FireBrick FB6202 V1.61.010 configuration objects

This appendix defines the object definitions used in the FireBrick FB6202 L2TP configuration. Copyright © 2008-2022 FireBrick Ltd.

Top level config

The top level config element contains all of the FireBrick configuration data.

config: Attributes
AttributeTypeDescriptionDefault
ipIPAddrConfig store IP address
patchintegerInternal use, for s/w updates that change config syntax
serialstringSerial number
timestampdateTimeConfig store time, set automatically when config is saved
versionstringCode version
whostringConfig store username
config: Elements
ElementTypeInstancesDescription
bgpbgpOptional, up to 100BGP config
bgp-filternamedbgpmapOptional, unlimitedMapping and filtering rules for use with BGP peers
blackholeblackholeOptional, unlimitedBlack hole (dropped packets) networks
cqmcqmOptionalConstant Quality Monitoring config
dhcp-relaydhcp-relayOptional, unlimitedDHCP server settings for remote / relayed requests
eapeapOptional, unlimitedUser access control via EAP
ethernetethernetOptional, unlimitedEthernet port settings
interfaceinterfaceOptional, up to 8192Ethernet interface (port-group/vlan) and subnets
ip-groupip-groupOptional, unlimitedNamed IP groups
l2tpl2tpOptionalL2TP settings
loglogOptional, up to 63Log target controls
loopbackloopbackOptional, unlimitedExtra local addresses
networknetworkOptional, unlimitedLocally originated networks
nowhereblackholeOptional, unlimitedDead end (icmp error) networks
portportdefOptional, up to 2Port grouping and naming
ppppppoeOptional, up to 50PPPoE settings
profileprofileOptional, unlimitedControl profiles
routerouteOptional, unlimitedStatic routes
routing-tablesrouting-tableOptional, unlimitedRouting table settings
servicesservicesOptionalGeneral system services
shapershaperOptional, unlimitedNamed traffic shapers
systemsystemOptionalSystem settings
useruserOptional, unlimitedAdmin users

System settings

The system settings are the top level attributes of the system which apply globally.

system: Attributes
AttributeTypeDescriptionDefault
acme-directorystringACME server directoryhttps://acme-v02.api.letsencrypt.org/directory
acme-hostnameList of stringPublic hostname(s) for FireBrick for HTTPS
acme-keygenbooleanAutomatically obtain private keys as neededtrue
acme-profileNMTOKENProfile for when to do ACME renewals
acme-renewpositiveIntegerRenewal before expiry (days)30
acme-source-ipIP46AddrSource IP for ACME renewal
acme-terms-agreed-emailstringPut your email if you agree CA terms
busy-thresholdunsignedIntMax non-idle time before damping eth rx (millisec)200
commentstringComment
contactstringContact name
cpu-int-reservedpercentage 0-100Min percentage of CPU earmarked for int processing95
emailstringContact email
eth-rx-batchunsignedIntMax packets serviced on one port before rechecking other port for idle20
eth-rx-qsizeunsignedIntSize of eth driver Rx queue2000
eth-tx-qsizeunsignedIntSize of eth driver Tx queue2000
introstringHome page text
locationstringLocation description
logNMTOKENLog system eventsWeb/console
log-acmeNMTOKENLog ACME
log-acme-debugNMTOKENLog ACME debug
log-acme-errorNMTOKENLog ACME errors
log-configNMTOKENLog config loadWeb/Flash/console
log-debugNMTOKENLog system debug messagesNot logging
log-diagnosticNMTOKENLog system diagnostic messagesNot logging
log-errorNMTOKENLog system errorsWeb/Flash/console
log-ethNMTOKENLog Ethernet messagesWeb/console
log-eth-debugNMTOKENLog Ethernet debugNot logging
log-eth-errorNMTOKENLog Ethernet errorsWeb/Flash/console
log-ppp-dumpppp-dumpPPP dump format
log-route-nexthopNMTOKENLog next hop changesNot logged
log-statsNMTOKENLog one second statsNot logging
log-supportNMTOKENLog support messages (e.g. stack trace)
Also works as log-panic, which is deprecated
Web logs
log-tcp-debugNMTOKENLog TCP/TLS debug messagesNot logging
login-introstringLogin page text
namestringSystem hostname
pre-reboot-urlstringURL to GET prior to s/w reboot (typically to warn nagios)
sourcestringSource of data, used in automated config management
sw-updateautoloadtypeLoad new software automaticallyfalse
sw-update-delayfb-sw-update-delay 0-30Number of days after release to wait before automatically upgrading0
sw-update-profileNMTOKENProfile name for when to load new s/w
tableroutetable 0-99Routing table number for system functions (s/w updates, etc)0
system: Elements
ElementTypeInstancesDescription
linklinkOptional, unlimitedIntro links

Web links

Links to other web pages

link: Attributes
AttributeTypeDescriptionDefault
commentstringComment
leveluser-levelLogin level requiredGUEST
namestringLink name
profileNMTOKENProfile name
sourcestringSource of data, used in automated config management
textstringLink text
urlstringLink address

Default source IP for services using a given table

Default source IP for traffic originated by this FireBrick

routing-table: Attributes
AttributeTypeDescriptionDefault
namestringName
source-ipIP46AddrDefault source IP for services
tableroutetable 0-99Routing table numberNot optional

Admin users

User names, passwords and abilities for admin users

user: Attributes
AttributeTypeDescriptionDefault
allowList of IPNameRangeRestrict logins to be from specific IP addresses
commentstringComment
configconfig-accessConfig access levelfull
full-namestringFull name
leveluser-levelLogin levelADMIN
local-onlybooleanRestrict access to locally connected Ethernet subnets onlyfalse
nameusername (NMTOKEN)User nameNot optional
otp-seedOTPOTP seed (do not edit by hand)
Also works as otp, which is deprecated
passwordPasswordUser passwordNot optional
profileNMTOKENProfile name
sourcestringSource of data, used in automated config management
tableroutetable 0-99Restrict login to specific routing table0
timeoutdurationLogin idle timeout (zero to stay logged in, not recommended)5:00

User access controlled by EAP

Identities, passwords and access methods for access controlled with EAP

eap: Attributes
AttributeTypeDescriptionDefault
commentstringComment
full-namestringFull name
methodsSet of eap-methodAllowed methodsNot optional
namestringUser or account nameNot optional
passwordSecretUser passwordNot optional
profileNMTOKENProfile name
sourcestringSource of data, used in automated config management
subsystemeap-subsystemAccess controlled subsystemNot optional

Log target controls

Named logging target

log: Attributes
AttributeTypeDescriptionDefault
colourColourColour used in web display
commentstringComment
consolebooleanLog immediately to console
flashbooleanLog immediately to slow flash memory (use with care)
jtagbooleanLog immediately jtag (development use only)
nameNMTOKENLog target nameNot optional
profileNMTOKENProfile name
sourcestringSource of data, used in automated config management
systembooleanInclude system logs on web/cli view
log: Elements
ElementTypeInstancesDescription
emaillog-emailOptional, unlimitedEmail settings
sysloglog-syslogOptional, unlimitedSyslog settings

Syslog logger settings

Logging to a syslog server

log-syslog: Attributes
AttributeTypeDescriptionDefault
commentstringComment
facilitysyslog-facilityFacility settingLOCAL0
portunsignedShortServer port514
profileNMTOKENProfile name
serverIPNameAddrSyslog serverNot optional
severitysyslog-severitySeverity settingNOTICE
sourcestringSource of data, used in automated config management
source-ipIPAddrUse specific source IP
system-logsbooleanInclude generic system log messages as well
tableroutetable 0-99Routing table number for sending syslogs0

Email logger settings

Logging to email

log-email: Attributes
AttributeTypeDescriptionDefault
commentstringComment
delaydurationDelay before sending, since first event to send1:00
fromstringSource email addressOne made up using serial number
hold-offdurationDelay before sending, since last email1:00:00
logNMTOKENLog emailing processNot logging
log-debugNMTOKENLog emailing debugNot logging
log-errorNMTOKENLog emailing errorsNot logging
portunsignedShortServer port25
profileNMTOKENProfile name
retrydurationDelay before sending, since failed send10:00
serverIPNameAddrSmart host to use rather than MX
sourcestringSource of data, used in automated config management
subjectstringSubjectFrom first line being logged
tableroutetable 0-99Routing table number for sending email0
tostringTarget email addressNot optional

System services

System services are various generic services that the system provides, and allows access controls and settings for these to be specified. The service is only active if the corresponding element is included in services, otherwise it is disabled.

services: Elements
ElementTypeInstancesDescription
dnsdns-serviceOptionalDNS service settings
httphttp-serviceOptionalWeb server settings
radiusradius-serviceOptionalRADIUS server/proxy settings
snmpsnmp-serviceOptionalSNMP server settings
telnettelnet-serviceOptionalTelnet server settings
timetime-serviceOptionalSystem time server settings
Also works as ntp, which is deprecated

Web service settings

Web management pages

http-service: Attributes
AttributeTypeDescriptionDefault
access-control-allow-originstringAdditional HTTP header
allowList of IPNameRangeList of IP ranges from which service can be accessedAllow from anywhere
allow-acmebooleanAllow limited port 80 HTTP access for ACME during renewaltrue
certlistList of NMTOKENCertificate(s) to be used for HTTPS sessionsuse any suitable
commentstringComment
content-security-policystringAdditional HTTP header
css-urlstringAdditional CSS for web control pages
https-portunsignedShortService port for HTTPS access443
js-urlstringAdditional javascript for web control pages (logged in/trusted-ip)
local-onlybooleanRestrict access to locally connected Ethernet subnets onlytrue
logNMTOKENLog eventsNot logging
log-clientNMTOKENLog client accessesNot logging
log-client-debugNMTOKENLog client accesses (debug)Not logging
log-debugNMTOKENLog debugNot logging
log-errorNMTOKENLog errorsLog as event
modehttp-modeSecurity moderedirect-to-https-if-acme
portunsignedShortService port for HTTP access80
profileNMTOKENProfile name
referrer-policystringAdditional HTTP headerno-referrer
self-signbooleanCreate self signed certificate for HTTPS when necessarytrue
sourcestringSource of data, used in automated config management
tableroutetable 0-99Routing table number for access to serviceAll
trustedList of IPNameRangeList of allowed IP ranges from which additional access to certain functions is available
x-content-type-optionsstringAdditional HTTP headernosniff
x-frame-optionsstringAdditional HTTP headerSAMEORIGIN
x-xss-protectionstringAdditional HTTP header1; mode=block

DNS service settings

DNS forwarding resolver service

dns-service: Attributes
AttributeTypeDescriptionDefault
allowList of IPNameRangeList of IP ranges from which service can be accessedAllow from anywhere
auto-dhcpbooleanForward and reverse DNS for names in DHCP using this domain
auto-dhcp-newstringName to use for last new DHCP allocation (since last reboot)
cachingbooleanCache relayed DNS entries locallytrue
commentstringComment
domainstringOur domain
fallbackbooleanFor incoming requests, if no server in required table, relay to any DNS availabletrue
fallback-tableroutetable 0-99For incoming requests, if no server in requesting table, relay to any DNS available in this tableDon't fallback
local-onlybooleanRestrict access to locally connected Ethernet subnets onlytrue
logNMTOKENLog eventsNot logging
log-debugNMTOKENLog debugNot logging
log-errorNMTOKENLog errorsLog as event
log-interfaceList of NMTOKENOnly do normal log for specific interface(s)All interfaces
profileNMTOKENProfile name
resolversList of IPAddrRecursive DNS resolvers to use
resolvers-tableroutetable 0-99Routing table for specified resolversas table / 0
sourcestringSource of data, used in automated config management
tableroutetable 0-99Routing table number for access to serviceAll
dns-service: Elements
ElementTypeInstancesDescription
blockdns-blockOptional, unlimitedFixed local DNS host blocks
hostdns-hostOptional, unlimitedFixed local DNS host entries

Fixed local DNS host settings

DNS forwarding resolver service

dns-host: Attributes
AttributeTypeDescriptionDefault
commentstringComment
ipList of IPAddrIP addresses to serve (or our IP if omitted)Our IP
nameList of stringHost names (can use * as a part of a domain)Not optional
profileNMTOKENProfile name
restrict-interfaceList of NMTOKENOnly apply on certain interface(s)
restrict-toList of IPNameRangeList of IP ranges to which this is served
Also works as restrict, which is deprecated
reversebooleanMap reverse DNS as well
sourcestringSource of data, used in automated config management
tableroutetable 0-99Routing table applicableany
ttlunsignedIntTime to live60

Fixed local DNS blocks

DNS forwarding resolver service

dns-block: Attributes
AttributeTypeDescriptionDefault
commentstringComment
nameList of stringHost names (can use * as a part of a domain)Not optional
profileNMTOKENProfile name
restrict-interfaceList of NMTOKENOnly apply on certain interface(s)
restrict-toList of IPNameRangeList of IP ranges to which this is served
Also works as restrict, which is deprecated
sourcestringSource of data, used in automated config management
tableroutetable 0-99Routing table applicableany
ttlunsignedIntTime to live60

RADIUS service definition

RADIUS server and proxy definitions

radius-service: Attributes
AttributeTypeDescriptionDefault
acct-portunsignedShortAccounting UDP port1813
allowList of IPNameRangeAllowed source IP address of RADIUS request
aruba-vlanvlan 0-4095Aruba VLANDon't send
auth-portunsignedShortAuthentication UDP port1812
authenticatorbooleanRequire message authenticator
backup-ipList of IPNameAddrTarget IP(s) or hostname for backup L2TP connection
classstringClass field to send
commentstringComment
control-portunsignedShortControl UDP port (CoA/DM)3799
dummy-ipbooleanSend dummy framed IP responsetrue
erx-egress-policy-namestringJuniper attribute 11
erx-ingress-policy-namestringJuniper attribute 10
erx-tunnel-switch-profilestringJuniper attribute 91
erx-tunnel-virtual-routerstringJuniper attribute 8
erx-virtual-router-namestringJuniper attribute 1 (Also SIN502 Context-Name)
Also works as context-name, which is deprecated
logNMTOKENLog eventsNot logging
log-debugNMTOKENLog debug
log-errorNMTOKENLog errorsLog as event
nsn-conditionalbooleanOnly send NSN settings if username is not same as calling station id
nsn-tunnel-override-usernameunsignedByteAdditional response for GGSN usage
nsn-tunnel-user-auth-methodunsignedIntAdditional response for GGSN usage
orderradiuspriorityPriority tagging of endpoints sent
profileNMTOKENProfile name
rejectbooleanReject request (rarely what you want)
relay-ipList of IPAddrAddress to copy RADIUS request
relay-portunsignedShortAuthentication UDP port for copy RADIUS request1812
relay-tableroutetable 0-99Routing table number for copy of RADIUS request
secretSecretShared secret for RADIUS requests (needed for replies)
sourcestringSource of data, used in automated config management
taggedbooleanTag all attributes that support tagging
target-hostnamestringHostname for L2TP connection
target-ipList of IPNameAddrTarget IP(s) or hostname for primary L2TP connection
target-secretSecretShared secret for L2TP connection
tunnel-assignment-idstringTunnel Assignment ID to send
tunnel-client-returnbooleanReturn tunnel client as radius IP
radius-service: Elements
ElementTypeInstancesDescription
matchradius-service-matchOptional, unlimitedMatching rules for specific responses
serverradius-serverOptional, unlimitedRADIUS server settings

Matching rules for RADIUS service

Rules for matching incoming RADIUS requests

radius-service-match: Attributes
AttributeTypeDescriptionDefault
allowList of IPNameRangeAllowed source IP address of RADIUS request
ap-groupList of stringOne or more patterns to match AP Group
aruba-vlanvlan 0-4095Aruba VLANDon't send
authenticatorbooleanRequire message authenticator
backup-ipList of IPNameAddrTarget IP(s) or hostname for backup L2TP connection
called-station-idList of stringOne or more patterns to match called-station-id
calling-station-idList of stringOne or more patterns to match calling-station-id
classstringClass field to send
commentstringComment
device-typeList of stringOne or more patterns to match Device Type
dummy-ipbooleanSend dummy framed IP responsetrue
erx-egress-policy-namestringJuniper attribute 11
erx-ingress-policy-namestringJuniper attribute 10
erx-tunnel-switch-profilestringJuniper attribute 91
erx-tunnel-virtual-routerstringJuniper attribute 8
erx-virtual-router-namestringJuniper attribute 1 (Also SIN502 Context-Name)
Also works as context-name, which is deprecated
essid-nameList of stringOne or more patterns to match ESSID Name
ipList of IPNameRangeMatch target IP address of RADIUS request
location-idList of stringOne or more patterns to match Location ID
logNMTOKENLog events matching thisNot logging
mac-localbooleanMatch only local or non local MAC addresses if username is a MAC
namestringName
nas-ipList of IPNameRangeMatch NAS-IP address in RADIUS request
nsn-conditionalbooleanOnly send NSN settings if username is not same as calling station id
nsn-tunnel-override-usernameunsignedByteAdditional response for GGSN usage
nsn-tunnel-user-auth-methodunsignedIntAdditional response for GGSN usage
orderradiuspriorityPriority tagging of endpoints sent
profileNMTOKENProfile name
rejectbooleanReject request (rarely what you want)
relay-ipList of IPAddrAddress to copy RADIUS request
relay-portunsignedShortAuthentication UDP port for copy RADIUS request1812
relay-tableroutetable 0-99Routing table number for copy of RADIUS request
secretSecretShared secret for RADIUS requests (needed for replies)
sourcestringSource of data, used in automated config management
stopbooleanStop checking if this matchestrue
taggedbooleanTag all attributes that support tagging
target-hostnamestringHostname for L2TP connection
target-ipList of IPNameAddrTarget IP(s) or hostname for primary L2TP connection
target-secretSecretShared secret for L2TP connection
tunnel-assignment-idstringTunnel Assignment ID to send
tunnel-client-returnbooleanReturn tunnel client as radius IP
usernameList of stringOne or more patterns to match username

RADIUS server settings

Server settings for outgoing RADIUS

radius-server: Attributes
AttributeTypeDescriptionDefault
allowList of IPNameRangeAllowed control request source IPs instead of host checkMust match host
commentstringComment
hostList of IPNameAddrOne or more hostname/IPs of RADIUS serversNot optional
max-timeoutdurationMaximum final timeout10
min-timeoutdurationMinimum final timeout2
namestringName
portunsignedShortUDP portFrom services/radius settings
profileNMTOKENProfile name
queueunsignedIntConcurrent requests over all of these servers (per type)
scale-timeoutunsignedByteTimeout scaling factor2
secretSecretShared secret for RADIUS requestsNot optional
sourcestringSource of data, used in automated config management
source-ipIPAddrFix source IP
tableroutetable 0-99Routing table number
typeSet of radiustypeServer typeAll

Telnet service settings

Telnet control interface

telnet-service: Attributes
AttributeTypeDescriptionDefault
allowList of IPNameRangeList of IP ranges from which service can be accessedAllow from anywhere
commentstringComment
local-onlybooleanRestrict access to locally connected Ethernet subnets onlytrue
logNMTOKENLog eventsNot logging
log-debugNMTOKENLog debugNot logging
log-errorNMTOKENLog errorsLog as event
portunsignedShortService port23
profileNMTOKENProfile name
promptstringPromptsystem name
sourcestringSource of data, used in automated config management
tableroutetable 0-99Routing table number for access to serviceAll

SNMP service settings

The SNMP service has general service settings and also specific attributes for SNMP such as community

snmp-service: Attributes
AttributeTypeDescriptionDefault
allowList of IPNameRangeList of IP ranges from which service can be accessedAllow from anywhere
commentstringComment
communitySecretCommunity stringpublic
local-onlybooleanRestrict access to locally connected Ethernet subnets onlyfalse
logNMTOKENLog eventsNot logging
log-debugNMTOKENLog debugNot logging
log-errorNMTOKENLog errorsLog as event
portunsignedShortService port161
profileNMTOKENProfile name
sourcestringSource of data, used in automated config management
tableroutetable 0-99Routing table number for access to serviceAll

System time server settings

The time settings define which NTP servers to synchronize the system clock from, and provide controls for daylight saving (summer time). The defaults are those that apply to the EU

time-service: Attributes
AttributeTypeDescriptionDefault
allowList of IPNameRangeList of IP ranges from which service can be accessedAllow from anywhere
commentstringComment
legacy-timeserverbooleanServe legacy TIME service on UDP port 37true
local-onlybooleanRestrict access to locally connected Ethernet subnets onlytrue
logNMTOKENLog eventsNot logging
log-debugNMTOKENLog debugNot logging
log-errorNMTOKENLog errorsLog as event
maxpolldurationNTP maximum poll rate1024
minpolldurationNTP minimum poll rate64
ntp-control-allowList of IPNameRangeList of IP ranges from which control (ntpq) requests can be accessedAllow from anywhere
ntp-control-local-onlybooleanRestrict control (ntpq) access to locally connected Ethernet subnets onlytrue
ntp-control-tableroutetable 0-99Routing table number for incoming control (ntpq) requestsAll
ntp-peer-tableroutetable 0-99Routing table number used for outgoing ntp peer requests0
ntp-serversList of IPNameAddrList of NTP time servers (IP or hostname) from which time may be synchronized and served by ntp (Null list disables NTP)
Also works as ntpserver, which is deprecated
ntp.firebrick.ltd.uk
profileNMTOKENProfile name
sourcestringSource of data, used in automated config management
tableroutetable 0-99Routing table number for access to serviceAll
tz1-namestringTimezone 1 nameGMT
tz1-offsetdurationTimezone 1 offset from UTC0
tz12-datedatenum 1-31Timezone 1 to 2 earliest date in month25
tz12-daydayTimezone 1 to 2 day of week of changeSun
tz12-monthmonthTimezone 1 to 2 monthMar
tz12-timetimeTimezone 1 to 2 local time of change01:00:00
tz2-namestringTimezone 2 nameBST
tz2-offsetdurationTimezone 2 offset from UTC1:00:00
tz21-datedatenum 1-31Timezone 2 to 1 earliest date in month25
tz21-daydayTimezone 2 to 1 day of week of changeSun
tz21-monthmonthTimezone 2 to 1 monthOct
tz21-timetimeTimezone 2 to 1 local time of change02:00:00

Physical port controls

Physical port attributes

ethernet: Attributes
AttributeTypeDescriptionDefault
autonegbooleanPerform link auto-negotiationtrue
clockingLinkClockGigabit clock settingprefer-slave
crossoverCrossoverPort crossover configurationauto
flowLinkFlowFlow control settingnone
greenLinkLED-gGreen LED settingLink/Activity
lacpbooleanSend LACP packetsAuto
lldpbooleanSend LLDP packetstrue
optimisebooleanenable PHY optimisationstrue
portportPhysical portNot optional
power-savingLinkPowerenable PHY power savingfull
profileNMTOKENProfile name
send-faultLinkFaultSend fault status
yellowLinkLED-yYellow LED settingTx

Port grouping and naming

Port grouping and naming

portdef: Attributes
AttributeTypeDescriptionDefault
commentstringComment
nameNMTOKENNameNot optional
portsSet of portPhysical port(s)Not optional
sourcestringSource of data, used in automated config management
trunktrunk-modeTrunk portsl2-hash

Port-group/VLAN interface settings

The interface definition relates to a specific physical port group and VLAN. It includes subnets and VRRP that apply to that interface.

interface: Attributes
AttributeTypeDescriptionDefault
allow-6in4booleanHandle 6in4 (protocol 41) packetsfalse
bgpbgpmodeBGP announce mode for routesAuto
commentstringComment
cugcug 1-32767Closed user group ID
cug-restrictbooleanClosed user group restricted traffic (only to/from same CUG ID)
dhcp-relayIP4AddrRelay any unresolved requests to external server
fast-l2tpbooleanSet on interfaces that are mainly terminating L2TP traffic
graphgraphname (token)Graph name
linkNMTOKENInterface to which this is linked at layer 2
logNMTOKENLog eventsNot logging
log-debugNMTOKENLog debugNot logging
log-dhcpNMTOKENLog DHCP events not related to a poolNot logging
log-errorNMTOKENLog errorsLog as event
mtumtu 576-2000MTU for this interface1500
nameNMTOKENName
pdbooleanAvailable for IPv6 prefix delegationIf not WAN and not ra-client and no ra subnets
pingIPAddrPing address to add loss/latency to graph for interface
portNMTOKENPort group nameNot optional
profileNMTOKENProfile name
ra-clientbooleanAccept IPv6 RA and create auto config subnets and routesIf WAN set
restrict-macbooleanUse only one MAC on this interface
sourcestringSource of data, used in automated config management
source-filtersfoptionSource filter traffic received via this interface
source-filter-tableroutetable 0-99Routing table to use for source filtering checksinterface table
tableroutetable 0-99Routing table applicable0
vlanvlan 0-4095VLAN ID (0=untagged)0
wanbooleanDo not consider this interface 'local' for 'local-only' checks
interface: Elements
ElementTypeInstancesDescription
dhcpdhcpsOptional, unlimitedDHCP server settings
subnetsubnetOptional, unlimitedIP subnet on the interface
vrrpvrrpOptional, unlimitedVRRP settings

Subnet settings

Subnet settings define the IP address(es) of the FireBrick, and also allow default routes to be set.

subnet: Attributes
AttributeTypeDescriptionDefault
accept-dnsbooleanAccept DNS servers specified by DHCPtrue
arp-timeoutunsignedShortMax lifetime on ARP and ND60
bgpbgpmodeBGP announce mode for routesAuto
broadcastbooleanIf broadcast address allowedfalse
commentstringComment
dhcp-classstringDHCP client option 60 (Class)FB-type
dhcp-client-idstringDHCP client option 61 (Client-Identifier)MAC
gatewayList of IPAddrOne or more gateways to install
ipList of IPSubnetOne or more IP/lenAutomatic by DHCP
localprefunsignedIntLocalpref for subnet (highest wins)4294967295
mtumtu 576-2000MTU for subnetAs interface
namestringName
profileNMTOKENProfile name
proxy-arpbooleanAnswer ARP/ND by proxy if we have routingfalse
raramodeIf to announce IPv6 RA for this subnetfalse
ra-autonomousbooleanRA 'A' (autonomous) flagIf managed not set
ra-dnsList of IP6AddrList of recursive DNS servers in route announcementsOur IP
ra-dnsslList of stringList of DNS search domains in route announcements
ra-managedbooleanRA 'M' (managed) flag
ra-maxra-max 4-1800Max RA send interval600
ra-minra-min 3-1350Min RA send intervalra-max/3
ra-mtuunsignedShortMTU to use on RAAs subnet
ra-onlinkbooleanRA 'L' (onlink) flagtrue
ra-otherbooleanRA 'O' (other) flag
ra-profileNMTOKENProfile, if inactive then forces low priority RA
simple-dhcpv6booleanSimple DHCPv6 (fixed addresses)
sourcestringSource of data, used in automated config management
testIPAddrTest link state using ARP/ND for this IP
ttlunsignedByteTTL for originating traffic via subnet64

VRRP settings

VRRP settings provide virtual router redundancy for the FireBrick. Profile inactive does not disable vrrp but forces vrrp low priority.

vrrp: Attributes
AttributeTypeDescriptionDefault
answer-pingbooleanWhether to answer PING to VRRP IPs when mastertrue
commentstringComment
delayunsignedIntDelay after routing established before priority returns to normal60
intervalunsignedShortTransit interval (centiseconds)100
ipList of IPAddrOne or more IP addresses to announceNot optional
logNMTOKENLog eventsNot logging
log-errorNMTOKENLog errorslog as event
low-priorityunsignedByteLower priority applicable until routing established1
nameNMTOKENName
preemptbooleanWhether pre-empt allowedtrue
priorityunsignedByteNormal priority100
profileNMTOKENProfile name
sourcestringSource of data, used in automated config management
use-vmacbooleanWhether to use the special VMAC or use normal MACtrue
version3booleanUse only version 3v2 for IPv4, v3 for IPv6
vridunsignedByteVRID42

DHCP server settings

Settings for DHCP server

dhcps: Attributes
AttributeTypeDescriptionDefault
bootIP4AddrNext/boot server
boot-filestringBoot filename
broadcastbooleanBroadcast replies even if not requested
circuitstringAgent info circuit match
classstringVendor class match
client-namestringClient name match
commentstringComment
dnsList of IP4AddrDNS resolversOur IP
domainstringDNS domainFrom system settings
domain-searchstringDNS domain search list (list will be truncated to fit one attribute)
forcebooleanSend all options even if not requested
gatewayIP4SubnetGatewayOur IP
ipList of IP4RangeAddress pool0.0.0.0/0
leasedurationLease length2:00:00
logNMTOKENLog eventsNot logging
log-declineNMTOKENLog events (declined)Not logging
log-moveNMTOKENLog events (moved)Not logging
log-newNMTOKENLog events (new)Not logging
log-releaseNMTOKENLog events (released)Not logging
log-renewNMTOKENLog events (renewed)Not logging
log-reuseNMTOKENLog events (reused)Not logging
macList of up to 12 macprefix (hexBinary)Partial or full client hardware (MAC) addresses (or client-id MAC if specified)
mac-localbooleanMatch only local or non local MAC addresses
namestringName
ntpList of IP4AddrNTP serverOur IP
profileNMTOKENProfile name
sourcestringSource of data, used in automated config management
syslogList of IP4AddrSyslog server
timeList of IP4AddrTime serverOur IP
dhcps: Elements
ElementTypeInstancesDescription
senddhcp-attr-hexOptional, unlimitedAdditional attributes to send (hex)
send-ipdhcp-attr-ipOptional, unlimitedAdditional attributes to send (IP)
send-numberdhcp-attr-numberOptional, unlimitedAdditional attributes to send (numeric)
send-stringdhcp-attr-stringOptional, unlimitedAdditional attributes to send (string)

DHCP server attributes (hex)

Additional DHCP server attributes (hex)

dhcp-attr-hex: Attributes
AttributeTypeDescriptionDefault
commentstringComment
forcebooleanSend even if not requested
idunsignedByteAttribute type code/tagNot optional
namestringName
valuehexBinaryValueNot optional
vendorbooleanAdd as vendor specific option (under option 43)

DHCP server attributes (string)

Additional DHCP server attributes (string)

dhcp-attr-string: Attributes
AttributeTypeDescriptionDefault
commentstringComment
forcebooleanSend even if not requested
idunsignedByteAttribute type code/tagNot optional
namestringName
valuestringValueNot optional
vendorbooleanAdd as vendor specific option (under option 43)

DHCP server attributes (numeric)

Additional DHCP server attributes (numeric)

dhcp-attr-number: Attributes
AttributeTypeDescriptionDefault
commentstringComment
forcebooleanSend even if not requested
idunsignedByteAttribute type code/tagNot optional
namestringName
valueunsignedIntValueNot optional
vendorbooleanAdd as vendor specific option (under option 43)

DHCP server attributes (IP)

Additional DHCP server attributes (IP)

dhcp-attr-ip: Attributes
AttributeTypeDescriptionDefault
commentstringComment
forcebooleanSend even if not requested
idunsignedByteAttribute type code/tagNot optional
namestringName
valueIP4AddrValueNot optional
vendorbooleanAdd as vendor specific option (under option 43)

PPPoE settings

PPPoE endpoint settings

pppoe: Attributes
AttributeTypeDescriptionDefault
ac-namestringAccess concentrator nameAny a/c name as client, else same as 'name'
accept-dnsbooleanAccept DNS servers specified by far endtrue
auto-percentunsignedByteTry to set egress based on connect message, percentageN/A
bgpbgpmodeBGP announce mode for routesAuto
calling-idpppoe-callingAdd mac and/or vlan after prefix
calling-prefixstringPrefix on calling number (BRAS mode)
commentstringComment
cugcug 1-32767Closed user group ID
cug-restrictbooleanClosed user group restricted traffic (only to/from same CUG ID)
ethportPhysical port connected to modem (for port reset)
fast-retrybooleanAggressive re-connect
graphgraphname (token)Graph name
ip-over-lcpbooleanSends all IP packets as LCPauto
lcp-rateunsignedByteLCP interval (seconds)10
lcp-timeoutunsignedByteLCP timeout (seconds)61
localIP4AddrLocal IPv4 address
localprefunsignedIntLocalpref for route (highest wins)4294967295
logNMTOKENLog eventsNot logging
log-debugNMTOKENLog debugNot logging
log-errorNMTOKENLog as eventsNot logging
modepppoe-modePPPoE server/client modeclient
mtumtu 576-2000MTU for link1492
nameNMTOKENName
passwordSecretUser password
portNMTOKENPort group name
profileNMTOKENProfile name
remoteIP4AddrRemote IPv4 address
rfc4638booleanSend RFC4638 PPP-Max-PayloadIf over 1492 MTU
routesList of IPPrefixRoutes when link upDefault gateway
servicestringService nameAny service
sourcestringSource of data, used in automated config management
speedunsignedIntDefault egress rate limit (b/s)
tableroutetable 0-99Routing table number for payload
tcp-mss-fixbooleanAdjust MSS option in TCP SYN to fix session MSStrue
usernamestringUser name
vlanvlan 0-4095VLAN ID (0=untagged)0
pppoe: Elements
ElementTypeInstancesDescription
routeppp-routeOptional, unlimitedRoutes to apply when ppp link is up

PPP routes

Routes that apply when link is up

ppp-route: Attributes
AttributeTypeDescriptionDefault
bgpbgpmodeBGP announce mode for routesAuto
commentstringComment
ipList of IPPrefixOne or more network prefixesNot optional
localprefunsignedIntLocalpref of network (highest wins)4294967295
namestringName
profileNMTOKENProfile name
sourcestringSource of data, used in automated config management

Static routes

Static routes define prefixes which are permanently in the routing table, and whether these should be announced by routing protocols or not.

route: Attributes
AttributeTypeDescriptionDefault
as-pathList of up to 10 unsignedIntCustom AS path as if network received
bgpbgpmodeBGP announce mode for routesAuto
commentstringComment
gatewayList of IPAddrOne or more target gateway IPsNot optional
graphgraphname (token)Graph name
ipList of IPPrefixOne or more network prefixesNot optional
localprefunsignedIntLocalpref of network (highest wins)4294967295
namestringName
profileNMTOKENProfile name
sourcestringSource of data, used in automated config management
speedunsignedIntEgress rate limit (b/s)
tableroutetable 0-99Routing table number0
tagList of CommunityList of community tags

Locally originated networks

Network blocks that are announced but not actually added to internal routes - note that blackhole and nowhere objects can also announce but not add routing.

network: Attributes
AttributeTypeDescriptionDefault
as-pathList of up to 10 unsignedIntCustom AS path as if network received
bgpbgpmodeBGP announce mode for routestrue
commentstringComment
ipList of IPPrefixOne or more network prefixesNot optional
localprefunsignedIntLocalpref of network (highest wins)4294967295
namestringName
profileNMTOKENProfile name
sourcestringSource of data, used in automated config management
tableroutetable 0-99Routing table number0
tagList of CommunityList of community tags

Dead end networks

Networks that go nowhere

blackhole: Attributes
AttributeTypeDescriptionDefault
as-pathList of up to 10 unsignedIntCustom AS path as if network received
bgpbgpmodeBGP announce mode for routesfalse
commentstringComment
ipList of IPPrefixOne or more network prefixesNot optional
localprefunsignedIntLocalpref of network (highest wins)4294967295
namestringName
no-fibbooleanRoute not in forwarding, only for EBGP
profileNMTOKENProfile name
sourcestringSource of data, used in automated config management
tableroutetable 0-99Routing table number0
tagList of CommunityList of community tags

Locally originated networks

Loopback addresses define local IP addresses

loopback: Attributes
AttributeTypeDescriptionDefault
as-pathList of up to 10 unsignedIntCustom AS path as if network received
bgpbgpmodeBGP announce mode for routesAuto
commentstringComment
ipList of IPAddrOne or more local network addressesNot optional
localprefunsignedIntLocalpref of network (highest wins)4294967295
namestringName
profileNMTOKENProfile name
sourcestringSource of data, used in automated config management
tableroutetable 0-99Routing table number0
tagList of CommunityList of community tags

Mapping and filtering rules of BGP prefixes

This defines a set of named rules for mapping and filtering of prefixes to/from a BGP peer.

namedbgpmap: Attributes
AttributeTypeDescriptionDefault
commentstringComment
nameNMTOKENNameNot optional
sourcestringSource of data, used in automated config management
namedbgpmap: Elements
ElementTypeInstancesDescription
matchbgpruleOptional, unlimitedList rules, in order of checking

Individual mapping/filtering rule

An individual rule for BGP mapping/filtering

bgprule: Attributes
AttributeTypeDescriptionDefault
as-originunsignedIntAS that must be last in path to match
as-presentunsignedIntAS that must be present in path to match
commentstringComment
communityCommunityCommunity that must be present to match
detagList of CommunityList of community tags to remove
dropbooleanDo not import/export this prefix
localprefunsignedIntSet localpref (highest wins)
medunsignedIntSet MED
namestringName
no-communityCommunityCommunity that must not be present to match
padunsignedBytePad (prefix stuff) our AS on export by this many, can be zero to not send our AS
prefixList of IPFilterPrefixes that this rule applies to
sourcestringSource of data, used in automated config management
tagList of CommunityList of community tags to add

Overall BGP settings

The BGP element defines general BGP settings and a list of peer definitions for the individual BGP peers.

bgp: Attributes
AttributeTypeDescriptionDefault
asunsignedIntOur AS
blackhole-communityCommunityCommunity tag to mark black hole routes
cluster-idIP4AddrOur cluster ID
commentstringComment
dead-end-communityCommunityCommunity tag to mark dead end routes
greyhole-communityCommunityCommunity tag to mark black hole routes with no-fib
idIP4AddrOur router ID
logNMTOKENLog eventsNot logging
namestringName
sourcestringSource of data, used in automated config management
tableroutetable 0-99Routing table number0
bgp: Elements
ElementTypeInstancesDescription
peerbgppeerOptional, up to 500List of peers/neighbours

BGP peer definitions

The peer definition specifies the attributes of an individual peer. Multiple IP addresses can be specified, typically for IPv4 and IPv6 addresses for the same peer, but this can be used for a group of similar peers.

bgppeer: Attributes
AttributeTypeDescriptionDefault
add-own-asbooleanAdd our AS on exported routes
allow-exportbooleanIgnore no-export community and export anywaytrue for customer
allow-only-their-asbooleanOnly accept routes that are solely the peers AS
allow-own-asbooleanAllow our AS inbound
asunsignedIntPeer AS
blackhole-communityCommunityEgress community tag to mark black hole routesNot announced on EBGP, our blackhole-community if IBGP
capability-as4booleanIf supporting AS4true
capability-graceful-restartbooleanIf supporting Graceful Restarttrue
capability-mpe-ipv4booleanIf supporting MPE for IPv4true
capability-mpe-ipv6booleanIf supporting MPE for IPv6true
capability-route-refreshbooleanIf supporting Route Refreshtrue
clean-shutdown-waitdurationSend peers low priority and delay on shutdown
clean-startup-waitdurationDon't announce routes within this time of reboot
commentstringComment
drop-defaultbooleanIgnore default route receivedfalse
export-filtersList of NMTOKENNamed export filters to apply
export-medunsignedIntSet MED on exported routes (unless export filter sets it)
holdtimeunsignedIntHold time30
ignore-bad-optional-partialbooleanIgnore routes with a recognised badly formed optional that is flagged partialtrue
import-filtersList of NMTOKENNamed import filters to apply
import-localprefunsignedIntSet localpref on imported routes (unless import filter sets it)
import-tagList of CommunityList of community tags to add in addition to any import filters
in-softbooleanMark received routes as soft
ipList of IPAddrOne or more IPs of neighbours (omit to allow incoming)
log-debugNMTOKENLog debugNot logging
max-prefixunsignedIntLimit prefixes (IPv4+IPv6)
md5SecretMD5 signing secret
namestringName
next-hop-selfbooleanForce us as next hop outboundfalse
no-fibbooleanDon't include received routes in packet forwarding
padunsignedBytePad (prefix stuff) our AS on export by this many
profileNMTOKENProfile name
reduce-recursionbooleanOverride incoming next hop if not local subnetfalse
same-ip-typebooleanOnly accept/send IPv4 routes to IPv4 peers and IPv6 routes to IPv6 peerstrue
send-defaultbooleanSend a default route to this peerfalse
send-no-routesbooleanDon't send any normal routesfalse
sourcestringSource of data, used in automated config management
timer-idleunsignedIntIdle time after error60
timer-openwaitunsignedIntTime to wait for OPEN on connection10
timer-retryunsignedIntTime to retry the neighbour10
ttl-securitybyteEnable RFC5082 TTL security (if +ve, 1 to 127), i.e. 1 for adjacent router. If -ve (-1 to -128) set forced sending TTL, i.e. -1 for TTL of 1 sending, and not checking.
typepeertypeType of neighbour (affects some defaults)normal
use-vrrp-as-selfbooleanUse VRRP address as self if possibletrue if customer/transit type
bgppeer: Elements
ElementTypeInstancesDescription
exportbgpmapOptionalMapping and filtering rules of announcing prefixes to peer
importbgpmapOptionalMapping and filtering rules of accepting prefixes from peer

Mapping and filtering rules of BGP prefixes

This defines the rules for mapping and filtering of prefixes to/from a BGP peer.

bgpmap: Attributes
AttributeTypeDescriptionDefault
commentstringComment
detagList of CommunityList of community tags to remove
dropbooleanDo not import/export this prefix
localprefunsignedIntSet localpref (highest wins)
medunsignedIntSet MED
prefixList of IPFilterDrop all that are not in this prefix list
sourcestringSource of data, used in automated config management
tagList of CommunityList of community tags to add
bgpmap: Elements
ElementTypeInstancesDescription
matchbgpruleOptional, unlimitedList rules, in order of checking

Constant Quality Monitoring settings

Constant quality monitoring (graphs and data) have a number of settings. Most of the graphing settings can be overridden when a graph is collected so these define the defaults in many cases.

cqm: Attributes
AttributeTypeDescriptionDefault
auto-refresh-listbooleanAuto refresh graph list pages (for trusted IPs)true
aveColourColour for average latency#08f
axisColourAxis colourblack
backgroundColourBackground colourwhite
bottomunsignedBytePixels space at bottom of graph11
dateformatstringDate format%Y-%m-%d
dayformatstringDay format%a
failColourColour for failed (dropped) secondsred
fail-levelunsignedIntFail level not expected on low usage1
fail-level1unsignedByteLoss level 13
fail-level2unsignedByteLoss level 250
fail-scoreunsignedByteScore for fail and low usage200
fail-score1unsignedByteScore for on/above level 1100
fail-score2unsignedByteScore for on/above level 2200
fail-usageunsignedIntUsage below which fail is not expected128000
fblogoColourColour for logo#bd1220
graticuleColourGraticule colourgrey
headingstringHeading of graph
hourformatstringHour format%H
keyunsignedBytePixels space for key90
label-avestringLabel for average latencyAve
label-dampstringLabel for % shaper dampingDamp%
label-failstringLabel for seconds (%) failed%Fail
label-latencystringLabel for latencyLatency
label-maxstringLabel for maximum latencyMax
label-minstringLabel for minimum latencyMin
label-offstringLabel for off line secondsOff
label-periodstringLabel for periodPeriod
label-pollstringLabel for pollsPolls
label-rejstringLabel for rejected seconds%Reject
label-rxstringLabel for Rx traffic levelRx
label-scorestringLabel for scoreScore
label-sentstringLabel for seconds polledSent
label-shaperstringLabel for shaperShaper
label-timestringLabel for timeTime
label-trafficstringLabel for traffic levelTraffic (bit/s)
label-txstringLabel for Tx traffic levelTx
latency-levelunsignedIntLatency level not expected on low usage100000000
latency-level1unsignedIntLatency level 1 (ns)100000000
latency-level2unsignedIntLatency level 2 (ns)500000000
latency-scoreunsignedByteScore for high latency and low usage200
latency-score1unsignedByteScore for on/above level 110
latency-score2unsignedByteScore for on/above level 220
latency-usageunsignedIntUsage below which latency is not expected128000
leftunsignedBytePixels space left of main graph0
logNMTOKENLog eventsNot logging
marker-widthstringStroke width for marker (+) on tx/rx (e.g. 4)
maxColourColour for maximum latencygreen
minColourColour for minimum latency#008
ms-maxpositiveIntegerms max height500
offColourColour for off line seconds#c8f
outsideColourColour for outer bordertransparent
rejColourColour for off line seconds#f8c
rightunsignedBytePixels space right of main graph50
rxColourColour for Rx traffic level#800
secretSecretSecret for SHA1 coded URLs
sentColourColour for polled seconds#ff8
share-interfaceNMTOKENInterface on which to broadcast data for shaper sharing
share-secretSecretSecret to validate shaper sharing
stroke-widthstringStroke line for tx/rx4 if no marker
subheadingstringSubheading of graph
svg-cssstringURL for SVG CSS instead of local style settings
svg-titlebooleanInclude mouseover title text on svg
textColourColour for textblack
text1stringText line 1
text2stringText line 2
text3stringText line 3
text4stringText line 4
timeformatstringTime format%Y-%m-%d %H:%M:%S
topunsignedBytePixels space at top of graph4
txColourColour for Tx traffic level#080

L2TP settings

L2TP settings for incoming L2TP connections

l2tp: Attributes
AttributeTypeDescriptionDefault
accounting-intervaldurationPeriodic interim accounting interval1:00:00
send-acct-delaybooleanSend Acct-Delay as well as Event-Timestamp on accounting
l2tp: Elements
ElementTypeInstancesDescription
incomingl2tp-incomingOptional, unlimitedIncoming L2TP connections

L2TP settings for incoming L2TP connections

L2TP tunnel settings for incoming L2TP connections

l2tp-incoming: Attributes
AttributeTypeDescriptionDefault
advise-speedunsignedIntAdvise clients of their egress rate (may be overridden by RADIUS) (b/s) - This is a FireBrick specific mechanism
allowList of IPNameRangeList of IP ranges from which connects can be made
bgpbgpmodeBGP announce mode for routesAuto
commentstringComment
dampingbooleanApply damping to sessions if limiting on shaperfalse
dhcpv6dnsList of IP6AddrList of IPv6 DNS servers
dos-limitunsignedIntPer second per session tx packet drop limit for DOS protection10000
fail-lockoutunsignedByteInterval kept in failed state60
graphstringGraph name
hdlcbooleanSend HDLC header (FF03) on all PPP framestrue
hello-intervalunsignedByteInterval between HELLO messages60
icmp-pppbooleanUse PPP endpoint for ICMPfalse
ipv6epIP4AddrLocal end IPv4 for IPv6 tunnels
lcp-data-lenunsignedByteLCP data field length
lcp-mru-fixbooleanRestart LCP if RAS negotiated MRU is too highfalse
lcp-rateunsignedByteLCP interval (seconds)1
lcp-timeoutunsignedByteLCP timeout (seconds)10
local-hostnamestringHostname quoted on replySystem name
local-ppp-ipIP4AddrLocal end PPP IPv4
Also works as pppip, which is deprecated
logNMTOKENLog eventsNot logging
log-debugNMTOKENLog debugNot logging
log-errorNMTOKENLog errorsLog as event
mtumtu 576-2000Default MTU for sessions in this tunnel
namestringName
open-timeoutunsignedByteInterval before OPEN considered failed60
payload-tableroutetable 0-99Routing table number for payload traffic0
ppp-final-timeoutunsignedBytePPP total timeout (seconds)60
ppp-init-timeoutunsignedBytePPP initial timeout (seconds)10
pppdns1IP4AddrPPP DNS1 IPv4 default
pppdns2IP4AddrPPP DNS2 IPv4 default
profileNMTOKENProfile name
radiusstringName for RADIUS server config to use
radius-nas-ipradius-nasPass remote (LAC) or local (LNS) as RADIUS NAS IP / port
Also works as relay-nas-ip, which is deprecated
lac
receive-windowunsignedShortReceive window to advise on connectionNot sent
remote-hostnamestringHostname expected on connection
require-platformbooleanAll sessions require a platform RADIUS firstfalse
require-radius-acctbooleanClose session if cannot do RADIUS accounting
retry-timeoutunsignedByteInterval to retry sending control messages before fail60
secretSecretShared secret (for far end to check)
session-timeoutdurationDefault session timeout
shutdownbooleanRefuse all new sessions or tunnelsfalse
sourcestringSource of data, used in automated config management
source-ipIPAddrIP of our end for relayed (on same table)
Also works as relay-local-ip, which is deprecated
speedunsignedIntDefault egress rate limit (b/s)
tableroutetable 0-99Routing table number for L2TP sessionAny
tcp-mss-fixbooleanAdjust MSS option in TCP SYN to fix session MSSfalse
l2tp-incoming: Elements
ElementTypeInstancesDescription
matchl2tp-relayOptional, unlimitedRules for relaying connections and local authentication

Relay and local authentication rules for L2TP

Rules for relaying L2TP or local authentication

l2tp-relay: Attributes
AttributeTypeDescriptionDefault
called-station-idList of stringOne or more patterns to match called-station-id
calling-station-idList of stringOne or more patterns to match calling-station-id
commentstringComment
graphgraphname (token)Graph name
ip-over-lcpbooleanSend IP over LCP (local auth)
lcp-echo-mimbooleanHandle LCP echos in the middle on relayed connection
localprefunsignedIntLocalpref for remote-ppp-ip/routes (highest wins)4294967295
namestringName
passwordSecretPassword check
payload-tableroutetable 0-99Routing table number for payload traffic (or L2TP relay)As per l2tp-incoming
profileNMTOKENProfile name
relay-hostnamestringHostname for L2TP connection
relay-ipList of IPAddrTarget IP(s) for L2TP connection
relay-pickbooleanIf set, try one of the relay IPs at random first
relay-secretSecretShared secret for L2TP connection
remote-netmaskIP4AddrRemote end PPP Netmask (local auth)
remote-ppp-ipIP4AddrRemote end PPP IPv4 (local auth)
Also works as remote-ip, which is deprecated
routesList of IPPrefixAdditional routes when link up (local auth)
sourcestringSource of data, used in automated config management
usernameList of stringOne or more patterns to match username

Control profile

General on/off control profile used in various places in the config.

profile: Attributes
AttributeTypeDescriptionDefault
andList of NMTOKENActive if all specified profiles are active as well as all other tests passing, including 'not'
commentstringComment
control-switch-usersList of NMTOKENRestrict users that have access to control switchAny users
dhcpList of IPNameAddrTest passes if any specified addresses are active in DHCP
expectbooleanDefines state considered 'Good' and shown green on status pagenone
initialbooleanDefines state at system startup, or new config, where not known/fixedtrue
intervaldurationTime between tests1
invertbooleanInvert final result of testing
logNMTOKENLog targetNot logging
log-debugNMTOKENLog additional informationNot logging
nameNMTOKENProfile nameNot optional
notNMTOKENActive if specified profile is inactive as well as all other tests passing, including 'and'
orList of NMTOKENActive if any of these other profiles are active regardless of other tests (including 'not' or 'and')
portsSet of portTest passes if any of these physical ports are up
pppList of NMTOKENPPP link state (any of these are up)
recoverdurationTime before recover (i.e. how long test has been passing)1
routeList of IPAddrTest passes if all specified addresses are routeable
setswitchManual override. Test settings ignored; Control switches can use and/or/not/invert
sourcestringSource of data, used in automated config management
tableroutetable 0-99Routing table for ping/route/dhcp
timeoutdurationTime before timeout (i.e. how long test has been failing)10
vrrpList of NMTOKENVRRP state (any of these is master)
profile: Elements
ElementTypeInstancesDescription
dateprofile-dateOptional, unlimitedTest passes if within any date range specified
pingprofile-pingOptionalTest passes if address is answering pings
timeprofile-timeOptional, unlimitedTest passes if within any time range specified

Test passes if within any of the time ranges specified

Time range test in profiles

profile-date: Attributes
AttributeTypeDescriptionDefault
commentstringComment
sourcestringSource of data, used in automated config management
startdateTimeStart (YYYY-MM-DDTHH:MM:SS)
stopdateTimeEnd (YYYY-MM-DDTHH:MM:SS)

Test passes if within any of the date/time ranges specified

Time range test in profiles

profile-time: Attributes
AttributeTypeDescriptionDefault
commentstringComment
daysSet of dayWhich days of week apply, default all
sourcestringSource of data, used in automated config management
starttimeStart (HH:MM:SS)
stoptimeEnd (HH:MM:SS)

Test passes if any addresses are pingable

Ping targets

profile-ping: Attributes
AttributeTypeDescriptionDefault
commentstringComment
flowunsignedShortFlow label (IPv6)
gatewayIPAddrPing via specific gateway (bypasses session tracking if set)
ipIPAddrTarget IPNot optional
sourcestringSource of data, used in automated config management
source-ipIPAddrSource IP
ttlunsignedByteTime to live / Hop limit

Traffic shaper

Settings for a named traffic shaper

shaper: Attributes
AttributeTypeDescriptionDefault
commentstringComment
namegraphname (token)Graph nameNot optional
rxunsignedLongRx rate limit/target (b/s)
rx-limitshaper-limit 0-1000Rx low level burst limit (ms) - ½ for large packets400ms
rx-maxunsignedLongRx rate limit max
rx-minunsignedLongRx rate limit min
rx-min-burstdurationRx minimum allowed burst time
rx-stepunsignedLongRx rate reduction per hour
sharebooleanIf shaper is shared with other devicesfalse
sourcestringSource of data, used in automated config management
txunsignedLongTx rate limit/target (b/s)
tx-limitshaper-limit 0-1000Tx low level burst limit (ms) - ½ for large packets400ms
tx-maxunsignedLongTx rate limit max
tx-minunsignedLongTx rate limit min
tx-min-burstdurationTx minimum allowed burst time
tx-stepunsignedLongTx rate reduction per hour
shaper: Elements
ElementTypeInstancesDescription
overrideshaper-overrideOptional, unlimitedProfile specific variations on main settings

Traffic shaper override based on profile

Settings for a named traffic shaper

shaper-override: Attributes
AttributeTypeDescriptionDefault
commentstringComment
profileNMTOKENProfile nameNot optional
rxunsignedLongRx rate limit/target (b/s)
rx-limitshaper-limit 0-1000Rx low level burst limit (ms) - ½ for large packets400ms
rx-maxunsignedLongRx rate limit max
rx-minunsignedLongRx rate limit min
rx-min-burstdurationRx minimum allowed burst time
rx-stepunsignedLongRx rate reduction per hour
sourcestringSource of data, used in automated config management
txunsignedLongTx rate limit/target (b/s)
tx-limitshaper-limit 0-1000Tx low level burst limit (ms) - ½ for large packets400ms
tx-maxunsignedLongTx rate limit max
tx-minunsignedLongTx rate limit min
tx-min-burstdurationTx minimum allowed burst time
tx-stepunsignedLongTx rate reduction per hour

IP Group

Named IP group

ip-group: Attributes
AttributeTypeDescriptionDefault
commentstringComment
ipList of IPRangeOne or more IP ranges or IP/len
namestringNameNot optional
sourcestringSource of data, used in automated config management
usersList of NMTOKENInclude IP of (time limited) logged in web users

DHCP server settings for remote / relayed requests

Settings for DHCP server for relayed connections

dhcp-relay: Attributes
AttributeTypeDescriptionDefault
allocation-tableroutetable 0-99Routing table for allocations - suggest using separate tables for remote DHCPAllocate same as request table
allowList of IPNameRangeIPs allowed (e.g. allocated IPs for renewal)Allow from anywhere
relayList of IPNameRangeRelay server IP(s)Any relay
tableroutetable 0-99Routing table applicableAllow any
dhcp-relay: Elements
ElementTypeInstancesDescription
dhcpdhcpsOptional, unlimitedDHCP server settings

User login level

User login level - commands available are restricted according to assigned level.

TagDescription
NOBODYUnknown or not logged in user
GUESTGuest user
USERNormal unprivileged user
ADMINSystem administrator
DEBUGSystem debugger

PPP dump format

TagDescription
defaultMixed hex/decode
decodedDecoded only
decoded+rawDecoded + raw
rawRaw hex

Type of s/w auto load

TagDescription
falseDo no auto load
factoryLoad factory releases
betaLoad beta test releases
alphaLoad test releases

Type of access user has to config

TagDescription
noneNo access unless explicitly listed
viewView only access (no passwords)
readRead only access (with passwords)
demoFull view and edit access but can only test config, not save
testFull view and edit access but must test save config first
fullFull view and edit access

Subsystem with EAP access control

TagDescription
IPsecIPsec/IKEv2 VPN

EAP access method

TagDescription
MD5MD5 Challenge
MSChapV2MS Challenge

Syslog severity

Log severity - different loggable events log at different levels.

TagDescription
EMERGSystem is unstable
ALERTAction must be taken immediately
CRIT Critical conditions
ERRError conditions
WARNINGWarning conditions
NOTICENormal but significant events
INFOInformational
DEBUGDebug level messages
NO-LOGGINGNo logging

Syslog facility

Syslog facility, usually used to control which log file the syslog is written to.

TagDescription
KERNKernel messages
USERUser level messges
MAILMail system
DAEMONSystem Daemons
AUTHSecurity/auth
SYSLOGInternal to syslogd
LPRPrinter
NEWSNews
UUCPUUCP
CRONCron deamon
AUTHPRIVprivate security/auth
FTPFile transfer
12Unused
13Unused
14Unused
15Unused
LOCAL0Local 0
LOCAL1Local 1
LOCAL2Local 2
LOCAL3Local 3
LOCAL4Local 4
LOCAL5Local 5
LOCAL6Local 6
LOCAL7Local 7

HTTP/HTTPS security mode

TagDescription
http-onlyNo HTTPS access
http+httpsBoth HTTP and HTTPS access
https-onlyNo HTTP access
redirect-to-httpsHTTP accesses are redirected to use HTTPS
redirect-to-https-if-acmeHTTP accesses are redirected to use HTTPS if ACME set up for hostname
redirect-to-https-except-trustedHTTP accesses are redirected to use HTTPS (except trusted IPs)

Options for controlling platform RADIUS response priority tagging

TagDescription
equalAll the same priority
strictIn order specified
randomRandom order
callingHashed on calling station id
calledHashed on called station id
usernameHashed on full username
userHashed on username before @
realmHashed on username after @
prefixHashed on username initial letters and numbers only

Type of RADIUS server

TagDescription
authenticationAuthentication server
accountingAccounting server
controlAllowed to send control (CoA/DM)

Month name (3 letter)

TagDescription
JanJanuary
FebFebruary
MarMarch
AprApril
MayMay
JunJune
JulJuly
AugAugust
SepSeptember
OctOctober
NovNovember
DecDecember

Day name (3 letter)

TagDescription
SunSunday
MonMonday
TueTuesday
WedWednesday
ThuThursday
FriFriday
SatSaturday

Physical port

TagDescription
0Port 0 (left)
1Port 1 (right)

Crossover configuration

Physical port crossover configuration.

TagDescription
autoCrossover is determined automatically
MDIForce no crossover

Physical port flow control setting

TagDescription
noneNo flow control
symmetricCan support two-way flow control
send-pausesCan send pauses but does not support pause reception
anyCan receive pauses and may send pauses if required

Physical port Gigabit clock master/slave setting

TagDescription
prefer-masterMaster status negotiated; preference for master
prefer-slaveMaster status negotiated; preference for slave
force-masterMaster status forced
force-slaveSlave status forced

Yellow LED setting

TagDescription
Link/CollisionOn when link up; blink when collisions detected
ActivityBlink when Tx or Rx activity
FaultOn when autonegotiation mismatch
TxBlink when Tx activity
OffPermanently off
OnPermanently on

Green LED setting

TagDescription
Link/ActivityOn when link up; blink when Tx or Rx activity
CollisionBlink when collisions detected
RxBlink when Rx activity
OffPermanently off
OnPermanently on

PHY power saving options

TagDescription
noneNo power saving
fullFull power saving

Link fault type to send

TagDescription
falseNo fault
trueSend fault
off-lineSend offline fault (1G)
aneSend ANE fault (1G)

Trunk port mode

TagDescription
falseNot trunking
randomRandom trunking
l2-hashL2 hashed trunking
l23-hashL2 and L3 hashed trunking
l3-hashL3 hashed trunking

IPv6 route announce level

IPv6 route announcement mode and level

TagDescription
falseDo not announce
lowAnnounce as low priority
mediumAnnounce as medium priority
highAnnounce as high priority
trueAnnounce as default (medium) priority

BGP announcement mode

BGP mode defines the default advertisement mode for prefixes, based on well-known community tags

TagDescription
falseNot included in BGP at all
no-advertiseNot included in BGP, not advertised at all
no-exportNot normally exported from local AS/confederation
local-asNot exported from local AS
no-peerExported with no-peer community tag
trueExported as normal with no special tags added

Source filter option

TagDescription
falseNo source filter checks
blackholeCheck replies blackholed
nowhereCheck replies valid
selfCheck replies valid and not self
trueCheck replies down same port/vlan

Type of PPPoE connection

TagDescription
clientNormal PPPoE client connects to access controller
bras-l2tpPPPoE server mode linked to L2TP operation

Additional prefix on PPPoE calling ID

TagDescription
noneNone
macMAC
vlanVLAN
mac-vlanMAC and VLAN

BGP peer type

Peer type controls many of the defaults for a peer setting. It allows typical settings to be defined with one attribute that reflects the type of peer.

TagDescription
normalNormal BGP operation
transitEBGP Mark received as no-export
peerEBGP Mark received as no-export, only accept peer AS
customerEBGP Allow export as if confederate, only accept peer AS
internalIBGP allowing own AS
reflectorIBGP allowing own AS and working in route reflector mode
confederateEBGP confederate
ixpInternet exchange point peer on route server, soft routes EBGP only

NAS IP to report

TagDescription
falseLocal LNS IP (deprecated)
lnsLocal LNS IP
bothSend NAS IP twice (LAC then LNS)
lacRemote LAC IP
trueRemote LAC IP (deprecated)

Profile manual setting

Manual setting control for profile

TagDescription
falseProfile set to OFF
trueProfile set to ON
control-switchProfile set based on control switch on home page

Basic types

TypeDescription
stringtext string
tokentext string
hexBinaryhex coded binary data
integerinteger (-2147483648-2147483647)
positiveIntegerpositive integer (1-4294967295)
unsignedLongunsigned long 64 bit integer (0-9223372036854775807)
unsignedIntunsigned integer (0-4294967295)
unsignedShortunsigned short integer (0-65535)
bytebyte integer (-128-127)
unsignedByteunsigned byte integer (0-255)
booleanBoolean
dateTimeYYYY-MM-DDTHH:MM:SS date/time
timeHH:MM:SS time
NMTOKENString with no spaces
voidInternal use
IPAddrIP address
IPNameAddrIP address or name
IP4AddrIPv4 address
IP6AddrIPv6 address
IP46AddrIPv4 + IPv6 address
IPPrefixIP address / bitlen
IPRangeIP address / bitlen or range
IPNameRangeIP address / bitlen or range or name
IP4RangeIPv4 address / bitlen or range
IP4PrefixIPv4 address / bitlen
IPSubnetIP address / bitlen
IP4SubnetIPv4 address / bitlen
IPFilterRoute filter
PasswordPassword
OTPOTP
Communityxxx:xxx community
PortRangexxx-xxx port range
Colour#rgb #rrggbb #rgba #rrggbbaa colour
SecretSecret/passphrase
durationPeriod [[HH:]MM:]SS
fb-sw-update-delay[unsignedByte] Number of days to delay upgrade by (0-30)
stringlist[string] List of strings
percentage[unsignedByte] Percentage (0 .. 100) (0-100)
routetable[unsignedByte] Route table number (0-99)
username[NMTOKEN] Login name
ipnamerangelist[IPNameRange] List of IPranges or ip groups
nmtokenlist[NMTOKEN] List of NMTOKEN
iplist[IPAddr] List of IP addresses
ipnamelist[IPNameAddr] List of IP addresses or domain names
vlan[unsignedShort] VLAN ID (0=untagged) (0-4095)
datenum[unsignedByte] Day number in month (1-31)
subnetlist[IPSubnet] List of subnets
ra-max[unsignedShort] Route announcement max interval (seconds) (4-1800)
ra-min[unsignedShort] Route announcement min interval (seconds) (3-1350)
ip6list[IP6Addr] List of IPv6 addresses
mtu[unsignedShort] Max transmission unit (576-2000)
ip4rangelist[IP4Range] List of IP4ranges
macprefixlist[macprefix] List of strings
macprefix[hexBinary] MAC prefix
ip4list[IP4Addr] List of IPv4 addresses
graphname[token] Graph name
cug[unsignedShort] CUG ID (1-32767)
prefixlist[IPPrefix] List of IP Prefixes
aslist[unsignedIntList] List of AS numbers
unsignedIntList[unsignedInt] List of integers
communitylist[Community] List of BGP communities
filterlist[IPFilter] List of IP Prefix filters
shaper-limit[unsignedShort] Shaper limit (ms) (0-1000)
iprangelist[IPRange] List of IPranges
userlist[username] List of user names
prefix4list[IP4Prefix] List of IPv4 Prefixes
portlist[PortRange] List of protocol port ranges
protolist[unsignedByte] List of IP protocols
routetableset[routetable] Set of routetables
vlan-nz[unsignedShort] VLAN ID (1-4095)
dates[datenum] Set of dates
tun-id[unsignedShort] Local tunnel ID (1-20000)
ses-id[unsignedShort] Local session ID (1-65535)
hostname[NMTOKEN] Host name
sip-error[unsignedShort] SIP error code (400-699)