranges to which this is served
reverse	boolean	-	Map reverse DNS as well
source	string	-	Source of data, used in automated config management
table	(unsignedByte 0-99) routetable	any	Routing table applicable
ttl	unsignedInt	60	Time to live

M.2.12. dns-block: Fixed local DNS blocks

DNS forwarding resolver service

Table M.17. dns-block: Attributes

Attribute	Type	Default	Description
comment	string	-	Comment
name	List of string	Not optional	Host names (can use * as a part of a domain)
profile	NMTOKEN	-	Profile name
restrict-interface	List of NMTOKEN	-	Only apply on certain interface(s)
restrict-to	List of IPNameRange	-	List of IP ranges to which this is served
source	string	-	Source of data, used in automated config management
table	(unsignedByte 0-99) routetable	any	Routing table applicable
ttl	unsignedInt	60	Time to live

M.2.13. radius-service: RADIUS service definition

RADIUS server and proxy definitions

Table M.18. radius-service: Attributes

Attribute	Type	Default	Description
acct-port	unsignedShort	1813	Accounting UDP port
auth-port	unsignedShort	1812	Authentication UDP port
authenticator	boolean	-	Require message authenticator
backup-ip	List of IPNameAddr	-	Target IP(s) or hostname for backup L2TP connection
class	string	-	Class field to send
comment	string	-	Comment
control-port	unsignedShort	3799	Control UDP port (CoA/DM)
dummy-ip	boolean	true	Send dummy framed IP response
erx-tunnel-switch-profile	string	-	Juniper attribute 91
erx-tunnel-virtual-router	string	-	Juniper attribute 8
erx-virtual-router-name	string	-	Juniper attribute 1 (Also SIN502 Context-Name)
log	NMTOKEN	Not logging	Log events
log-debug	NMTOKEN	-	Log debug
log-error	NMTOKEN	Log as event	Log errors
nsn-conditional	boolean	-	Only send NSN settings if username is not same as calling station id
nsn-tunnel-override-username	unsignedByte	-	Additional response for GGSN usage
nsn-tunnel-user-auth-method	unsignedInt	-	Additional response for GGSN usage
order	radiuspriority	-	Priority tagging of endpoints sent
profile	NMTOKEN	-	Profile name
relay-ip	List of IPAddr	-	Address to copy RADIUS request
relay-port	unsignedShort	1812	Authentication UDP port for copy RADIUS request
relay-table	(unsignedByte 0-99) routetable	-	Routing table number for copy of RADIUS request
secret	Secret	-	Shared secret for RADIUS requests (needed for replies)
source	string	-	Source of data, used in automated config management
tagged	boolean	-	Tag all attributes that can be
target-hostname	string	-	Hostname for L2TP connection
target-ip	List of IPNameAddr	-	Target IP(s) or hostname for primary L2TP connection
target-secret	Secret	-	Shared secret for L2TP connection
tunnel-assignment-id	string	-	Tunnel Assignment ID to send
tunnel-client-return	boolean	-	Return tunnel client as radius IP

Table M.19. radius-service: Elements

Element	Type	Instances	Description
match	radius-service-match	Optional, unlimited	Matching rules for specific responses
server	radius-server	Optional, unlimited	RADIUS server settings

M.2.14. radius-service-match: Matching rules for RADIUS service

Rules for matching incoming RADIUS requests

Table M.20. radius-service-match: Attributes

Attribute	Type	Default	Description
allow	List of IPNameRange	-	Match source IP address of RADIUS request
authenticator	boolean	-	Require message authenticator
backup-ip	List of IPNameAddr	-	Target IP(s) or hostname for backup L2TP connection
called-station-id	List of string	-	One or more patterns to match called-station-id
calling-station-id	List of string	-	One or more patterns to match calling-station-id
class	string	-	Class field to send
comment	string	-	Comment
dummy-ip	boolean	true	Send dummy framed IP response
erx-tunnel-switch-profile	string	-	Juniper attribute 91
erx-tunnel-virtual-router	string	-	Juniper attribute 8
erx-virtual-router-name	string	-	Juniper attribute 1 (Also SIN502 Context-Name)
ip	List of IPNameRange	-	Match target IP address of RADIUS request
name	string	-	Name
nas-ip	List of IPNameRange	-	Match NAS-IP address in RADIUS request
nsn-conditional	boolean	-	Only send NSN settings if username is not same as calling station id
nsn-tunnel-override-username	unsignedByte	-	Additional response for GGSN usage
nsn-tunnel-user-auth-method	unsignedInt	-	Additional response for GGSN usage
order	radiuspriority	-	Priority tagging of endpoints sent
profile	NMTOKEN	-	Profile name
relay-ip	List of IPAddr	-	Address to copy RADIUS request
relay-port	unsignedShort	1812	Authentication UDP port for copy RADIUS request
relay-table	(unsignedByte 0-99) routetable	-	Routing table number for copy of RADIUS request
secret	Secret	-	Shared secret for RADIUS requests (needed for replies)
source	string	-	Source of data, used in automated config management
stop	boolean	true	Stop checking if this matches
tagged	boolean	-	Tag all attributes that can be
target-hostname	string	-	Hostname for L2TP connection
target-ip	List of IPNameAddr	-	Target IP(s) or hostname for primary L2TP connection
target-secret	Secret	-	Shared secret for L2TP connection
tunnel-assignment-id	string	-	Tunnel Assignment ID to send
tunnel-client-return	boolean	-	Return tunnel client as radius IP
username	List of string	-	One or more patterns to match username

M.2.15. radius-server: RADIUS server settings

Server settings for outgoing RADIUS

Table M.21. radius-server: Attributes

Attribute	Type	Default	Description
comment	string	-	Comment
host	List of IPNameAddr	Not optional	One or more hostname/IPs of RADIUS servers
max-timeout	duration	10	Maximum final timeout
min-timeout	duration	2	Minimum final timeout
name	string	-	Name
port	unsignedShort	From services/radius settings	UDP port
profile	NMTOKEN	-	Profile name
queue	unsignedInt	-	Concurrent requests over all of these servers (per type)
scale-timeout	unsignedByte	2	Timeout scaling factor
secret	Secret	Not optional	Shared secret for RADIUS requests
source	string	-	Source of data, used in automated config management
source-ip	IPAddr	-	Fix source IP
table	(unsignedByte 0-99) routetable	-	Routing table number
type	Set of radiustype	All	Server type

M.2.16. telnet-service: Telnet service settings

Telnet control interface

Table M.22. telnet-service: Attributes

Attribute	Type	Default	Description
allow	List of IPNameRange	Allow from anywhere	List of IP ranges from which service can be accessed
comment	string	-	Comment
local-only	boolean	true	Restrict access to locally connected Ethernet subnets only
log	NMTOKEN	Not logging	Log events
log-debug	NMTOKEN	Not logging	Log debug
log-error	NMTOKEN	Log as event	Log errors
port	unsignedShort	23	Service port
profile	NMTOKEN	-	Profile name
prompt	string	system name	Prompt
source	string	-	Source of data, used in automated config management
table	(unsignedByte 0-99) routetable	All	Routing table number for access to service

M.2.17. snmp-service: SNMP service settings

The SNMP service has general service settings and also specific attributes for SNMP such as community

Table M.23. snmp-service: Attributes

Attribute	Type	Default	Description
allow	List of IPNameRange	Allow from anywhere	List of IP ranges from which service can be accessed
comment	string	-	Comment
community	string	public	Community string
local-only	boolean	false	Restrict access to locally connected Ethernet subnets only
log	NMTOKEN	Not logging	Log events
log-debug	NMTOKEN	Not logging	Log debug
log-error	NMTOKEN	Log as event	Log errors
port	unsignedShort	161	Service port
profile	NMTOKEN	-	Profile name
source	string	-	Source of data, used in automated config management
table	(unsignedByte 0-99) routetable	All	Routing table number for access to service

M.2.18. time-service: System time server settings

The time settings define which NTP servers to synchronize the system clock from, and provide controls for daylight saving (summer time). The defaults are those that apply to the EU

Table M.24. time-service: Attributes

Attribute	Type	Default	Description
allow	List of IPNameRange	Allow from anywhere	List of IP ranges from which service can be accessed
comment	string	-	Comment
legacy-timeserver	boolean	true	Serve legacy TIME service on UDP port 37
local-only	boolean	true	Restrict access to locally connected Ethernet subnets only
log	NMTOKEN	Not logging	Log events
log-debug	NMTOKEN	Not logging	Log debug
log-error	NMTOKEN	Log as event	Log errors
maxpoll	duration	1024	NTP maximum poll rate
minpoll	duration	64	NTP minimum poll rate
ntp-control-allow	List of IPNameRange	Allow from anywhere	List of IP ranges from which control (ntpq) requests can be accessed
ntp-control-local-only	boolean	true	Restrict control (ntpq) access to locally connected Ethernet subnets only
ntp-control-table	(unsignedByte 0-99) routetable	All	Routing table number for incoming control (ntpq) requests
ntp-peer-table	(unsignedByte 0-99) routetable	0	Routing table number used for outgoing ntp peer requests
ntp-servers	List of IPNameAddr	ntp.firebrick.ltd.uk	List of NTP time servers (IP or hostname) from which time may be synchronized and served by ntp (Null list disables NTP)
profile	NMTOKEN	-	Profile name
source	string	-	Source of data, used in automated config management
table	(unsignedByte 0-99) routetable	All	Routing table number for access to service
tz1-name	string	GMT	Timezone 1 name
tz1-offset	duration	0	Timezone 1 offset from UTC
tz12-date	(unsignedByte 1-31) datenum	25	Timezone 1 to 2 earliest date in month
tz12-day	day	Sun	Timezone 1 to 2 day of week of change
tz12-month	month	Mar	Timezone 1 to 2 month
tz12-time	time	01:00:00	Timezone 1 to 2 local time of change
tz2-name	string	BST	Timezone 2 name
tz2-offset	duration	1:00:00	Timezone 2 offset from UTC
tz21-date	(unsignedByte 1-31) datenum	25	Timezone 2 to 1 earliest date in month
tz21-day	day	Sun	Timezone 2 to 1 day of week of change
tz21-month	month	Oct	Timezone 2 to 1 month
tz21-time	time	02:00:00	Timezone 2 to 1 local time of change

M.2.19. ethernet: Physical port controls

Physical port attributes

Table M.25. ethernet: Attributes

Attribute	Type	Default	Description
autoneg	boolean	auto negotiate unless manual 10/100 speed and duplex are set	Perform link auto-negotiation
clocking	LinkClock	prefer-slave	Gigabit clock setting
crossover	Crossover	auto	Port crossover configuration
duplex	LinkDuplex	auto	Duplex setting for this port
flow	LinkFlow	none	Flow control setting
green	LinkLED	Link/Activity	Green LED setting
lacp	boolean	Auto	Send LACP packets
lldp	boolean	true	Send LLDP packets
optimise	boolean	true	enable PHY optimisations
orange	LinkLED	Link/Activity	Orange LED setting
port	port	Not optional	Physical port
power-saving	LinkPower	full	enable PHY power saving
profile	NMTOKEN	-	Profile name
send-fault	LinkFault	-	Send fault status
speed	LinkSpeed	auto	Speed setting for this port
yellow	LinkLED	Link/Activity	Yellow LED setting

M.2.20. link-activity: LED link monitoring

LED behaviour based on link status

Table M.26. link-activity: Attributes

Attribute	Type	Default	Description
blink-rate	LEDBlink	Medium	Blink rate
blink-speedmatch	boolean	false	Only show activity if speed matched
collision	boolean	false	Blink on collision (half-duplex)
colour	LEDColour	Not optional	LED colour
full-duplex	boolean	false	On when link up and full-duplex
half-duplex	boolean	false	On when link up and half-duplex
rx-activity	boolean	green true, others false	Blink on Rx
tx-activity	boolean	true	Blink on Tx
up-100M	boolean	green true, others false	On when link up at 100M
up-10M	boolean	green true, others false	On when link up at 10M
up-1G	boolean	green true, others false	On when link up at 1G

M.2.21. sampling: Packet sampling configuration

Packet sampling configuration

Table M.27. sampling: Attributes

Attribute	Type	Default	Description
agent-ip	IPAddr	use source-ip	IP address used to identify this agent
collector-ip	IPAddr	Not optional	IP address of collector
collector-port	unsignedShort	6343 for sFlow, 4739 for IPFIX	UDP port which collector listens on
comment	string	-	Comment
mtu	(unsignedShort 576-2000) mtu	1500
name	string	-	Name
profile	NMTOKEN	-	Profile name
protocol	sampling-protocol	sflow	Protocol used to export sampling data
sample-flush	duration	1 sec for sFlow; 30 for IPFIX	Sample max cache time
sample-rate	(unsignedShort 100-10000) sample-rate	1000	Sample rate (uniform random prob 1/N)
snap-length	unsignedShort	64	Packet header snap length
source	string	-	Source of data, used in automated config management
source-ip	IPAddr	-	Source IP address to use
source-port	unsignedShort	Use collector-port	UDP source port
stats-interval	duration	60	Stats export interval
table	(unsignedByte 0-99) routetable	0	Routing table number for sample data
template-refresh	duration	600	Template resend interval

M.2.22. portdef: Port grouping and naming

Port grouping and naming

Table M.28. portdef: Attributes

Attribute	Type	Default	Description
comment	string	-	Comment
dongle	NMTOKEN	-	USB dongle config name (for eth/4G dongle)
name	NMTOKEN	Not optional	Name
ports	Set of port	Not optional	Physical port(s)
source	string	-	Source of data, used in automated config management
trunk	trunk-mode	false	Trunk ports

M.2.23. interface: Port-group/VLAN interface settings

The interface definition relates to a specific physical port group and VLAN. It includes subnets and VRRP that apply to that interface.

Table M.29. interface: Attributes

Attribute	Type	Default	Description
bgp	bgpmode	Auto	BGP announce mode for routes
comment	string	-	Comment
cug	(unsignedShort 1-32767) cug	-	Closed user group ID
cug-restrict	boolean	-	Closed user group restricted traffic (only to/from same CUG ID)
dhcp-relay	IP4Addr	-	Relay any unresolved requests to external server
fast-l2tp	boolean	-	Set on interfaces that are mainly terminating L2TP traffic
graph	(token) graphname	-	Graph name
link	NMTOKEN	-	Interface to which this is linked at layer 2
log	NMTOKEN	Not logging	Log events including DHCP and related events
log-debug	NMTOKEN	Not logging	Log debug
log-error	NMTOKEN	Log as event	Log errors
mtu	(unsignedShort 576-2000) mtu	1500	MTU for this interface
name	NMTOKEN	-	Name
ospf	boolean	true	OSPF announce mode for route
ospf-cost	unsignedShort	1	Outbound link cost
pd-pcp	boolean	true	Accept NAT-PMP / PCP on PD subnets
ping	IPAddr	-	Ping address to add loss/latency to graph for interface
port	NMTOKEN	Not optional	Port group name
profile	NMTOKEN	-	Profile name
ra-client	boolean	true	Accept IPv6 RA and create auto config subnets and routes
restrict-mac	boolean	-	Use only one MAC on this interface
sampling	sampling-mode	off	Perform sampling
source	string	-	Source of data, used in automated config management
source-filter	sfoption	-	Source filter traffic received via this interface
source-filter-table	(unsignedByte 0-99) routetable	interface table	Routing table to use for source filtering checks
table	(unsignedByte 0-99) routetable	0	Routing table applicable
vlan	(unsignedShort 0-4095) vlan	0	VLAN ID (0=untagged)
wan	boolean	-	Do not consider this interface 'local' for 'local-only' checks

Table M.30. interface: Elements

Element	Type	Instances	Description
dhcp	dhcps	Optional, unlimited	DHCP server settings
subnet	subnet	Optional, unlimited	IP subnet on the interface
vrrp	vrrp	Optional, unlimited	VRRP settings

M.2.24. subnet: Subnet settings

Subnet settings define the IP address(es) of the FireBrick, and also allow default routes to be set.

Table M.31. subnet: Attributes

Attribute	Type	Default	Description
accept-dns	boolean	true	Accept DNS servers specified by DHCP
arp-timeout	unsignedShort	60	Max lifetime on ARP and ND
bgp	bgpmode	Auto	BGP announce mode for routes
broadcast	boolean	false	If broadcast address allowed
comment	string	-	Comment
dhcp-class	string	FB-type	DHCP client option 60 (Class)
dhcp-client-id	string	MAC	DHCP client option 61 (Client-Identifier)
gateway	List of IPAddr	-	One or more gateways to install
ip	List of IPSubnet	Automatic by DHCP	One or more IP/len
localpref	unsignedInt	4294967295	Localpref for subnet (highest wins)
mtu	(unsignedShort 576-2000) mtu	As interface	MTU for subnet
name	string	-	Name
nat	boolean	false	Short cut to set nat default mode on all IPv4 traffic from subnet (can be overridden by firewall rules)
ospf	boolean	true	OSPF announce mode for route
pcp	boolean	If nat	Accept NAT-PMP / PCP
profile	NMTOKEN	-	Profile name
proxy-arp	boolean	false	Answer ARP/ND by proxy if we have routing
ra	ramode	false	If to announce IPv6 RA for this subnet
ra-dns	List of IP6Addr	Our IP	List of recursive DNS servers in route announcements
ra-dnssl	List of string	-	List of DNS search domains in route announcements
ra-managed	dhcpv6control	-	RA 'M' (managed) flag
ra-max	(unsignedShort 4-1800) ra-max	600	Max RA send interval
ra-min	(unsignedShort 3-1350) ra-min	ra-max/3	Min RA send interval
ra-mtu	unsignedShort	As subnet	MTU to use on RA
ra-other	dhcpv6control	-	RA 'O' (other) flag
ra-profile	NMTOKEN	-	Profile, if inactive then forces low priority RA
source	string	-	Source of data, used in automated config management
test	IPAddr	-	Test link state using ARP/ND for this IP
ttl	unsignedByte	64	TTL for originating traffic via subnet

M.2.25. vrrp: VRRP settings

VRRP settings provide virtual router redundancy for the FireBrick. Profile inactive does not disable vrrp but forces vrrp low priority. Use different VRID on different VLANs.

Table M.32. vrrp: Attributes

Attribute	Type	Default	Description
answer-ping	boolean	true	Whether to answer PING to VRRP IPs when master
comment	string	-	Comment
delay	unsignedInt	60	Delay after routing established before priority returns to normal
interval	unsignedShort	100	Transit interval (centiseconds)
ip	List of IPAddr	Not optional	One or more IP addresses to announce
log	NMTOKEN	Not logging	Log events
log-error	NMTOKEN	log as event	Log errors
low-priority	unsignedByte	1	Lower priority applicable until routing established
name	NMTOKEN	-	Name
preempt	boolean	true	Whether pre-empt allowed
priority	unsignedByte	100	Normal priority
profile	NMTOKEN	-	Profile name
source	string	-	Source of data, used in automated config management
use-vmac	boolean	true	Whether to use the special VMAC or use normal MAC
version3	boolean	v2 for IPv4, v3 for IPv6	Use only version 3
vrid	unsignedByte	42	VRID

M.2.26. dhcps: DHCP server settings

Settings for DHCP server

Table M.33. dhcps: Attributes

Attribute	Type	Default	Description
boot	IP4Addr	-	Next/boot server
boot-file	string	-	Boot filename
class	string	-	Vendor class match
client-name	string	-	Client name match
comment	string	-	Comment
dns	List of IP4Addr	Our IP	DNS resolvers
domain	string	From system settings	DNS domain
domain-search	string	-	DNS domain search list (list will be truncated to fit one attribute)
force	boolean	-	Send all options even if not requested
gateway	IP4Subnet	Our IP	Gateway
ip	List of IP4Range	0.0.0.0/0	Address pool
lease	duration	2:00:00	Lease length
log	NMTOKEN	Not logging	Log events (allocations)
mac	List up to 12 (hexBinary) macprefix	-	Partial or full client hardware (MAC) addresses (or client-id MAC if specified)
name	string	-	Name
ntp	List of IP4Addr	Our IP	NTP server
profile	NMTOKEN	-	Profile name
source	string	-	Source of data, used in automated config management
syslog	List of IP4Addr	-	Syslog server
time	List of IP4Addr	Our IP	Time server

Table M.34. dhcps: Elements

Element	Type	Instances	Description
send	dhcp-attr-hex	Optional, unlimited	Additional attributes to send (hex)
send-ip	dhcp-attr-ip	Optional, unlimited	Additional attributes to send (IP)
send-number	dhcp-attr-number	Optional, unlimited	Additional attributes to send (numeric)
send-string	dhcp-attr-string	Optional, unlimited	Additional attributes to send (string)

M.2.27. dhcp-attr-hex: DHCP server attributes (hex)

Additional DHCP server attributes (hex)

Table M.35. dhcp-attr-hex: Attributes

Attribute	Type	Default	Description
comment	string	-	Comment
force	boolean	-	Send even if not requested
id	unsignedByte	Not optional	Attribute type code/tag
name	string	-	Name
value	hexBinary	Not optional	Value
vendor	boolean	-	Add as vendor specific option (under option 43)

M.2.28. dhcp-attr-string: DHCP server attributes (string)

Additional DHCP server attributes (string)

Table M.36. dhcp-attr-string: Attributes

Attribute	Type	Default	Description
comment	string	-	Comment
force	boolean	-	Send even if not requested
id	unsignedByte	Not optional	Attribute type code/tag
name	string	-	Name
value	string	Not optional	Value
vendor	boolean	-	Add as vendor specific option (under option 43)

M.2.29. dhcp-attr-number: DHCP server attributes (numeric)

Additional DHCP server attributes (numeric)

Table M.37. dhcp-attr-number: Attributes

Attribute	Type	Default	Description
comment	string	-	Comment
force	boolean	-	Send even if not requested
id	unsignedByte	Not optional	Attribute type code/tag
name	string	-	Name
value	unsignedInt	Not optional	Value
vendor	boolean	-	Add as vendor specific option (under option 43)

M.2.30. dhcp-attr-ip: DHCP server attributes (IP)

Additional DHCP server attributes (IP)

Table M.38. dhcp-attr-ip: Attributes

Attribute	Type	Default	Description
comment	string	-	Comment
force	boolean	-	Send even if not requested
id	unsignedByte	Not optional	Attribute type code/tag
name	string	-	Name
value	IP4Addr	Not optional	Value
vendor	boolean	-	Add as vendor specific option (under option 43)

M.2.31. pppoe: PPPoE settings

PPPoE endpoint settings

Table M.39. pppoe: Attributes

Attribute	Type	Default	Description
ac-name	string	Any a/c name as client, else same as 'name'	Access concentrator name
accept-dns	boolean	true	Accept DNS servers specified by far end
bgp	bgpmode	Auto	BGP announce mode for routes
calling-id	pppoe-calling	-	Add mac and/or vlan after prefix
calling-prefix	string	-	Prefix on calling number (BRAS mode)
comment	string	-	Comment
cug	(unsignedShort 1-32767) cug	-	Closed user group ID
cug-restrict	boolean	-	Closed user group restricted traffic (only to/from same CUG ID)
eth	port	-	Physical port connected to modem (for port reset)
fast-retry	boolean	-	Aggressive re-connect
graph	(token) graphname	-	Graph name
ip-over-lcp	boolean	auto	Sends all IP packets as LCP
lcp-rate	unsignedByte	10	LCP interval (seconds)
lcp-timeout	unsignedByte	61	LCP timeout (seconds)
local	IP4Addr	-	Local IPv4 address
localpref	unsignedInt	4294967295	Localpref for route (highest wins)
log	NMTOKEN	Not logging	Log events
log-debug	NMTOKEN	Not logging	Log debug
log-error	NMTOKEN	Not logging	Log as events
mode	pppoe-mode	client	PPPoE server/client mode
mtu	(unsignedShort 576-2000) mtu	1492	MTU for link
name	NMTOKEN	-	Name
nat	boolean	false	NAT IPv4 traffic to this link unless otherwise set by rules
ospf	boolean	true	OSPF announce mode for route
password	Secret	-	User password
pd-interface	List of NMTOKEN	Auto	Interfaces for IPv6 prefix delegation
port	NMTOKEN	-	Port group name
profile	NMTOKEN	-	Profile name
remote	IP4Addr	-	Remote IPv4 address
rfc4638	boolean	If over 1492 MTU	Send RFC4638 PPP-Max-Payload
routes	List of IPPrefix	Default gateway	Routes when link up
service	string	Any service	Service name
source	string	-	Source of data, used in automated config management
speed	unsignedInt	-	Default egress rate limit (b/s)
table	(unsignedByte 0-99) routetable	-	Routing table number for payload
tcp-mss-fix	boolean	true	Adjust MSS option in TCP SYN to fix session MSS
username	string	-	User name
vlan	(unsignedShort 0-4095) vlan	0	VLAN ID (0=untagged)

Table M.40. pppoe: Elements

Element	Type	Instances	Description
route	ppp-route	Optional, unlimited	Routes to apply when ppp link is up

M.2.32. ppp-route: PPP routes

Routes that apply when link is up

Table M.41. ppp-route: Attributes

Attribute	Type	Default	Description
bgp	bgpmode	Auto	BGP announce mode for routes
comment	string	-	Comment
ip	List of IPPrefix	Not optional	One or more network prefixes
localpref	unsignedInt	4294967295	Localpref of network (highest wins)
name	string	-	Name
ospf	boolean	true	OSPF announce mode for route
profile	NMTOKEN	-	Profile name
source	string	-	Source of data, used in automated config management

M.2.33. usb: USB 3G/dongle settings

USB config settings including 3G data

Table M.42. usb: Attributes

Attribute	Type	Default	Description
log	NMTOKEN	Web/console	Log events
log-debug	NMTOKEN	Not logged	Log errors
log-error	NMTOKEN	Web/Flash/console	Log errors
profile	NMTOKEN	-	Profile name

Table M.43. usb: Elements

Element	Type	Instances	Description
dongle	dongle	Optional, up to 10	USB 3G/dongle settings

M.2.34. dongle: 3G/dongle settings

3G/dongle config settings

Table M.44. dongle: Attributes

Attribute	Type	Default	Description
accept-dns	boolean	true	Accept DNS servers specified by far end
apn	string	From SIM	Mobile access point name
bgp	bgpmode	Auto	BGP announce mode for routes
comment	string	-	Comment
context	pdp-context-type	ip	Type of connection to make
cug	(unsignedShort 1-32767) cug	-	Closed user group ID
cug-restrict	boolean	-	Closed user group restricted traffic (only to/from same CUG ID)
dial-string	string	ATV1 ATE0 AT+CFUN=1 AT&D2&C1S0=0S7=60 AT+CGDCONT=1,"[context]","[apn]" ATDT*99#	Space separated AT command strings which can include [apn] and [context]
graph	(token) graphname	-	Graph name
local	IP4Addr	-	Local IPv4 address
localpref	unsignedInt	4294967295	Localpref for route (highest wins)
log	NMTOKEN	Log as specified in parent usb config	Log events
log-debug	NMTOKEN	Log as specified in parent usb config	Log debug
log-error	NMTOKEN	Log as specified in parent usb config	Log errors
modeswitch	string	standard switching	Mode switch mechanism
mtu	(unsignedShort 576-2000) mtu	1500	MTU for link
name	NMTOKEN	-	Name
nat	boolean	true	NAT IPv4 traffic to this link unless otherwise set in rules
ospf	boolean	true	OSPF announce mode for route
password	Secret	-	User password
product	hexBinary	-	Product ID - used to match a configuration with specific device vendor
profile	NMTOKEN	-	Profile name
remote	IP4Addr	-	Remote IPv4 address
routes	List of IPPrefix	Default gateway	Routes when link up
socket	string	-	What USB socket ID should this config apply to
source	string	-	Source of data, used in automated config management
speed	unsignedInt	-	Default egress rate limit (b/s)
table	(unsignedByte 0-99) routetable	From interface	Routing table number for payload
tcp-mss-fix	boolean	true	Adjust MSS option in TCP SYN to fix session MSS
username	string	-	User name
vendor	hexBinary	-	Vendor ID - used to match a configuration with specific device vendor

Table M.45. dongle: Elements

Element	Type	Instances	Description
route	ppp-route	Optional, unlimited	Routes to apply when link is up

M.2.35. route: Static routes

Static routes define prefixes which are permanently in the routing table, and whether these should be announced by routing protocols or not.

Table M.46. route: Attributes

Attribute	Type	Default	Description
bgp	bgpmode	Auto	BGP announce mode for routes
comment	string	-	Comment
gateway	List of IPAddr	Not optional	One or more target gateway IPs
graph	(token) graphname	-	Graph name
ip	List of IPPrefix	Not optional	One or more network prefixes
localpref	unsignedInt	4294967295	Localpref of network (highest wins)
name	string	-	Name
ospf	boolean	true	OSPF announce mode for route
profile	NMTOKEN	-	Profile name
source	string	-	Source of data, used in automated config management
speed	unsignedInt	-	Egress rate limit (b/s)
table	(unsignedByte 0-99) routetable	0	Routing table number

M.2.36. network: Locally originated networks

Network blocks that are announced but not actually added to internal routes - note that blackhole and nowhere objects can also announce but add routing.

Table M.47. network: Attributes

Attribute	Type	Default	Description
as-path	List up to 10 unsignedInt	-	Custom AS path as if network received
bgp	bgpmode	true	BGP announce mode for routes
comment	string	-	Comment
ip	List of IPPrefix	Not optional	One or more network prefixes
localpref	unsignedInt	4294967295	Localpref of network (highest wins)
name	string	-	Name
ospf	boolean	true	OSPF announce mode for route
profile	NMTOKEN	-	Profile name
source	string	-	Source of data, used in automated config management
table	(unsignedByte 0-99) routetable	0	Routing table number
tag	List of Community	-	List of community tags

M.2.37. blackhole: Dead end networks

Networks that go nowhere

Table M.48. blackhole: Attributes

Attribute	Type	Default	Description
as-path	List up to 10 unsignedInt	-	Custom AS path as if network received
bgp	bgpmode	false	BGP announce mode for routes
comment	string	-	Comment
ip	List of IPPrefix	Not optional	One or more network prefixes
localpref	unsignedInt	4294967295	Localpref of network (highest wins)
name	string	-	Name
no-fib	boolean	-	Route not in forwarding, only for EBGP
ospf	boolean	-	OSPF announce mode for route
profile	NMTOKEN	-	Profile name
source	string	-	Source of data, used in automated config management
table	(unsignedByte 0-99) routetable	0	Routing table number
tag	List of Community	-	List of community tags

M.2.38. loopback: Locally originated networks

Loopback addresses define local IP addresses

Table M.49. loopback: Attributes

Attribute	Type	Default	Description
as-path	List up to 10 unsignedInt	-	Custom AS path as if network received
bgp	bgpmode	Auto	BGP announce mode for routes
comment	string	-	Comment
ip	List of IPAddr	Not optional	One or more local network addresses
localpref	unsignedInt	4294967295	Localpref of network (highest wins)
name	string	-	Name
ospf	boolean	true	OSPF announce mode for route
profile	NMTOKEN	-	Profile name
source	string	-	Source of data, used in automated config management
table	(unsignedByte 0-99) routetable	0	Routing table number
tag	List of Community	-	List of community tags

M.2.39. ospf: Overall OSPF settings

The OSPF element defines general OSPF settings. Where interfaces/table specified, first matching OSPF config is applied. Only provides OSPF internal and AS-border router functionality.

Table M.50. ospf: Attributes

Attribute	Type	Default	Description
area-id	IP4Addr	0.0.0.0	Area ID
auth-algorithm	ipsec-auth-algorithm	AES-XCBC	Authentication algorithm for OSPFv3
auth-key	hexBinary	-	Key for OSPFv3 authentication
bgp	bgpmode	-	BGP announce mode for routes
comment	string	-	Comment
crypt-algorithm	ipsec-crypt-algorithm	null	Encryption algorithm for OSPFv3
crypt-key	hexBinary	-	Key for OSPFv3 encryption
dead-interval	duration	45	Default router dead interval
hello-interval	duration	9	Default hello interval
instance	unsignedByte	-	Instance ID for OSPFv3
interfaces	List of NMTOKEN	All	Ethernet interfaces to which this OSPF config applies
ipsec-type	ipsec-type	ESP	Encapsulation type for OSPFv3 security
key-id	integer	1	Key ID for OSPFv2 MD5 authentication (-1 for simple auth)
localpref	unsignedInt	-	Base localpref (highest wins)
log	NMTOKEN	Not logging	Log calls
log-debug	NMTOKEN	Not logging	Log debug and SIP messages
log-error	NMTOKEN	Log as event	Log errors
name	string	-	Name
password	Secret	-	Secret for OSPFv2 MD5 authentication
priority	unsignedByte	1	Default priority
profile	NMTOKEN	-	Profile name
router-id	IP4Addr	-	Router ID
rxmt-interval	duration	3	Default router retransmit interval
source	string	-	Source of data, used in automated config management
spi	(unsignedInt 256-4294967295) ipsec-spi	-	SPI for OSPFv3 security (unset for no security)
stub	boolean	-	Stub area
table	(unsignedByte 0-99) routetable	0	Routing table

M.2.40. namedbgpmap: Mapping and filtering rules of BGP prefixes

This defines a set of named rules for mapping and filtering of prefixes to/from a BGP peer.

Table M.51. namedbgpmap: Attributes

Attribute	Type	Default	Description
comment	string	-	Comment
name	NMTOKEN	Not optional	Name
source	string	-	Source of data, used in automated config management

Table M.52. namedbgpmap: Elements

Element	Type	Instances	Description
match	bgprule	Optional, unlimited	List rules, in order of checking

M.2.41. bgprule: Individual mapping/filtering rule

An individual rule for BGP mapping/filtering

Table M.53. bgprule: Attributes

Attribute	Type	Default	Description
as-origin	unsignedInt	-	AS that must be last in path to match
as-present	unsignedInt	-	AS that must be present in path to match
comment	string	-	Comment
community	Community	-	Community that must be present to match
detag	List of Community	-	List of community tags to remove
drop	boolean	-	Do not import/export this prefix
localpref	unsignedInt	-	Set localpref (highest wins)
med	unsignedInt	-	Set MED
name	string	-	Name
no-community	Community	-	Community that must not be present to match
pad	unsignedByte	-	Pad (prefix stuff) our AS on export by this many, can be zero to not send our AS
prefix	List of IPFilter	-	Prefixes that this rule applies to
source	string	-	Source of data, used in automated config management
tag	List of Community	-	List of community tags to add

M.2.42. bgp: Overall BGP settings

The BGP element defines general BGP settings and a list of peer definitions for the individual BGP peers.

Table M.54. bgp: Attributes

Attribute	Type	Default	Description
as	unsignedInt	-	Our AS
blackhole-community	Community	-	Community tag to mark black hole routes
cluster-id	IP4Addr	-	Our cluster ID
comment	string	-	Comment
dead-end-community	Community	-	Community tag to mark dead end routes
greyhole-community	Community	-	Community tag to mark black hole routes with no-fib
id	IP4Addr	-	Our router ID
log	NMTOKEN	Not logging	Log events
name	string	-	Name
source	string	-	Source of data, used in automated config management
table	(unsignedByte 0-99) routetable	0	Routing table number

Table M.55. bgp: Elements

Element	Type	Instances	Description
peer	bgppeer	Optional, up to 500	List of peers/neighbours

M.2.43. bgppeer: BGP peer definitions

The peer definition specifies the attributes of an individual peer. Multiple IP addresses can be specified, typically for IPv4 and IPv6 addresses for the same peer, but this can be used for a group of similar peers.

Table M.56. bgppeer: Attributes

Attribute	Type	Default	Description
add-own-as	boolean	-	Add our AS on exported routes
allow-export	boolean	true for customer	Ignore no-export community and export anyway
allow-only-their-as	boolean	-	Only accept routes that are solely the peers AS
allow-own-as	boolean	-	Allow our AS inbound
as	unsignedInt	-	Peer AS
blackhole-community	Community	Not announced on EBGP, our blackhole-community if IBGP	Egress community tag to mark black hole routes
capability-as4	boolean	true	If supporting AS4
capability-graceful-restart	boolean	true	If supporting Graceful Restart
capability-mpe-ipv4	boolean	true	If supporting MPE for IPv4
capability-mpe-ipv6	boolean	true	If supporting MPE for IPv6
capability-route-refresh	boolean	true	If supporting Route Refresh
clean-shutdown-wait	duration	-	Send peers low priority and delay on shutdown
clean-startup-wait	duration	-	Don't announce routes within this time of reboot
comment	string	-	Comment
drop-default	boolean	false	Ignore default route received
export-filters	List of NMTOKEN	-	Named export filters to apply
export-med	unsignedInt	-	Set MED on exported routes (unless export filter sets it)
holdtime	unsignedInt	30	Hold time
ignore-bad-optional-partial	boolean	true	Ignore routes with a recognised badly formed optional that is flagged partial
import-filters	List of NMTOKEN	-	Named import filters to apply
import-localpref	unsignedInt	-	Set localpref on imported routes (unless import filter sets it)
import-tag	List of Community	-	List of community tags to add in addition to any import filters
in-soft	boolean	-	Mark received routes as soft
ip	List of IPAddr	-	One or more IPs of neighbours (omit to allow incoming)
log-debug	NMTOKEN	Not logging	Log debug
max-prefix	unsignedInt	-	Limit prefixes (IPv4+IPv6)
md5	Secret	-	MD5 signing secret
name	string	-	Name
next-hop-self	boolean	false	Force us as next hop outbound
no-fib	boolean	-	Don't include received routes in packet forwarding
pad	unsignedByte	-	Pad (prefix stuff) our AS on export by this many
profile	NMTOKEN	-	Profile name
reduce-recursion	boolean	false	Override incoming next hop if not local subnet
same-ip-type	boolean	true	Only accept/send IPv4 routes to IPv4 peers and IPv6 routes to IPv6 peers
send-default	boolean	false	Send a default route to this peer
send-no-routes	boolean	false	Don't send any normal routes
source	string	-	Source of data, used in automated config management
timer-idle	unsignedInt	60	Idle time after error
timer-openwait	unsignedInt	10	Time to wait for OPEN on connection
timer-retry	unsignedInt	10	Time to retry the neighbour
ttl-security	byte	-	Enable RFC5082 TTL security (if +ve, 1 to 127), i.e. 1 for adjacent router. If -ve (-1 to -128) set forced sending TTL, i.e. -1 for TTL of 1 sending, and not checking.
type	peertype	normal	Type of neighbour (affects some defaults)
use-vrrp-as-self	boolean	true if customer/transit type	Use VRRP address as self if possible

Table M.57. bgppeer: Elements

Element	Type	Instances	Description
export	bgpmap	Optional	Mapping and filtering rules of announcing prefixes to peer
import	bgpmap	Optional	Mapping and filtering rules of accepting prefixes from peer

M.2.44. bgpmap: Mapping and filtering rules of BGP prefixes

This defines the rules for mapping and filtering of prefixes to/from a BGP peer.

Table M.58. bgpmap: Attributes

Attribute	Type	Default	Description
comment	string	-	Comment
detag	List of Community	-	List of community tags to remove
drop	boolean	-	Do not import/export this prefix
localpref	unsignedInt	-	Set localpref (highest wins)
med	unsignedInt	-	Set MED
prefix	List of IPFilter	-	Drop all that are not in this prefix list
source	string	-	Source of data, used in automated config management
tag	List of Community	-	List of community tags to add

Table M.59. bgpmap: Elements

Element	Type	Instances	Description
match	bgprule	Optional, unlimited	List rules, in order of checking

M.2.45. cqm: Constant Quality Monitoring settings

Constant quality monitoring (graphs and data) have a number of settings. Most of the graphing settings can be overridden when a graph is collected so these define the defaults in many cases.

Table M.60. cqm: Attributes

Attribute	Type	Default	Description
ave	Colour	#08f	Colour for average latency
axis	Colour	black	Axis colour
background	Colour	white	Background colour
bottom	unsignedByte	11	Pixels space at bottom of graph
dateformat	string	%Y-%m-%d	Date format
dayformat	string	%a	Day format
fail	Colour	red	Colour for failed (dropped) seconds
fail-level	unsignedInt	1	Fail level not expected on low usage
fail-level1	unsignedByte	3	Loss level 1
fail-level2	unsignedByte	50	Loss level 2
fail-score	unsignedByte	200	Score for fail and low usage
fail-score1	unsignedByte	100	Score for on/above level 1
fail-score2	unsignedByte	200	Score for on/above level 2
fail-usage	unsignedInt	128000	Usage below which fail is not expected
fblogo	Colour	#bd1220	Colour for logo
graticule	Colour	grey	Graticule colour
heading	string	-	Heading of graph
hourformat	string	%H	Hour format
key	unsignedByte	90	Pixels space for key
label-ave	string	Ave	Label for average latency
label-damp	string	Damp%	Label for % shaper damping
label-fail	string	%Fail	Label for seconds (%) failed
label-latency	string	Latency	Label for latency
label-max	string	Max	Label for maximum latency
label-min	string	Min	Label for minimum latency
label-off	string	Off	Label for off line seconds
label-period	string	Period	Label for period
label-poll	string	Polls	Label for polls
label-rej	string	%Reject	Label for rejected seconds
label-rx	string	Rx	Label for Rx traffic level
label-score	string	Score	Label for score
label-sent	string	Sent	Label for seconds polled
label-shaper	string	Shaper	Label for shaper
label-time	string	Time	Label for time
label-traffic	string	Traffic (bit/s)	Label for traffic level
label-tx	string	Tx	Label for Tx traffic level
latency-level	unsignedInt	100000000	Latency level not expected on low usage
latency-level1	unsignedInt	100000000	Latency level 1 (ns)
latency-level2	unsignedInt	500000000	Latency level 2 (ns)
latency-score	unsignedByte	200	Score for high latency and low usage
latency-score1	unsignedByte	10	Score for on/above level 1
latency-score2	unsignedByte	20	Score for on/above level 2
latency-usage	unsignedInt	128000	Usage below which latency is not expected
left	unsignedByte	0	Pixels space left of main graph
log	NMTOKEN	Not logging	Log events
marker-width	string	-	Marker + on tx/rx
max	Colour	green	Colour for maximum latency
min	Colour	#008	Colour for minimum latency
ms-max	positiveInteger	500	ms max height
off	Colour	#c8f	Colour for off line seconds
outside	Colour	transparent	Colour for outer border
ping-update	duration	1:00:00	Interval for periodic updates
ping-url	string	-	URL for ping list
rej	Colour	#f8c	Colour for off line seconds
right	unsignedByte	50	Pixels space right of main graph
rx	Colour	#800	Colour for Rx traffic level
secret	Secret	-	Secret for MD5 coded URLs
sent	Colour	#ff8	Colour for polled seconds
share-interface	NMTOKEN	-	Interface on which to broadcast data for shaper sharing
share-secret	string	-	Secret to validate shaper sharing
stroke-width	string	-	Stroke line tx/rx
subheading	string	-	Subheading of graph
svg-css	string	-	URL for SVG CSS instead of local style settings
svg-title	boolean	-	Include mouseover title text on svg
text	Colour	black	Colour for text
text1	string	-	Text line 1
text2	string	-	Text line 2
text3	string	-	Text line 3
text4	string	-	Text line 4
timeformat	string	%Y-%m-%d %H:%M:%S	Time format
top	unsignedByte	4	Pixels space at top of graph
tx	Colour	#080	Colour for Tx traffic level

M.2.46. l2tp: L2TP settings

L2TP settings for incoming and outgoing L2TP connections

Table M.61. l2tp: Attributes

Attribute	Type	Default	Description
accounting-interval	duration	1:00:00	Periodic interim accounting interval
send-acct-delay	boolean	-	Send Acct-Delay as well as Event-Timestamp on accounting

Table M.62. l2tp: Elements

Element	Type	Instances	Description
incoming	l2tp-incoming	Optional, unlimited	Incoming L2TP connections
outgoing	l2tp-outgoing	Optional, unlimited	Outgoing L2TP connections

M.2.47. l2tp-outgoing: L2TP settings for outgoing L2TP connections

L2TP tunnel settings for outgoing L2TP connections

Table M.63. l2tp-outgoing: Attributes

Attribute	Type	Default	Description
accept-dns	boolean	true	Accept DNS servers specified by far end
bgp	bgpmode	Auto	BGP announce mode for routes
called-station-id	string	-	called-station-idi to send
calling-station-id	string	-	calling-station-id to send
comment	string	-	Comment
cug	(unsignedShort 1-32767) cug	-	Closed user group ID
cug-restrict	boolean	-	Closed user group restricted traffic (only to/from same CUG ID)
fail-lockout	unsignedByte	1	Interval kept in failed state
graph	string	-	Graph name
ha-set	ha-set	-	HA Set (send duplicate packets to set)
hdlc	boolean	true	Send HDLC header (FF03) on all PPP frames
hello-interval	unsignedByte	10	Interval between HELLO messages
lcp-data-len	unsignedByte	-	LCP echo data field length
lcp-rate	unsignedByte	10	LCP interval (seconds)
lcp-timeout	unsignedByte	61	LCP timeout (seconds)
local	IP4Addr	-	Local (internal/PPP) IPv4 address
local-hostname	string	System name	The hostname we quote on tunnel connect
local-ip	IPAddr	-	Wrapper IP of our end
localpref	unsignedInt	4294967295	Localpref for remote-ip/routes (highest wins)
log	NMTOKEN	Not logging	Log events
log-debug	NMTOKEN	Not logging	Log debug
log-error	NMTOKEN	Log as event	Log errors
min-retry	duration	10	Minimum session time before retrying connection
mtu	(unsignedShort 576-2000) mtu	-	Default MTU for sessions in this tunnel
name	NMTOKEN	-	Name
nat	boolean	true	NAT IPv4 traffic to this link unless otherwise set in rules
open-timeout	unsignedByte	10	Interval before OPEN considered failed
ospf	boolean	true	OSPF announce mode for route
password	Secret	-	Password for login
payload-table	(unsignedByte 0-99) routetable	0	Routing table number for payload traffic
ppp-final-timeout	unsignedByte	60	PPP total timeout (seconds)
ppp-init-timeout	unsignedByte	10	PPP initial timeout (seconds)
profile	NMTOKEN	-	Profile name
receive-window	unsignedShort	Not sent	Receive window to advise on connection
remote	IP4Addr	-	Remote (internal/PPP) IPv4 address
retry-timeout	unsignedByte	10	Interval to retry sending control messages before fail
routes	List of IPPrefix	Default gateway	Routes when link up
rx-speed	unsignedInt	-	Send ingress rate (b/s)
secret	Secret	-	Shared secret
server	IPNameAddr	Not optional	IP/name of far end
source	string	-	Source of data, used in automated config management
table	(unsignedByte 0-99) routetable	0	Routing table number for L2TP session
tcp-mss-fix	boolean	false	Adjust MSS option in TCP SYN to fix session MSS
tx-speed	unsignedInt	-	Egress rate limit (b/s)
username	string	-	User name for login

Table M.64. l2tp-outgoing: Elements

Element	Type	Instances	Description
route	ppp-route	Optional, unlimited	Routes to apply when link is up

M.2.48. l2tp-incoming: L2TP settings for incoming L2TP connections

L2TP tunnel settings for incoming L2TP connections

Table M.65. l2tp-incoming: Attributes

Attribute	Type	Default	Description
allow	List of IPNameRange	-	List of IP ranges from which connects can be made
bgp	bgpmode	Auto	BGP announce mode for routes
comment	string	-	Comment
damping	boolean	false	Apply damping to sessions if limiting on shaper
dhcpv6dns	List of IP6Addr	-	List of IPv6 DNS servers
dos-limit	unsignedInt	10000	Per second per session tx packet drop limit for DOS protection
fail-lockout	unsignedByte	60	Interval kept in failed state
graph	string	-	Graph name
ha-set	ha-set	-	HA Set (send duplicate packets to set)
hdlc	boolean	true	Send HDLC header (FF03) on all PPP frames
hello-interval	unsignedByte	60	Interval between HELLO messages
icmp-ppp	boolean	false	Use PPP endpoint for ICMP
ipv6ep	IP4Addr	-	Local end IPv4 for IPv6 tunnels
lcp-data-len	unsignedByte	-	LCP data field length
lcp-mru-fix	boolean	false	Restart LCP if RAS negotiated MRU is too high
lcp-rate	unsignedByte	1	LCP interval (seconds)
lcp-timeout	unsignedByte	10	LCP timeout (seconds)
local-hostname	string	System name	Hostname quoted on reply
local-ppp-ip	IP4Addr	-	Local end PPP IPv4
log	NMTOKEN	Not logging	Log events
log-debug	NMTOKEN	Not logging	Log debug
log-error	NMTOKEN	Log as event	Log errors
mtu	(unsignedShort 576-2000) mtu	-	Default MTU for sessions in this tunnel
name	string	-	Name
open-timeout	unsignedByte	60	Interval before OPEN considered failed
ospf	boolean	true	OSPF announce mode for route
payload-table	(unsignedByte 0-99) routetable	0	Routing table number for payload traffic
ppp-final-timeout	unsignedByte	60	PPP total timeout (seconds)
ppp-init-timeout	unsignedByte	10	PPP initial timeout (seconds)
pppdns1	IP4Addr	-	PPP DNS1 IPv4 default
pppdns2	IP4Addr	-	PPP DNS2 IPv4 default
profile	NMTOKEN	-	Profile name
radius	string	-	Name for RADIUS server config to use
radius-nas-ip	radius-nas	lac	Pass remote (LAC) or local (LNS) as RADIUS NAS IP / port
receive-window	unsignedShort	Not sent	Receive window to advise on connection
remote-hostname	string	-	Hostname expected on connection
require-platform	boolean	false	All sessions require a platform RADIUS first
require-radius-acct	boolean	-	Close session if cannot do RADIUS accounting
retry-timeout	unsignedByte	60	Interval to retry sending control messages before fail
secret	Secret	-	Shared secret (for far end to check)
shutdown	boolean	false	Refuse all new sessions or tunnels
source	string	-	Source of data, used in automated config management
source-ip	IPAddr	-	IP of our end for relayed (on same table)
speed	unsignedInt	-	Default egress rate limit (b/s)
table	(unsignedByte 0-99) routetable	Any	Routing table number for L2TP session
tcp-mss-fix	boolean	false	Adjust MSS option in TCP SYN to fix session MSS

Table M.66. l2tp-incoming: Elements

Element	Type	Instances	Description
match	l2tp-relay	Optional, unlimited	Rules for relaying connections and local authentication

M.2.49. l2tp-relay: Relay and local authentication rules for L2TP

Rules for relaying L2TP or local authentication

Table M.67. l2tp-relay: Attributes

Attribute	Type	Default	Description
called-station-id	List of string	-	One or more patterns to match called-station-id
calling-station-id	List of string	-	One or more patterns to match calling-station-id
comment	string	-	Comment
graph	(token) graphname	-	Graph name
ip-over-lcp	boolean	-	Send IP over LCP (local auth)
lcp-echo-mim	boolean	-	Handle LCP echos in the middle on relayed connection
localpref	unsignedInt	4294967295	Localpref for remote-ip/routes (highest wins)
name	string	-	Name
password	Secret	-	Password check
payload-table	(unsignedByte 0-99) routetable	As per l2tp-incoming	Routing table number for payload traffic (or L2TP relay)
profile	NMTOKEN	-	Profile name
relay-hostname	string	-	Hostname for L2TP connection
relay-ip	List of IPAddr	-	Target IP(s) for L2TP connection
relay-pick	boolean	-	If set, try one of the relay IPs at random first
relay-secret	Secret	-	Shared secret for L2TP connection
remote-netmask	IP4Addr	-	Remote end PPP Netmask (local auth)
remote-ppp-ip	IP4Addr	-	Remote end PPP IPv4 (local auth)
routes	List of IPPrefix	-	Additional routes when link up (local auth)
source	string	-	Source of data, used in automated config management
username	List of string	-	One or more patterns to match username

M.2.50. fb105: FB105 tunnel definition

FB105 tunnel definition

Table M.68. fb105: Attributes

Attribute	Type	Default	Description
bgp	bgpmode	Auto	BGP announce mode for routes
comment	string	-	Comment
fast-udp	boolean	true	Send UDP packets marked not to be reordered
graph	(token) graphname	-	Graph name
internal-ip	IP46Addr	local-ip	Internal IP for traffic originated and sent down tunnel
ip	IP4Addr	dynamic tunnel	Far end IP
keep-alive	boolean	true if ip set	Constantly send keep alive packets
local-id	unsignedByte	Not optional	Unique local end tunnel ID
local-ip	IP4Addr	-	Force specific local end IP
localpref	unsignedInt	4294967295	Localpref for route (highest wins)
log	NMTOKEN	Not logging	Log events
log-error	NMTOKEN	Log as event	Log errors
mtu	unsignedShort	1500	MTU for wrapped packets
name	NMTOKEN	-	Name
obfuscate	(hexBinary) hex32	-	Scramble (not encrypt) data
ospf	boolean	true	OSPF announce mode for route
payload-table	(unsignedByte 0-99) routetable	0	Routing table number for payload traffic
port	unsignedShort	1	UDP port to use
profile	NMTOKEN	-	Profile name
remote-id	unsignedByte	Not optional	Unique remote end tunnel ID
reorder	boolean	false	Reorder incoming tunnel packets
reorder-maxq	(unsignedInt 1-100) fb105-reorder-maxq	32	Max queue length for out of order packets
reorder-timeout	(unsignedInt 10-5000) fb105-reorder-timeout	100	Max time to delay out of order packet (ms)
routes	List of IPPrefix	None	Routes when link up
satellite	boolean	-	Mark links that are high speed and latency for split latency bonding (experimental)
secret	Secret	Unsigned	Shared secret for tunnel
set	unsignedByte	-	Set ID for reorder ID tagging (create a set of tunnels together)
sign-all	boolean	false	All packets must be signed, not just keepalives
source	string	-	Source of data, used in automated config management
speed	unsignedInt	no shaping	Egress rate limit used (b/s)
table	(unsignedByte 0-99) routetable	0	Routing table number for tunnel wrappers
tcp-mss-fix	boolean	true	Adjust MSS option in TCP SYN to fix session MSS

Table M.69. fb105: Elements

Element	Type	Instances	Description
route	fb105-route	Optional, unlimited	Routes to apply to tunnel when up

M.2.51. fb105-route: FB105 routes

Routes for prefixes that are sent to the FB105 tunnel when up

Table M.70. fb105-route: Attributes

Attribute	Type	Default	Description
bgp	bgpmode	Auto	BGP announce mode for routes
comment	string	-	Comment
ip	List of IPPrefix	Not optional	One or more network prefixes
localpref	unsignedInt	4294967295	Localpref of network (highest wins)
name	string	-	Name
ospf	boolean	true	OSPF announce mode for route
profile	NMTOKEN	-	Profile name
source	string	-	Source of data, used in automated config management

M.2.52. ipsec-ike: IPsec configuration (IKEv2)

IPsec IKE and manually-keyed connection details

Table M.71. ipsec-ike: Attributes

Attribute	Type	Default	Description
allow	List of IPNameRange	Allow from anywhere	List of IP ranges from which IKE connections are allowed
force-NAT	List of IPNameRange	-	List of IP ranges of peers requiring forced NAT-T
log	NMTOKEN	Not logging	Log events
log-debug	NMTOKEN	Not logging	Log debug
log-error	NMTOKEN	Log as event	Log errors
trusted	List of IPNameRange	-	List of IP ranges given higher priority when establshing new connections
comment	string	-	Comment
source	string	-	Source of data, used in automated config management

Table M.72. ipsec-ike: Elements

Element	Type	Instances	Description
IKE-proposal	ike-proposal	Optional, unlimited	Proposals for IKE security association
IPsec-proposal	ipsec-proposal	Optional, unlimited	Proposals for IPsec AH/ESP security association
connection	(ipsec-connection-common) ike-connection	Optional, unlimited	IKE connections
manually-keyed	(ipsec-connection-common) ipsec-manual	Optional, unlimited	IPsec manually-keyed connections (not recommended)
roaming	ike-roaming	Optional, unlimited	IKE roaming IP pools

M.2.53. ike-connection: connection configuration

IPsec IKE connection settings

Table M.73. ike-connection: Attributes

Attribute	Type	Default	Description
bgp	bgpmode	Auto	BGP announce mode for routes
comment	string	-	Comment
graph	(token) graphname	-	Graph name
internal-ip	IP46Addr	local-ip	Internal IP for traffic originated on the FireBrick and sent down tunnel
local-ip	IPAddr	-	Local IP
localpref	unsignedInt	4294967295	Localpref for route (highest wins)
log	NMTOKEN	Not logging	Log events
log-debug	NMTOKEN	Not logging	Log debug
log-error	NMTOKEN	Log as event	Log errors
mtu	unsignedShort	1500	MTU for wrapped packets
name	NMTOKEN	-	Name
ospf	boolean	true	OSPF announce mode for route
payload-table	(unsignedByte 0-99) routetable	0	Routing table number for payload traffic
peer-ips	List of IPNameRange	Accept from anywhere	peer's IP or range
profile	NMTOKEN	-	Profile name
routes	List of IPPrefix	-	Routes when link up
source	string	-	Source of data, used in automated config management
speed	unsignedInt	no shaping	Egress rate limit used (b/s)
table	(unsignedByte 0-99) routetable	0	Routing table number for IKE traffic and tunnel wrappers
tcp-mss-fix	boolean	true	Adjust MSS option in TCP SYN to fix session MSS
type	ipsec-type	ESP	Encapsulation type
auth-method	ike-authmethod	Not optional	method for authenticating self to peer
blackhole	boolean	false	Blackhole routed traffic when tunnel is not up
certlist	List of NMTOKEN	use any suitable	Certificate(s) to be used to authenticate self
dead-peer-detect	duration	30	check peer is alive at least this often - 0 to inhibit
hw-crypto	boolean	false	Use hardware crypto support (if available)
ike-proposals	List of NMTOKEN	use built-in default proposals	IKE proposal list
ipsec-proposals	List of NMTOKEN	use built-in default proposals	IPsec proposal list
lifetime	duration	1:00:00	max lifetime before renegotiation
local-ID	string	-	Local IKE ID
local-ts	List of IPRange	Allow any	Valid outgoing-source/incoming-destination IPs for tunnelled traffic
mode	ike-mode	Wait	ike connection setup mode
peer-ID	string	-	Peer IKE ID
peer-auth-method	ike-authmethod	Use auth-method	method for authenticating peer
peer-certlist	List of NMTOKEN	accept any suitable	Certificate trust anchor(s) acceptable for authenticating peer
peer-secret	Secret	use secret	shared secret used to authenticate peer
peer-ts	List of IPRange	Allow any	Valid outgoing-destination/incoming-source IPs for tunnelled traffic
peer-ts-from-routes	boolean	false	Send traffic selector based on routing
query-eap-id	boolean	true	Query client for EAP identity
roaming-pool	NMTOKEN	-	IKE roaming IP pool
secret	Secret	-	shared secret used to authenticate self to peer

Table M.74. ike-connection: Elements

Element	Type	Instances	Description
route	ipsec-route	Optional, unlimited	Routes to apply to tunnel when up

M.2.54. ipsec-route: IPsec tunnel routes

Routes for prefixes that are sent to the IPsec tunnel

Table M.75. ipsec-route: Attributes

Attribute	Type	Default	Description
bgp	bgpmode	Auto	BGP announce mode for routes
comment	string	-	Comment
ip	List of IPPrefix	Not optional	One or more network prefixes
localpref	unsignedInt	4294967295	Localpref of network (highest wins)
name	string	-	Name
ospf	boolean	true	OSPF announce mode for route
profile	NMTOKEN	-	Profile name
source	string	-	Source of data, used in automated config management

M.2.55. ike-roaming: IKE roaming IP pools

Pool of IP addresses and associated DNS/NBNS servers for dynamic IP allocation

Table M.76. ike-roaming: Attributes

Attribute	Type	Default	Description
DNS	List of IPAddr	-	List of DNS servers available to clients
NBNS	List of IPAddr	-	List of NetBios name servers available to clients
comment	string	-	Comment
ip	List of IPRange	Not optional	List of IP ranges for allocation to road-warrior clients
name	NMTOKEN	Not optional	Name
nat	boolean	false	NAT incoming IPv4 traffic unless set otherwise in rules
source	string	-	Source of data, used in automated config management

M.2.56. ike-proposal: IKE security proposal

Proposal for establishing the IKE security association

Table M.77. ike-proposal: Attributes

Attribute	Type	Default	Description
DHset	Set of ike-DH	Accept any supported group	Diffie-Hellman group for IKE negotiation
PRFset	Set of ike-PRF	Accept any supported function	Pseudo-Random function for key generation
authset	Set of ipsec-auth-algorithm	Accept any supported algorithm	Integrity check algorithm for IKE messages
cryptset	Set of ipsec-crypt-algorithm	Accept any supported algorithm	Encryption algorithm for IKE messages
name	NMTOKEN	Not optional	Name

M.2.57. ipsec-proposal: IPsec AH/ESP proposal

Proposal for establishing the IPsec AH/ESP keying information

Table M.78. ipsec-proposal: Attributes

Attribute	Type	Default	Description
DHset	Set of ike-DH	Accept any supported group	Diffie-Hellman group for IPsec key negotiation
ESN	Set of ike-ESN	Accept ESN or short SN	Support for extended sequence numbers
authset	Set of ipsec-auth-algorithm	Accept any supported algorithm	Integrity check algorithm for IPsec traffic
cryptset	Set of ipsec-crypt-algorithm	Accept any supported algorithm	Encryption algorithm for IPsec traffic
name	NMTOKEN	Not optional	Name

M.2.58. ipsec-manual: peer configuration

IPsec manually keyed connection settings (not recommended, use IKEv2 and secrets instead)

Table M.79. ipsec-manual: Attributes

Attribute	Type	Default	Description
bgp	bgpmode	Auto	BGP announce mode for routes
comment	string	-	Comment
graph	(token) graphname	-	Graph name
internal-ip	IP46Addr	local-ip	Internal IP for traffic originated on the FireBrick and sent down tunnel
local-ip	IPAddr	-	Local IP
localpref	unsignedInt	4294967295	Localpref for route (highest wins)
log	NMTOKEN	Not logging	Log events
log-debug	NMTOKEN	Not logging	Log debug
log-error	NMTOKEN	Log as event	Log errors
mtu	unsignedShort	1500	MTU for wrapped packets
name	NMTOKEN	-	Name
ospf	boolean	true	OSPF announce mode for route
payload-table	(unsignedByte 0-99) routetable	0	Routing table number for payload traffic
peer-ips	List of IPNameRange	Accept from anywhere	peer's IP or range
profile	NMTOKEN	-	Profile name
routes	List of IPPrefix	-	Routes when link up
source	string	-	Source of data, used in automated config management
speed	unsignedInt	no shaping	Egress rate limit used (b/s)
table	(unsignedByte 0-99) routetable	0	Routing table number for IKE traffic and tunnel wrappers
tcp-mss-fix	boolean	true	Adjust MSS option in TCP SYN to fix session MSS
type	ipsec-type	ESP	Encapsulation type
auth-algorithm	ipsec-auth-algorithm	null	Manual setting for authentication algorithm
auth-key	hexBinary	-	Manual key for authentication
crypt-algorithm	ipsec-crypt-algorithm	null	Manual setting for encryption algorithm
crypt-key	hexBinary	-	Manual key for encryption
local-spi	(unsignedInt 256-4294967295) ipsec-spi	Not optional	Local Security Parameters Index
mode	ipsec-encapsulation	tunnel	Encapsulation mode
outer-spi	(unsignedInt 256-4294967295) ipsec-spi	-	Security Parameters Index for outer header
remote-spi	(unsignedInt 256-4294967295) ipsec-spi	Not optional	Peer Security Parameters Index

Table M.80. ipsec-manual: Elements

Element	Type	Instances	Description
route	ipsec-route	Optional, unlimited	Routes to apply to tunnel when up

M.2.59. ping: Ping/graph definition

Base ping config - additional ping targets set via web API or other means

Table M.81. ping: Attributes

Attribute	Type	Default	Description
comment	string	-	Comment
graph	(token) graphname	Not optional	Graph name
ip	IPNameAddr	Not optional	Far end IP
name	string	-	Name
profile	NMTOKEN	-	Profile name
size	(unsignedInt 0-1472) ping-size	0	Payload size
slow	boolean	Auto	Slow polling
source	string	-	Source of data, used in automated config management
table	(unsignedByte 0-99) routetable	0	Routing table number for sending pings

M.2.60. profile: Control profile

General on/off control profile used in various places in the config.

Table M.82. profile: Attributes

Attribute	Type	Default	Description
and	List of NMTOKEN	-	Active if all specified profiles are active as well as all other tests passing, including 'not'
comment	string	-	Comment
control-switch-users	List of NMTOKEN	Any users	Restrict users that have access to control switch
dongle	List of NMTOKEN	-	3G Dongle state (any of these are ppp up)
expect	boolean	none	Defines state considered 'Good' and shown green on status page
fb105	List of NMTOKEN	-	FB105 tunnel state (any of these active)
initial	boolean	true	Defines state at system startup, or new config, where not known/fixed
interval	duration	1	Time between tests
invert	boolean	-	Invert final result of testing
l2tp	List of NMTOKEN	-	Outgoing L2TP link state (any of these are up)
led	Colour	-	LED colour when active (or not expected state, if expect is set)
log	NMTOKEN	Not logging	Log target
log-debug	NMTOKEN	Not logging	Log additional information
name	NMTOKEN	Not optional	Profile name
not	NMTOKEN	-	Active if specified profile is inactive as well as all other tests passing, including 'and'
or	List of NMTOKEN	-	Active if any of these other profiles are active regardless of other tests (including 'not' or 'and')
ports	Set of port	-	Test passes if any of these physical ports are up
ppp	List of NMTOKEN	-	PPP link state (any of these are up)
recover	duration	1	Time before recover (i.e. how long test has been passing)
route	List of IPAddr	-	Test passes if all specified addresses are routeable
set	switch	-	Manual override. Test settings ignored; Control switches can use and/or/not/invert
source	string	-	Source of data, used in automated config management
table	(unsignedByte 0-99) routetable	-	Routing table for ping/route
timeout	duration	10	Time before timeout (i.e. how long test has been failing)
vrrp	List of NMTOKEN	-	VRRP state (any of these is master)

Table M.83. profile: Elements

Element	Type	Instances	Description
date	profile-date	Optional, unlimited	Test passes if within any date range specified
ping	profile-ping	Optional	Test passes if address is answering pings
time	profile-time	Optional, unlimited	Test passes if within any time range specified

M.2.61. profile-date: Test passes if within any of the time ranges specified

Time range test in profiles

Table M.84. profile-date: Attributes

Attribute	Type	Default	Description
comment	string	-	Comment
source	string	-	Source of data, used in automated config management
start	dateTime	-	Start (YYYY-MM-DDTHH:MM:SS)
stop	dateTime	-	End (YYYY-MM-DDTHH:MM:SS)

M.2.62. profile-time: Test passes if within any of the date/time ranges specified

Time range test in profiles

Table M.85. profile-time: Attributes

Attribute	Type	Default	Description
comment	string	-	Comment
days	Set of day	-	Which days of week apply, default all
source	string	-	Source of data, used in automated config management
start	time	-	Start (HH:MM:SS)
stop	time	-	End (HH:MM:SS)

M.2.63. profile-ping: Test passes if any addresses are pingable

Ping targets

Table M.86. profile-ping: Attributes

Attribute	Type	Default	Description
comment	string	-	Comment
flow	unsignedShort	-	Flow label (IPv6)
gateway	IPAddr	-	Ping via specific gateway (bypasses session tracking if set)
ip	IPAddr	Not optional	Target IP
source	string	-	Source of data, used in automated config management
source-ip	IPAddr	-	Source IP
ttl	unsignedByte	-	Time to live / Hop limit

M.2.64. shaper: Traffic shaper

Settings for a named traffic shaper

Table M.87. shaper: Attributes

Attribute	Type	Default	Description
comment	string	-	Comment
name	(token) graphname	Not optional	Graph name
rx	unsignedLong	-	Rx rate limit/target (b/s)
rx-max	unsignedLong	-	Rx rate limit max
rx-min	unsignedLong	-	Rx rate limit min
rx-min-burst	duration	-	Rx minimum allowed burst time
rx-step	unsignedLong	-	Rx rate reduction per hour
share	boolean	-	If shaper is shared with other devices
source	string	-	Source of data, used in automated config management
tx	unsignedLong	-	Tx rate limit/target (b/s)
tx-max	unsignedLong	-	Tx rate limit max
tx-min	unsignedLong	-	Tx rate limit min
tx-min-burst	duration	-	Tx minimum allowed burst time
tx-step	unsignedLong	-	Tx rate reduction per hour

Table M.88. shaper: Elements

Element	Type	Instances	Description
override	shaper-override	Optional, unlimited	Profile specific variations on main settings

M.2.65. shaper-override: Traffic shaper override based on profile

Settings for a named traffic shaper

Table M.89. shaper-override: Attributes

Attribute	Type	Default	Description
comment	string	-	Comment
profile	NMTOKEN	Not optional	Profile name
rx	unsignedLong	-	Rx rate limit/target (b/s)
rx-max	unsignedLong	-	Rx rate limit max
rx-min	unsignedLong	-	Rx rate limit min
rx-min-burst	duration	-	Rx minimum allowed burst time
rx-step	unsignedLong	-	Rx rate reduction per hour
source	string	-	Source of data, used in automated config management
tx	unsignedLong	-	Tx rate limit/target (b/s)
tx-max	unsignedLong	-	Tx rate limit max
tx-min	unsignedLong	-	Tx rate limit min
tx-min-burst	duration	-	Tx minimum allowed burst time
tx-step	unsignedLong	-	Tx rate reduction per hour

M.2.66. ip-group: IP Group

Named IP group

Table M.90. ip-group: Attributes

Attribute	Type	Default	Description
comment	string	-	Comment
ip	List of IPRange	-	One or more IP ranges or IP/len
name	string	Not optional	Name
source	string	-	Source of data, used in automated config management
users	List of NMTOKEN	-	Include IP of (time limited) logged in web users

M.2.67. route-override: Routing override rules

Routing override rules

Table M.91. route-override: Attributes

Attribute	Type	Default	Description
comment	string	-	Comment
name	string	-	Name
source	string	-	Source of data, used in automated config management
table	(unsignedByte 0-99) routetable	0	Applicable routing table

Table M.92. route-override: Elements

Element	Type	Instances	Description
rule	session-route-rule	Optional, unlimited	Individual rules, first match applies

M.2.68. session-route-rule: Routing override rule

Routing override rule

Table M.93. session-route-rule: Attributes

Attribute	Type	Default	Description
comment	string	-	Comment
cug	List of PortRange	-	Closed user group ID(s)
hash	boolean	-	Use hash of IPs for load sharing
name	string	-	Name
profile	NMTOKEN	-	Profile name
protocol	List of unsignedByte	-	Protocol(s) [1=ICMP, 6=TCP, 17=UDP]
set-gateway	IPAddr	-	New gateway
set-graph	string	-	Graph name for shaping/logging (if not set by rule-set)
set-nat	boolean	-	Changed source IP and port to local for NAT
source	string	-	Source of data, used in automated config management
source-interface	List of NMTOKEN	-	Source interface(s)
source-ip	List of IPNameRange	-	Source IP address range(s)
source-port	List of PortRange	-	Source port(s)
target-interface	List of NMTOKEN	-	Target interface(s)
target-ip	List of IPNameRange	-	Target IP address range(s)
target-port	List of PortRange	-	Target port(s)

Table M.94. session-route-rule: Elements

Element	Type	Instances	Description
share	session-route-share	Optional, unlimited	Load shared actions

M.2.69. session-route-share: Route override load sharing

Route override setting for load sharing

Table M.95. session-route-share: Attributes

Attribute	Type	Default	Description
comment	string	-	Comment
profile	NMTOKEN	-	Profile name
set-gateway	IPAddr	-	New gateway
set-graph	string	-	Graph name for shaping/logging (if not set by rule-set)
set-nat	boolean	-	Changed source IP and port to local for NAT
weight	positiveInteger	1	Weighting of load share

M.2.70. rule-set: Firewall/mapping rule set

Firewalling rule set with entry criteria and default actions

Table M.96. rule-set: Attributes

Attribute	Type	Default	Description
comment	string	-	Comment
cug	List of PortRange	-	Closed user group ID(s)
interface	List of NMTOKEN	-	Source or target interface(s)
ip	List of IPNameRange	-	Source or target IP address range(s)
log	NMTOKEN	Not logging	Log session start
log-end	NMTOKEN	Not logging	Log session end
log-no-match	NMTOKEN	log-start	Log if no match
name	string	-	Name
no-match-action	firewall-action	Not optional	Default if no rule matches
profile	NMTOKEN	-	Profile name
protocol	List of unsignedByte	-	Protocol(s) [1=ICMP, 6=TCP, 17=UDP]
source	string	-	Source of data, used in automated config management
source-interface	List of NMTOKEN	-	Source interface(s)
source-ip	List of IPNameRange	-	Source IP address range(s)
source-port	List of PortRange	-	Source port(s)
startup-delay	duration	1:00	Startup interval to use ignore instead of reject/drop
table	(unsignedByte 0-99) routetable	0	Applicable routing table
target-interface	List of NMTOKEN	-	Target interface(s)
target-ip	List of IPNameRange	-	Target IP address range(s)
target-port	List of PortRange	-	Target port(s)

Table M.97. rule-set: Elements

Element	Type	Instances	Description
ip-group	ip-group	Optional, unlimited	Named IP groups
rule	session-rule	Optional, unlimited	Individual rules, first match applies

M.2.71. session-rule: Firewall rules

Firewall rule

The individual firewall rules are checked in order within the rule-set, and the first match applied. The default action for a rule is continue, so once matched the next rule-set is considered.

Table M.98. session-rule: Attributes

Attribute	Type	Default	Description
action	firewall-action	continue	Action taken on match
comment	string	-	Comment
cug	List of PortRange	-	Closed user group ID(s)
hash	boolean	-	Use hash of IPs for load sharing
interface	List of NMTOKEN	-	Source or target interface(s)
ip	List of IPNameRange	-	Source or target IP address range(s)
log	NMTOKEN	As rule-set	Log session start
log-end	NMTOKEN	As rule-set	Log session end
name	string	-	Name
pcp	boolean	-	If mapped by NAT-PMP / PCP
profile	NMTOKEN	-	Profile name
protocol	List of unsignedByte	-	Protocol(s) [1=ICMP, 6=TCP, 17=UDP]
set-gateway	IPAddr	-	New gateway
set-graph	string	-	Graph name for shaping/logging
set-graph-dynamic	dynamic-graph	-	Dynamically create graph
set-initial-timeout	duration	-	Initial time-out
set-nat	boolean	-	Change source IP and port to local for NAT
set-ongoing-timeout	duration	-	Ongoing time-out
set-reverse-graph	string	-	Graph name for shaping/logging (far side of session)
set-source-ip	IPRange	-	New source IP
set-source-port	unsignedShort	-	New source port
set-table	(unsignedByte 0-99) routetable	-	Set new routing table
set-target-ip	IPRange	-	New target IP
set-target-port	unsignedShort	-	New target port
source	string	-	Source of data, used in automated config management
source-interface	List of NMTOKEN	-	Source interface(s)
source-ip	List of IPNameRange	-	Source IP address range(s)
source-mac	List up to 12 (hexBinary) macprefix	-	Source MAC check if from Ethernet
source-port	List of PortRange	-	Source port(s)
target-interface	List of NMTOKEN	-	Target interface(s)
target-ip	List of IPNameRange	-	Target IP address range(s)
target-port	List of PortRange	-	Target port(s)

Table M.99. session-rule: Elements

Element	Type	Instances	Description
share	session-share	Optional, unlimited	Load shared actions

M.2.72. session-share: Firewall load sharing

Firewall actions for load sharing

Table M.100. session-share: Attributes

Attribute	Type	Default	Description
comment	string	-	Comment
profile	NMTOKEN	-	Profile name
set-gateway	IPAddr	-	New gateway
set-graph	string	-	Graph name for shaping/logging
set-nat	boolean	-	Change source IP and port to local for NAT
set-reverse-graph	string	-	Graph name for shaping/logging (far side of session)
set-source-ip	IPRange	-	New source IP
set-source-port	unsignedShort	-	New source port
set-table	(unsignedByte 0-99) routetable	-	Set new routing table
set-target-ip	IPRange	-	New target IP
set-target-port	unsignedShort	-	New target port
weight	positiveInteger	1	Weighting of load share

M.2.73. voip: Voice over IP config

Voice over IP config

Table M.101. voip: Attributes

Attribute	Type	Default	Description
area-code	string	-	Local area code (without national prefix)
auth-source-ip	IP46Addr	-	Default source address to use when sending authenticated messages
backup-carrier	NMTOKEN	-	Backup carrier to use for external calls
call-progress	boolean	true	Send call progress at 3 seconds
comment	string	-	Comment
country	string	44	Local country code
default-carrier	NMTOKEN	-	Default carrier to use for external calls
domain	string	-	Domain to use for us on outgoing SIP connections
emergency	List of string	112 999	Emergency numbers
emergency-uri	string	Use outbound carrier	SIP URI for emergency calls
international	string	00	International dialling prefix
local-digits	string	23456789	Local numbers start with these digits
local-min-len	unsignedByte	5	Local numbers min length
log	NMTOKEN	Not logging	Log calls
log-cdr	NMTOKEN	Not logged	Log CDR records
log-debug	NMTOKEN	Not logging	Log debug and SIP messages
log-error	NMTOKEN	Log as event	Log errors
log-sip-blf	NMTOKEN	Not logged	SUBSCRIBE, NOTIFY, PUBLISH
log-sip-call	NMTOKEN	Not logged	INVITE, ACK, CANCEL, BYE, REFER
log-sip-other	NMTOKEN	Not logged	OPTIONS, INFO, etc
log-sip-register	NMTOKEN	Not logged	REGISTER
long-headers	boolean	false	Send long SIP headers
max-ring	duration	5:00	Max time limit on call setup
national	string	0	National dialling prefix
pabx	boolean	true	Operate as office PABX
pickup	string	*	Call pickup/steal prefix
radius-call	string	-	Name for RADIUS server config to use call routing
radius-cdr	string	-	Name for RADIUS server config to use for CDRs
radius-challenge	boolean	-	Send RADIUS auth to get challenge response
radius-register	string	-	Name for RADIUS server config to use for registrations
realm	string	FireBrick	Default realm
record-beep	record-beep-option	true	Send beep at start of recording
record-mandatory	boolean	-	Drop call if recording fails
record-server	string	-	Call recording server hostname or address
release	string	1470	CLI release prefix
security-replies	boolean	true	Don't challenge or error reply to unrecognised non local IP request
send-pre-auth	boolean	true	Send Auth header with username before receiving challenge
source	string	-	Source of data, used in automated config management
source-ip	IP46Addr	-	Default source address to use when sending messages
user-agent	string	Version specific	User-Agent to send
withhold	string	141	CLI withhold prefix
wrap-headers	boolean	true	Wrap long SIP header lines

Table M.102. voip: Elements

Element	Type	Instances	Description
carrier	carrier	Optional, up to 250	VoIP carriers
directory	directory	Optional, up to 200	Directory
group	ringgroup	Optional, up to 50	Ring groups
telephone	telephone	Optional, up to 250	VoIP users
tone	tone	Optional, up to 25	Defined tones

M.2.74. carrier: VoIP carrier details

VoIP carrier details

Table M.103. carrier: Attributes

Attribute	Type	Default	Description
allow	List of IPNameRange	Allow from anywhere	List of IP ranges from which invite accepted
comment	string	-	Comment
cui	string	-	Chargeable user identity for call accounting of incoming calls
display-name	string	-	Text name to use
expires	duration	1:00:00	Registration expiry time
extn	string	-	Local number assumed for incoming call, use X for digits from end of called numbers
force-dtmf	boolean	-	Always send DTMF in-band
from	string	-	From SIP address for outbound registration and invites
hold-tone	boolean	true	Send hold tones to carrier
incoming-cli	voip-format	transparent	CLI number format on incoming calls
incoming-format	voip-format	national	Dialled number format on incoming calls
map-404	(unsignedShort 400-699) sip-error	-	Map SIP error 404 to an alternative
max-calls	unsignedInt	-	Maximum simultaneous calls allowed
name	NMTOKEN	Not optional	Carrier name
outgoing-cli	voip-format	national	CLI number format for outgoing calls
outgoing-format	voip-format	national	Dialled number format for outgoing calls
password	Secret	-	Carrier password for outbound registration or inbound authenticated calls
pre-expire	duration	30	Re-register time before expiry
profile	NMTOKEN	-	Profile name
proxy	string	-	Carrier proxy hostname or address for registration and calls
proxy-ip	IPAddr	-	Target proxy IP to use
proxy-port	unsignedShort	-	Target proxy port to use
registrar	string	-	Carrier hostname for registration
send-hold	boolean	true	Pass hold state to carrier
send-p-a-id	boolean	true	Send P-Asserted-Identity
send-pre-auth	boolean	As general config	Send Auth header with username before receiving challenge
send-privacy	boolean	true	Send Privacy (if withheld)
source	string	-	Source of data, used in automated config management
source-ip	IPAddr	-	Source IP to use
table	(unsignedByte 0-99) routetable	0	Routing table number
to	List of string	-	To SIP request address for inbound invites, may be @domain for any at a domain
tone-hold	string	-	Name of tone to generate for hold with no media
tone-progress	string	-	Name of tone to generate for progress with no media
tone-queue	string	-	Name of tone to generate for queue with no media
tone-ring	string	-	Name of tone to generate for ring with no media
tone-wait	string	-	Name of tone to generate for wait with no media
trust-cli	boolean	true	Trust inbound calling line identity
username	string	-	Carrier username for outbound registration or inbound authenticated calls
withhold	string	-	Mark withheld outbound calls using this dial prefix and send CLI in p-asserted-identity or remote-party-id

M.2.75. telephone: VoIP telephone authentication user details

VoIP telephone details

Table M.104. telephone: Attributes

Attribute	Type	Default	Description
allow	List of IPNameRange	Allow from anywhere	List of IP ranges from which registration accepted
allow-pickup	List of string	Allow all if PABX mode	Only allow pickup from these extensions
allow-subscribe	List of string	-	Only allow subscribe (Busy Lamp Field) from these extensions
anon-numeric	boolean	-	Mark anonymous calls just using withhold prefix, and leave display name
area-code	string	-	Local area code (without national prefix) for use from this phone
carrier	NMTOKEN	-	Carrier to use for outbound calls
comment	string	-	Comment
cui	string	-	Chargeable user identity for call accounting
ddi	string	-	Full telephone number (international format starting +)
display-name	string	-	Text name to use
email	string	-	Email address (sent to call recording server)
expires	duration	1:00:00	Registration expiry time
extn	string	-	Local extension number
force-dtmf	boolean	-	Always send DTMF in-band
local-only	boolean	true	Restrict access to registrations from Ethernet subnets only
max-calls	unsignedInt	-	Maximum simultaneous calls allowed
name	NMTOKEN	Not optional	User name (local part of 'from')
outgoing-cli	voip-format	auto	CLI number format passed to telephone
password	Secret	-	Authentication password
profile	NMTOKEN	-	Profile name
realm	string	-	Realm
record	recordoption	-	Automatically record calls
screen	voip-screen	non-rejected	Screen calls
source	string	-	Source of data, used in automated config management
table	(unsignedByte 0-99) routetable	0	Routing table number
uk-cli-text	uknumberformat	Auto	Send display name as UK formatted number
uri	string	-	Direct URI for extn
username	string	-	Authentication username
wrap-up	duration	-	Wrap up time before new call

M.2.76. tone: Tone definitions

Definition of tones used

Table M.105. tone: Attributes

Attribute	Type	Default	Description
name	NMTOKEN	Not optional	Tone name
plan	string	Not optional	Plan for frequency and duration, e.g. 400ms@400Hz-3dB+450Hz-3dB

M.2.77. ringgroup: Ring groups

Ring groups

Table M.106. ringgroup: Attributes

Attribute	Type	Default	Description
allow-pickup	List of string	-	Only allow pickup from these extensions
allow-subscribe	List of string	-	Only allow subscribe (Busy Lamp Field) from these extensions
answer-time	duration	30	Answer caller if ringing this long
carrier	NMTOKEN	-	Carrier to use for external calls
comment	string	-	Comment
cui	string	-	Chargeable user identity for call accounting
ddi	List of string	-	Full telephone number (international format starting +)
display-name	string	-	Text name to use
email	string	-	Email address (sent to call recording server)
extn	List of string	-	Local extension number
initial-time	duration	-	Don't progress to second number until this time
limit	unsignedByte	-	Number allowed to queue
name	NMTOKEN	Not optional	Group name
order	ring-group-order	strict	Order of ring
out-of-hours-group	NMTOKEN	-	Alternative group if this is out of profile (cascades)
out-of-hours-ring	List of string	-	Numbers to ring if out of profile and no out-of-hours-group set
overflow	List of string	-	Numbers to ring when more than one call in queue
overflow-time	duration	30	Include overflow after this time at head of queue
profile	NMTOKEN	-	Profile name
progress-time	duration	6	Time between each target called
redirect	boolean	-	Allow calls to be diverted before ringing
ring	List of string	-	Numbers to ring
ringall-time	duration	-	Switch to ring all after this time at head of queue
screen	voip-screen	non-rejected	Screen calls
source	string	-	Source of data, used in automated config management
type	ring-group-type	all	Type of ring when one call in queue

M.2.78. directory: Directory entry

M.2.79. etun: Ether tunnel

Ether tunnel

Table M.108. etun: Attributes

Attribute	Type	Default	Description
eth-port	NMTOKEN	Not optional	Port group name
ip	IPAddr	Not optional	Far end IP address
log	NMTOKEN	Not logging	Log events
log-debug	NMTOKEN	Not logging	Log debug
log-error	NMTOKEN	Log as event	Log errors
name	string	-	Name
profile	NMTOKEN	-	Profile name
source-ip	IPAddr	-	Our IP address
table	(unsignedByte 0-99) routetable	0	Routing table number

M.2.80. dhcp-relay: DHCP server settings for remote / relayed requests

Settings for DHCP server for relayed connections

Table M.109. dhcp-relay: Attributes

Attribute	Type	Default	Description
allocation-table	(unsignedByte 0-99) routetable	Allocate same as request table	Routing table for allocations - suggest using separate tables for remote DHCP
allow	List of IPNameRange	Allow from anywhere	IPs allowed (e.g. allocated IPs for renewal)
relay	List of IPNameRange	Any relay	Relay server IP(s)
table	(unsignedByte 0-99) routetable	Allow any	Routing table applicable

Table M.110. dhcp-relay: Elements

Element	Type	Instances	Description
dhcp	dhcps	Optional, unlimited	DHCP server settings