| K.2. Objects | ||
|---|---|---|
 | Appendix K. Configuration Objects |  |
| K.2. Objects | ||
|---|---|---|
| | Appendix K. Configuration Objects | |
The system settings are the top level attributes of the system which apply globally.
Table K.3. system: Attributes
| Attribute | Type | Default | Description |
| acme-directory | string | https://acme-v02.api.letsencrypt.org/directory | ACME server directory |
| acme-hostname | List of string | - | Public hostname(s) for FireBrick for HTTPS |
| acme-keygen | boolean | true | Automatically obtain private keys as needed |
| acme-profile | NMTOKEN | - | Profile for when to do ACME renewals |
| acme-renew | positiveInteger | 30 | Renewal before expiry (days) |
| acme-source-ip | IP46Addr | - | Source IP for ACME renewal |
| acme-terms-agreed-email | string | - | Put your email if you agree CA terms |
| auto-backup-url | string | - | URL to http POST after config changed |
| comment | string | - | Comment |
| contact | string | - | Contact name |
| string | - | Contact email | |
| eth-rx-batch | unsignedInt | 20 | Max packets serviced on one port before rechecking other port for idle |
| eth-rx-qsize | unsignedInt | 2000 | Size of eth driver Rx queue |
| eth-tx-qsize | unsignedInt | 2000 | Size of eth driver Tx queue |
| intro | string | - | Home page text |
| lacp-hot-standby | lacp-hot-standby | nosync | Allow LACP to use hot standby |
| location | string | - | Location description |
| log | NMTOKEN | Web/console | Log system events |
| log-acme | NMTOKEN | - | Log ACME |
| log-acme-debug | NMTOKEN | - | Log ACME debug |
| log-acme-error | NMTOKEN | - | Log ACME errors |
| log-config | NMTOKEN | Web/Flash/console | Log config load |
| log-debug | NMTOKEN | Not logging | Log system debug messages |
| log-diagnostic | NMTOKEN | Not logging | Log system diagnostic messages |
| log-error | NMTOKEN | Web/Flash/console | Log system errors |
| log-eth | NMTOKEN | Web/console | Log Ethernet messages |
| log-eth-debug | NMTOKEN | Not logging | Log Ethernet debug |
| log-eth-error | NMTOKEN | Web/Flash/console | Log Ethernet errors |
| log-ppp-dump | ppp-dump | - | PPP dump format |
| log-route-nexthop | NMTOKEN | Not logged | Log next hop changes |
| log-stats | NMTOKEN | Not logging | Log one second stats |
| log-support | NMTOKEN | Web logs | Log support messages (e.g. stack trace) |
| log-tcp-debug | NMTOKEN | Not logging | Log TCP/TLS debug messages |
| login-intro | string | - | Login page text |
| name | string | - | System hostname |
| panic-stack-bytes | unsignedInt | 0 | Stack context for certain panics (bvtes) |
| pre-reboot-url | string | - | URL to GET prior to s/w reboot (typically to warn nagios) |
| source | string | - | Source of data, used in automated config management |
| spoof-mac | (hexBinary) macspoof | - | Spoof MAC base address - use with caution! |
| sw-update | autoloadtype | false | Load new software automatically |
| sw-update-delay | (unsignedByte 0-30) fb-sw-update-delay | 0 | Number of days after release to wait before automatically upgrading |
| sw-update-profile | NMTOKEN | - | Profile name for when to load new s/w |
| table | (unsignedByte 0-99) routetable | 0 | Routing table number for system functions (s/w updates, etc) |
| tcp-stealth | boolean | false | Ignore (as opposed to reject) TCP to the FireBrick itself that isn't accepted |
Default source IP for traffic originated by this FireBrick
Table K.6. routing-table: Attributes
| Attribute | Type | Default | Description |
| name | string | - | Name |
| source-ip | IP46Addr | - | Default source IP for services |
| table | (unsignedByte 0-99) routetable | Not optional | Routing table number |
User names, passwords and abilities for admin users
Table K.7. user: Attributes
| Attribute | Type | Default | Description |
| allow | List of IPNameRange | - | Restrict logins to be from specific IP addresses |
| comment | string | - | Comment |
| config | config-access | full | Config access level |
| full-name | string | - | Full name |
| level | user-level | ADMIN | Login level |
| local-only | boolean | false | Restrict access to locally connected Ethernet subnets only |
| log | NMTOKEN | Not logged | Log events |
| name | (NMTOKEN) username | Not optional | User name |
| otp-seed | OTP | - | OTP seed (do not edit by hand) |
| password | Password | Not optional | User password |
| profile | NMTOKEN | - | Profile name |
| source | string | - | Source of data, used in automated config management |
| table | (unsignedByte 0-99) routetable | 0 | Restrict login to specific routing table |
| timeout | duration | 5:00 | Login idle timeout (zero to stay logged in, not recommended) |
Identities, passwords and access methods for access controlled with EAP
Table K.8. eap: Attributes
| Attribute | Type | Default | Description |
| comment | string | - | Comment |
| full-name | string | - | Full name |
| methods | Set of eap-method | Not optional | Allowed methods |
| name | string | Not optional | User or account name |
| password | Secret | Not optional | User password |
| profile | NMTOKEN | - | Profile name |
| source | string | - | Source of data, used in automated config management |
| subsystem | eap-subsystem | Not optional | Access controlled subsystem |
Named logging target
Table K.9. log: Attributes
| Attribute | Type | Default | Description |
| colour | Colour | - | Colour used in web display |
| comment | string | - | Comment |
| console | boolean | - | Log immediately to console |
| flash | boolean | - | Log immediately to slow flash memory (use with care) |
| jtag | boolean | - | Log immediately jtag (development use only) |
| name | NMTOKEN | Not optional | Log target name |
| profile | NMTOKEN | - | Profile name |
| source | string | - | Source of data, used in automated config management |
| system | boolean | - | Include system logs on web/cli view |
Table K.10. log: Elements
| Element | Type | Instances | Description |
| log-email | Optional, unlimited | Email settings | |
| syslog | log-syslog | Optional, unlimited | Syslog settings |
Logging to a syslog server
Table K.11. log-syslog: Attributes
| Attribute | Type | Default | Description |
| comment | string | - | Comment |
| facility | syslog-facility | LOCAL0 | Facility setting |
| port | unsignedShort | 514 | Server port |
| profile | NMTOKEN | - | Profile name |
| server | IPNameAddr | Not optional | Syslog server |
| severity | syslog-severity | NOTICE | Severity setting |
| source | string | - | Source of data, used in automated config management |
| source-ip | IPAddr | - | Use specific source IP |
| system-logs | boolean | - | Include generic system log messages as well |
| table | (unsignedByte 0-99) routetable | 0 | Routing table number for sending syslogs |
Logging to email
Table K.12. log-email: Attributes
| Attribute | Type | Default | Description |
| comment | string | - | Comment |
| delay | duration | 1:00 | Delay before sending, since first event to send |
| from | string | One made up using serial number | Source email address |
| hold-off | duration | 1:00:00 | Delay before sending, since last email |
| log | NMTOKEN | Not logging | Log emailing process |
| log-debug | NMTOKEN | Not logging | Log emailing debug |
| log-error | NMTOKEN | Not logging | Log emailing errors |
| port | unsignedShort | 25 | Server port |
| profile | NMTOKEN | - | Profile name |
| retry | duration | 10:00 | Delay before sending, since failed send |
| server | IPNameAddr | - | Smart host to use rather than MX |
| source | string | - | Source of data, used in automated config management |
| subject | string | From first line being logged | Subject |
| table | (unsignedByte 0-99) routetable | 0 | Routing table number for sending email |
| to | string | Not optional | Target email address |
System services are various generic services that the system provides, and allows access controls and settings for these to be specified. The service is only active if the corresponding element is included in services, otherwise it is disabled.
Table K.13. services: Elements
| Element | Type | Instances | Description |
| dns | dns-service | Optional | DNS service settings |
| http | http-service | Optional | Web server settings |
| radius | radius-service | Optional | RADIUS server/proxy settings |
| snmp | snmp-service | Optional | SNMP server settings |
| telnet | telnet-service | Optional | Telnet server settings |
| time | time-service | Optional | System time server settings |
Web management pages
Table K.14. http-service: Attributes
| Attribute | Type | Default | Description |
| access-control-allow-origin | string | - | Additional HTTP header |
| allow | List of IPNameRange | Allow from anywhere | List of IP ranges from which service can be accessed |
| allow-acme | boolean | true | Allow limited port 80 HTTP access for ACME during renewal |
| banner-background | Colour | #bd1220 | Override default colours |
| certlist | List of NMTOKEN | use any suitable | Certificate(s) to be used for HTTPS sessions |
| comment | string | - | Comment |
| config-boxes | Colour | from banner | Config editor colours |
| content-security-policy | string | - | Additional HTTP header |
| css-url | string | - | Additional CSS for web control pages |
| highlight-text | Colour | from banner | Override default colours |
| https-port | unsignedShort | 443 | Service port for HTTPS access |
| js-url | string | - | Additional javascript for web control pages (logged in/trusted-ip) |
| local-only | boolean | true | Restrict access to locally connected Ethernet subnets only |
| log | NMTOKEN | Not logging | Log events |
| log-client | NMTOKEN | Not logging | Log client accesses |
| log-client-debug | NMTOKEN | Not logging | Log client accesses (debug) |
| log-debug | NMTOKEN | Not logging | Log debug |
| log-error | NMTOKEN | Log as event | Log errors |
| mode | http-mode | redirect-to-https-if-acme | Security mode |
| port | unsignedShort | 80 | Service port for HTTP access |
| referrer-policy | string | no-referrer | Additional HTTP header |
| self-sign | boolean | true | Create self signed certificate for HTTPS when necessary |
| source | string | - | Source of data, used in automated config management |
| table | (unsignedByte 0-99) routetable | All | Routing table number for access to service |
| trusted | List of IPNameRange | - | List of allowed IP ranges from which additional access to certain functions is available |
| x-content-type-options | string | nosniff | Additional HTTP header |
| x-frame-options | string | SAMEORIGIN | Additional HTTP header |
| x-xss-protection | string | 1; mode=block | Additional HTTP header |
DNS forwarding resolver service
Table K.15. dns-service: Attributes
| Attribute | Type | Default | Description |
| allow | List of IPNameRange | Allow from anywhere | List of IP ranges from which service can be accessed |
| auto-dhcp | boolean | - | Forward and reverse DNS for names in DHCP using this domain |
| auto-dhcp-new | string | - | Name to use for last new DHCP allocation (since last reboot) |
| caching | boolean | true | Cache relayed DNS entries locally |
| comment | string | - | Comment |
| domain | string | - | Our domain |
| fallback | boolean | true | For incoming requests, if no server in required table, relay to any DNS available |
| fallback-table | (unsignedByte 0-99) routetable | Don't fallback | For incoming requests, if no server in requesting table, relay to any DNS available in this table |
| local-only | boolean | true | Restrict access to locally connected Ethernet subnets only |
| log | NMTOKEN | Not logging | Log events |
| log-debug | NMTOKEN | Not logging | Log debug |
| log-error | NMTOKEN | Log as event | Log errors |
| log-interface | List of NMTOKEN | All interfaces | Only do normal log for specific interface(s) |
| resolvers | List of IPAddr | - | Recursive DNS resolvers to use |
| resolvers-table | (unsignedByte 0-99) routetable | as table / 0 | Routing table for specified resolvers |
| source | string | - | Source of data, used in automated config management |
| table | (unsignedByte 0-99) routetable | All | Routing table number for access to service |
DNS forwarding resolver service
Table K.17. dns-host: Attributes
| Attribute | Type | Default | Description |
| comment | string | - | Comment |
| ip | List of IPAddr | Our IP | IP addresses to serve (or our IP if omitted) |
| name | List of string | Not optional | Host names (can use * as a part of a domain) |
| profile | NMTOKEN | - | Profile name |
| restrict-interface | List of NMTOKEN | - | Only apply on certain interface(s) |
| restrict-to | List of IPNameRange | - | List of IP ranges to which this is served |
| reverse | boolean | - | Map reverse DNS as well |
| source | string | - | Source of data, used in automated config management |
| table | (unsignedByte 0-99) routetable | any | Routing table applicable |
| ttl | unsignedInt | 60 | Time to live |
DNS forwarding resolver service
Table K.18. dns-block: Attributes
| Attribute | Type | Default | Description |
| comment | string | - | Comment |
| name | List of string | Not optional | Host names (can use * as a part of a domain) |
| profile | NMTOKEN | - | Profile name |
| restrict-interface | List of NMTOKEN | - | Only apply on certain interface(s) |
| restrict-to | List of IPNameRange | - | List of IP ranges to which this is served |
| source | string | - | Source of data, used in automated config management |
| table | (unsignedByte 0-99) routetable | any | Routing table applicable |
| ttl | unsignedInt | 60 | Time to live |
RADIUS server and proxy definitions
Table K.19. radius-service: Attributes
| Attribute | Type | Default | Description |
| acct-port | unsignedShort | 1813 | Accounting UDP port |
| allow | List of IPNameRange | - | Allowed source IP address of RADIUS request |
| aruba-vlan | (unsignedShort 0-4095) vlan | Don't send | Aruba VLAN |
| auth-port | unsignedShort | 1812 | Authentication UDP port |
| authenticator | boolean | - | Require message authenticator |
| backup-ip | List of IPNameAddr | - | Target IP(s) or hostname for backup L2TP connection |
| class | string | - | Class field to send |
| comment | string | - | Comment |
| control-port | unsignedShort | 3799 | Control UDP port (CoA/DM) |
| dummy-ip | boolean | true | Send dummy framed IP response |
| erx-egress-policy-name | string | - | Juniper attribute 11 |
| erx-ingress-policy-name | string | - | Juniper attribute 10 |
| erx-tunnel-switch-profile | string | - | Juniper attribute 91 |
| erx-tunnel-virtual-router | string | - | Juniper attribute 8 |
| erx-virtual-router-name | string | - | Juniper attribute 1 (Also SIN502 Context-Name) |
| log | NMTOKEN | Not logging | Log events |
| log-debug | NMTOKEN | - | Log debug |
| log-error | NMTOKEN | Log as event | Log errors |
| nsn-conditional | boolean | - | Only send NSN settings if username is not same as calling station id |
| nsn-tunnel-override-username | unsignedByte | - | Additional response for GGSN usage |
| nsn-tunnel-user-auth-method | unsignedInt | - | Additional response for GGSN usage |
| order | radiuspriority | - | Priority tagging of endpoints sent |
| profile | NMTOKEN | - | Profile name |
| reject | boolean | - | Reject request (rarely what you want) |
| relay-ip | List of IPAddr | - | Address to copy RADIUS request |
| relay-port | unsignedShort | 1812 | Authentication UDP port for copy RADIUS request |
| relay-table | (unsignedByte 0-99) routetable | - | Routing table number for copy of RADIUS request |
| secret | Secret | - | Shared secret for RADIUS requests (needed for replies) |
| source | string | - | Source of data, used in automated config management |
| tagged | boolean | - | Tag all attributes that support tagging |
| target-hostname | string | - | Hostname for L2TP connection |
| target-ip | List of IPNameAddr | - | Target IP(s) or hostname for primary L2TP connection |
| target-secret | Secret | - | Shared secret for L2TP connection |
| tunnel-assignment-id | string | - | Tunnel Assignment ID to send |
| tunnel-client-return | boolean | - | Return tunnel client as radius IP |
Table K.20. radius-service: Elements
| Element | Type | Instances | Description |
| match | radius-service-match | Optional, unlimited | Matching rules for specific responses |
| server | radius-server | Optional, unlimited | RADIUS server settings |
Rules for matching incoming RADIUS requests
Table K.21. radius-service-match: Attributes
| Attribute | Type | Default | Description |
| allow | List of IPNameRange | - | Allowed source IP address of RADIUS request |
| ap-group | List of string | - | One or more patterns to match AP Group |
| aruba-vlan | (unsignedShort 0-4095) vlan | Don't send | Aruba VLAN |
| authenticator | boolean | - | Require message authenticator |
| backup-ip | List of IPNameAddr | - | Target IP(s) or hostname for backup L2TP connection |
| called-station-id | List of string | - | One or more patterns to match called-station-id |
| calling-station-id | List of string | - | One or more patterns to match calling-station-id |
| class | string | - | Class field to send |
| comment | string | - | Comment |
| device-type | List of string | - | One or more patterns to match Device Type |
| dummy-ip | boolean | true | Send dummy framed IP response |
| erx-egress-policy-name | string | - | Juniper attribute 11 |
| erx-ingress-policy-name | string | - | Juniper attribute 10 |
| erx-tunnel-switch-profile | string | - | Juniper attribute 91 |
| erx-tunnel-virtual-router | string | - | Juniper attribute 8 |
| erx-virtual-router-name | string | - | Juniper attribute 1 (Also SIN502 Context-Name) |
| essid-name | List of string | - | One or more patterns to match ESSID Name |
| ip | List of IPNameRange | - | Match target IP address of RADIUS request |
| location-id | List of string | - | One or more patterns to match Location ID |
| log | NMTOKEN | Not logging | Log events matching this |
| mac-local | boolean | - | Match only local or non local MAC addresses if username is a MAC |
| name | string | - | Name |
| nas-ip | List of IPNameRange | - | Match NAS-IP address in RADIUS request |
| nsn-conditional | boolean | - | Only send NSN settings if username is not same as calling station id |
| nsn-tunnel-override-username | unsignedByte | - | Additional response for GGSN usage |
| nsn-tunnel-user-auth-method | unsignedInt | - | Additional response for GGSN usage |
| order | radiuspriority | - | Priority tagging of endpoints sent |
| profile | NMTOKEN | - | Profile name |
| reject | boolean | - | Reject request (rarely what you want) |
| relay-ip | List of IPAddr | - | Address to copy RADIUS request |
| relay-port | unsignedShort | 1812 | Authentication UDP port for copy RADIUS request |
| relay-table | (unsignedByte 0-99) routetable | - | Routing table number for copy of RADIUS request |
| secret | Secret | - | Shared secret for RADIUS requests (needed for replies) |
| source | string | - | Source of data, used in automated config management |
| stop | boolean | true | Stop checking if this matches |
| tagged | boolean | - | Tag all attributes that support tagging |
| target-hostname | string | - | Hostname for L2TP connection |
| target-ip | List of IPNameAddr | - | Target IP(s) or hostname for primary L2TP connection |
| target-secret | Secret | - | Shared secret for L2TP connection |
| tunnel-assignment-id | string | - | Tunnel Assignment ID to send |
| tunnel-client-return | boolean | - | Return tunnel client as radius IP |
| username | List of string | - | One or more patterns to match username |
Server settings for outgoing RADIUS
Table K.22. radius-server: Attributes
| Attribute | Type | Default | Description |
| allow | List of IPNameRange | Must match host | Allowed control request source IPs instead of host check |
| comment | string | - | Comment |
| host | List of IPNameAddr | Not optional | One or more hostname/IPs of RADIUS servers |
| max-timeout | duration | 10 | Maximum final timeout |
| min-timeout | duration | 2 | Minimum final timeout |
| name | string | - | Name |
| port | unsignedShort | From services/radius settings | UDP port |
| profile | NMTOKEN | - | Profile name |
| queue | unsignedInt | - | Concurrent requests over all of these servers (per type) |
| scale-timeout | unsignedByte | 2 | Timeout scaling factor |
| secret | Secret | Not optional | Shared secret for RADIUS requests |
| source | string | - | Source of data, used in automated config management |
| source-ip | IPAddr | - | Fix source IP |
| table | (unsignedByte 0-99) routetable | - | Routing table number |
| type | Set of radiustype | All | Server type |
Telnet control interface
Table K.23. telnet-service: Attributes
| Attribute | Type | Default | Description |
| allow | List of IPNameRange | Allow from anywhere | List of IP ranges from which service can be accessed |
| comment | string | - | Comment |
| local-only | boolean | true | Restrict access to locally connected Ethernet subnets only |
| log | NMTOKEN | Not logging | Log events |
| log-debug | NMTOKEN | Not logging | Log debug |
| log-error | NMTOKEN | Log as event | Log errors |
| port | unsignedShort | 23 | Service port |
| prompt | string | system name | Prompt |
| source | string | - | Source of data, used in automated config management |
| table | (unsignedByte 0-99) routetable | All | Routing table number for access to service |
The SNMP service has general service settings and also specific attributes for SNMP such as community
Table K.24. snmp-service: Attributes
| Attribute | Type | Default | Description |
| allow | List of IPNameRange | Allow from anywhere | List of IP ranges from which service can be accessed |
| comment | string | - | Comment |
| community | Secret | public | Community string |
| local-only | boolean | false | Restrict access to locally connected Ethernet subnets only |
| log | NMTOKEN | Not logging | Log events |
| log-debug | NMTOKEN | Not logging | Log debug |
| log-error | NMTOKEN | Log as event | Log errors |
| port | unsignedShort | 161 | Service port |
| profile | NMTOKEN | - | Profile name |
| source | string | - | Source of data, used in automated config management |
| table | (unsignedByte 0-99) routetable | All | Routing table number for access to service |
The time settings define which NTP servers to synchronize the system clock from, and provide controls for daylight saving (summer time). The defaults are those that apply to the EU
Table K.25. time-service: Attributes
| Attribute | Type | Default | Description |
| allow | List of IPNameRange | Allow from anywhere | List of IP ranges from which service can be accessed |
| comment | string | - | Comment |
| legacy-timeserver | boolean | false | Serve legacy TIME service on UDP port 37 |
| local-only | boolean | true | Restrict access to locally connected Ethernet subnets only |
| log | NMTOKEN | Not logging | Log events |
| log-debug | NMTOKEN | Not logging | Log debug |
| log-error | NMTOKEN | Log as event | Log errors |
| maxpoll | duration | 1024 | NTP maximum poll rate |
| minpoll | duration | 64 | NTP minimum poll rate |
| ntp-control-allow | List of IPNameRange | Allow from anywhere | List of IP ranges from which control (ntpq) requests can be accessed |
| ntp-control-local-only | boolean | true | Restrict control (ntpq) access to locally connected Ethernet subnets only |
| ntp-control-table | (unsignedByte 0-99) routetable | All | Routing table number for incoming control (ntpq) requests |
| ntp-peer-table | (unsignedByte 0-99) routetable | 0 | Routing table number used for outgoing ntp peer requests |
| ntp-servers | List of IPNameAddr | ntp.firebrick.ltd.uk | List of NTP time servers (IP or hostname) from which time may be synchronized and served by ntp (Null list disables NTP) |
| profile | NMTOKEN | - | Profile name |
| source | string | - | Source of data, used in automated config management |
| table | (unsignedByte 0-99) routetable | All | Routing table number for access to service |
| tz1-name | string | GMT | Timezone 1 name |
| tz1-offset | duration | 0 | Timezone 1 offset from UTC |
| tz12-date | (unsignedByte 1-31) datenum | 25 | Timezone 1 to 2 earliest date in month |
| tz12-day | day | Sun | Timezone 1 to 2 day of week of change |
| tz12-month | month | Mar | Timezone 1 to 2 month |
| tz12-time | time | 01:00:00 | Timezone 1 to 2 local time of change |
| tz2-name | string | BST | Timezone 2 name |
| tz2-offset | duration | 1:00:00 | Timezone 2 offset from UTC |
| tz21-date | (unsignedByte 1-31) datenum | 25 | Timezone 2 to 1 earliest date in month |
| tz21-day | day | Sun | Timezone 2 to 1 day of week of change |
| tz21-month | month | Oct | Timezone 2 to 1 month |
| tz21-time | time | 02:00:00 | Timezone 2 to 1 local time of change |
Physical port attributes
Table K.26. ethernet: Attributes
| Attribute | Type | Default | Description |
| autoneg | boolean | true | Perform link auto-negotiation |
| clocking | LinkClock | prefer-slave | Gigabit clock setting |
| crossover | Crossover | auto | Port crossover configuration |
| flow | LinkFlow | none | Flow control setting |
| green | LinkLED-g | Link/Activity | Green LED setting |
| lacp | boolean | Auto | Send LACP packets |
| lldp | boolean | true | Send LLDP packets |
| optimise | boolean | true | enable PHY optimisations |
| port | port | Not optional | Physical port |
| power-saving | LinkPower | full | enable PHY power saving |
| profile | NMTOKEN | - | Profile name |
| send-fault | LinkFault | - | Send fault status |
| yellow | LinkLED-y | Tx | Yellow LED setting |
Packet sampling configuration
Table K.27. sampling: Attributes
| Attribute | Type | Default | Description |
| agent-ip | IPAddr | use source-ip | IP address used to identify this agent |
| collector-ip | IPAddr | Not optional | IP address of collector |
| collector-port | unsignedShort | 6343 for sFlow, 4739 for IPFIX | UDP port which collector listens on |
| comment | string | - | Comment |
| mtu | (unsignedShort 576-2000) mtu | 1500 | |
| name | string | - | Name |
| profile | NMTOKEN | - | Profile name |
| protocol | sampling-protocol | sflow | Protocol used to export sampling data |
| sample-flush | duration | 1 sec for sFlow; 30 for IPFIX | Sample max cache time |
| sample-rate | (unsignedShort 100-10000) sample-rate | 1000 | Sample rate (uniform random prob 1/N) |
| snap-length | unsignedShort | 64 | Packet header snap length |
| source | string | - | Source of data, used in automated config management |
| source-ip | IPAddr | - | Source IP address to use |
| source-port | unsignedShort | Use collector-port | UDP source port |
| stats-interval | duration | 60 | Stats export interval |
| table | (unsignedByte 0-99) routetable | 0 | Routing table number for sample data |
| template-refresh | duration | 600 | Template resend interval |
Port grouping and naming
Table K.28. portdef: Attributes
| Attribute | Type | Default | Description |
| comment | string | - | Comment |
| name | NMTOKEN | Not optional | Name |
| ports | Set of port | Not optional | Physical port(s) |
| source | string | - | Source of data, used in automated config management |
| trunk | trunk-mode | l2-hash | Trunk ports |
The interface definition relates to a specific physical port group and VLAN. It includes subnets and VRRP that apply to that interface.
Table K.29. interface: Attributes
| Attribute | Type | Default | Description |
| allow-6in4 | boolean | false | Handle 6in4 (protocol 41) packets |
| bgp | bgpmode | Auto | BGP announce mode for routes |
| comment | string | - | Comment |
| cug | (unsignedShort 1-32767) cug | - | Closed user group ID |
| cug-restrict | boolean | - | Closed user group restricted traffic (only to/from same CUG ID) |
| dhcp-relay | IP4Addr | - | Relay any unresolved requests to external server |
| fast-l2tp | boolean | - | Set on interfaces that are mainly terminating L2TP traffic |
| graph | (token) graphname | - | Graph name |
| link | NMTOKEN | - | Interface to which this is linked at layer 2 |
| log | NMTOKEN | Not logging | Log events |
| log-debug | NMTOKEN | Not logging | Log debug |
| log-dhcp | NMTOKEN | Not logging | Log DHCP events not related to a pool |
| log-error | NMTOKEN | Log as event | Log errors |
| mac-suffix | (hexBinary) macsuffix | - | Interface MAC ends with this hex value |
| mtu | (unsignedShort 576-2000) mtu | 1500 | MTU for this interface |
| name | NMTOKEN | - | Name |
| pd | boolean | If not WAN and no ra-subnet-templates and no ra subnets | Available for IPv6 prefix delegation |
| ping | IPAddr | - | Ping address to add loss/latency to graph for interface |
| port | NMTOKEN | Not optional | Port group name |
| profile | NMTOKEN | - | Profile name |
| restrict-mac | boolean | - | Use only one MAC on this interface |
| sampling | sampling-mode | off | Perform sampling |
| source | string | - | Source of data, used in automated config management |
| source-filter | sfoption | - | Source filter traffic received via this interface |
| source-filter-table | (unsignedByte 0-99) routetable | interface table | Routing table to use for source filtering checks |
| table | (unsignedByte 0-99) routetable | 0 | Routing table applicable |
| vlan | (unsignedShort 0-4095) vlan | 0 | VLAN ID (0=untagged) |
| wan | boolean | - | Do not consider this interface 'local' for 'local-only' checks |
Table K.30. interface: Elements
| Element | Type | Instances | Description |
| dhcp | dhcps | Optional, unlimited | DHCP server settings |
| ra-subnet-template | subnet-template | Optional, unlimited | Subnet options for RA client |
| subnet | subnet | Optional, unlimited | IP subnet on the interface |
| vrrp | vrrp | Optional, unlimited | VRRP settings |
Subnet settings define the IP address(es) of the FireBrick, and also allow default routes to be set.
Table K.31. subnet: Attributes
| Attribute | Type | Default | Description |
| accept-dns | boolean | true | Accept DNS servers specified by DHCP |
| arp-timeout | unsignedShort | 60 | Max lifetime on ARP and ND |
| bgp | bgpmode | Auto | BGP announce mode for routes |
| broadcast | boolean | false | If broadcast address allowed |
| comment | string | - | Comment |
| dhcp-class | string | FB-type | DHCP client option 60 (Class) |
| dhcp-client-id | string | MAC | DHCP client option 61 (Client-Identifier) |
| gateway | List of IPAddr | - | One or more gateways to install |
| ip | List of IPSubnet | Automatic by DHCP | One or more IP/len |
| localpref | unsignedInt | 4294967295 | Localpref for subnet (highest wins) |
| mac-suffix | (hexBinary) macsuffix | - | Subnet MAC ends with this hex value |
| mtu | (unsignedShort 576-2000) mtu | As interface | MTU for subnet |
| name | string | - | Name |
| profile | NMTOKEN | - | Profile name |
| proxy-arp | boolean | false | Answer ARP/ND by proxy if we have routing |
| ra | ramode | false | If to announce IPv6 RA for this subnet |
| ra-autonomous | boolean | If managed not set | RA 'A' (autonomous) flag |
| ra-dns | List of IP6Addr | Our IP | List of recursive DNS servers in route announcements |
| ra-dnssl | List of string | - | List of DNS search domains in route announcements |
| ra-managed | boolean | - | RA 'M' (managed) flag |
| ra-max | (unsignedShort 4-1800) ra-max | 600 | Max RA send interval |
| ra-min | (unsignedShort 3-1350) ra-min | ra-max/3 | Min RA send interval |
| ra-mtu | unsignedShort | As subnet | MTU to use on RA |
| ra-onlink | boolean | true | RA 'L' (onlink) flag |
| ra-other | boolean | - | RA 'O' (other) flag |
| ra-profile | NMTOKEN | - | Profile, if inactive then forces low priority RA |
| simple-dhcpv6 | boolean | - | Simple DHCPv6 server (fixed addresses) |
| source | string | - | Source of data, used in automated config management |
| test | IPAddr | - | Test link state using ARP/ND for this IP |
| ttl | unsignedByte | 64 | TTL for originating traffic via subnet |
Table K.32. subnet-template: Attributes
| Attribute | Type | Default | Description |
| accept-dns | boolean | True if not set elsewhere | Accept DNS servers specified by DHCP/SLAAC |
| comment | string | - | Comment |
| gateway-match | List of IPNameRange | Any IP | Apply only to received RAs with a gateway in these IPs |
| name | string | - | Name |
| profile | NMTOKEN | - | Profile name |
| source | string | - | Source of data, used in automated config management |
VRRP settings provide virtual router redundancy for the FireBrick. Profile inactive does not disable vrrp but forces vrrp low priority.
Table K.33. vrrp: Attributes
| Attribute | Type | Default | Description |
| answer-ping | boolean | true | Whether to answer PING to VRRP IPs when master |
| comment | string | - | Comment |
| delay | unsignedInt | 60 | Delay after routing established before priority returns to normal |
| interval | unsignedShort | 100 | Transit interval (centiseconds) |
| ip | List of IPAddr | Not optional | One or more IP addresses to announce |
| log | NMTOKEN | Not logging | Log events |
| log-error | NMTOKEN | log as event | Log errors |
| low-priority | unsignedByte | 1 | Lower priority applicable until routing established |
| name | NMTOKEN | - | Name |
| preempt | boolean | true | Whether pre-empt allowed |
| priority | unsignedByte | 100 | Normal priority |
| profile | NMTOKEN | - | Profile name |
| source | string | - | Source of data, used in automated config management |
| use-vmac | boolean | true | Whether to use the special VMAC or use normal MAC |
| version3 | boolean | v2 for IPv4, v3 for IPv6 | Use only version 3 |
| vrid | unsignedByte | 42 | VRID |
Settings for DHCP server
Table K.34. dhcps: Attributes
| Attribute | Type | Default | Description |
| boot | IP4Addr | - | Next/boot server |
| boot-file | string | - | Boot filename |
| broadcast | boolean | - | Broadcast replies even if not requested |
| circuit | string | - | Agent info circuit match |
| class | string | - | Vendor class match |
| client-name | string | - | Client name match |
| comment | string | - | Comment |
| dns | List of IP4Addr | Our IP | DNS resolvers |
| domain | string | From system settings | DNS domain |
| domain-search | string | - | DNS domain search list (list will be truncated to fit one attribute) |
| force | boolean | - | Send all options even if not requested |
| gateway | IP4Subnet | Our IP | Gateway |
| graph-prefix | string | - | Prefix to use for allocation auto graphs |
| ip | List of IP4Range | 0.0.0.0/0 | Address pool |
| lease | duration | 2:00:00 | Lease length |
| log | NMTOKEN | Not logging | Log events |
| log-decline | NMTOKEN | Not logging | Log events (declined) |
| log-move | NMTOKEN | Not logging | Log events (moved) |
| log-new | NMTOKEN | Not logging | Log events (new) |
| log-release | NMTOKEN | Not logging | Log events (released) |
| log-renew | NMTOKEN | Not logging | Log events (renewed) |
| log-reuse | NMTOKEN | Not logging | Log events (reused) |
| mac | List up to 12 (hexBinary) macprefix | - | Partial or full client hardware (MAC) addresses (or client-id MAC if specified) |
| mac-local | boolean | - | Match only local or non local MAC addresses |
| name | string | - | Name |
| ntp | List of IP4Addr | Our IP | NTP server |
| profile | NMTOKEN | - | Profile name |
| source | string | - | Source of data, used in automated config management |
| syslog | List of IP4Addr | - | Syslog server |
| time | List of IP4Addr | Our IP | Time server |
Table K.35. dhcps: Elements
| Element | Type | Instances | Description |
| send | dhcp-attr-hex | Optional, unlimited | Additional attributes to send (hex) |
| send-ip | dhcp-attr-ip | Optional, unlimited | Additional attributes to send (IP) |
| send-number | dhcp-attr-number | Optional, unlimited | Additional attributes to send (numeric) |
| send-string | dhcp-attr-string | Optional, unlimited | Additional attributes to send (string) |
Additional DHCP server attributes (numeric)
Table K.38. dhcp-attr-number: Attributes
| Attribute | Type | Default | Description |
| comment | string | - | Comment |
| force | boolean | - | Send even if not requested |
| id | unsignedByte | Not optional | Attribute type code/tag |
| name | string | - | Name |
| value | unsignedInt | Not optional | Value |
| vendor | boolean | - | Add as vendor specific option (under option 43) |
PPPoE endpoint settings
Table K.40. pppoe: Attributes
| Attribute | Type | Default | Description |
| ac-name | string | Any a/c name as client, else same as 'name' | Access concentrator name |
| accept-dns | boolean | true | Accept DNS servers specified by far end |
| auto-percent | unsignedByte | N/A | Try to set egress based on connect message, percentage |
| bgp | bgpmode | Auto | BGP announce mode for routes |
| calling-id | pppoe-calling | - | Add mac and/or vlan(s) after prefix |
| calling-prefix | string | - | Prefix on calling number (BRAS mode) |
| calling-suffix | pppoe-calling-suffix | - | Override the calling suffix |
| comment | string | - | Comment |
| cug | (unsignedShort 1-32767) cug | - | Closed user group ID |
| cug-restrict | boolean | - | Closed user group restricted traffic (only to/from same CUG ID) |
| eth | port | - | Physical port connected to modem (for port reset) |
| fast-retry | boolean | - | Aggressive re-connect |
| graph | (token) graphname | - | Graph name |
| incoming-profile | NMTOKEN | - | Profile for responding to PADIs |
| incoming-vlans | List of (unsignedShort 0-4095) vlan | - | VLAN IDs to accept connections on |
| ip-over-lcp | boolean | auto | Sends all IP packets as LCP |
| lcp-rate | unsignedByte | 10 | LCP interval (seconds) |
| lcp-timeout | unsignedByte | 61 | LCP timeout (seconds) |
| local | IP4Addr | - | Local IPv4 address |
| localpref | unsignedInt | 4294967295 | Localpref for route (highest wins) |
| log | NMTOKEN | Not logging | Log events |
| log-debug | NMTOKEN | Not logging | Log debug |
| log-error | NMTOKEN | Not logging | Log as events |
| mac-suffix | (hexBinary) macsuffix | - | MAC ends with this hex value |
| mode | pppoe-mode | client | PPPoE server/client mode |
| mtu | (unsignedShort 576-2000) mtu | 1492 | MTU for link |
| name | NMTOKEN | - | Name |
| password | Secret | - | User password |
| port | NMTOKEN | Not optional | Port group name |
| profile | NMTOKEN | - | Profile name |
| remote | IP4Addr | - | Remote IPv4 address |
| rfc4638 | boolean | If over 1492 MTU | Send RFC4638 PPP-Max-Payload |
| routes | List of IPPrefix | Default gateway | Routes when link up |
| service | string | Any service | Service name |
| source | string | - | Source of data, used in automated config management |
| speed | unsignedInt | - | Default egress rate limit (b/s) |
| table | (unsignedByte 0-99) routetable | - | Routing table number for payload |
| tcp-mss-fix | boolean | true | Adjust MSS option in TCP SYN to fix session MSS |
| username | string | - | User name |
| vlan | (unsignedShort 0-4095) vlan | 0 | VLAN ID (0=untagged) |
Table K.41. pppoe: Elements
| Element | Type | Instances | Description |
| route | ppp-route | Optional, unlimited | Routes to apply when ppp link is up |
Routes that apply when link is up
Table K.42. ppp-route: Attributes
| Attribute | Type | Default | Description |
| bgp | bgpmode | Auto | BGP announce mode for routes |
| comment | string | - | Comment |
| ip | List of IPPrefix | Not optional | One or more network prefixes |
| localpref | unsignedInt | 4294967295 | Localpref of network (highest wins) |
| name | string | - | Name |
| profile | NMTOKEN | - | Profile name |
| source | string | - | Source of data, used in automated config management |
Static routes define prefixes which are permanently in the routing table, and whether these should be announced by routing protocols or not.
Table K.43. route: Attributes
| Attribute | Type | Default | Description |
| as-path | List up to 10 unsignedInt | - | Custom AS path as if network received |
| bgp | bgpmode | Auto | BGP announce mode for routes |
| comment | string | - | Comment |
| gateway | List of IPAddr | Not optional | One or more target gateway IPs |
| graph | (token) graphname | - | Graph name |
| ip | List of IPPrefix | Not optional | One or more network prefixes |
| localpref | unsignedInt | 4294967295 | Localpref of network (highest wins) |
| name | string | - | Name |
| profile | NMTOKEN | - | Profile name |
| source | string | - | Source of data, used in automated config management |
| speed | unsignedInt | - | Egress rate limit (b/s) |
| table | (unsignedByte 0-99) routetable | 0 | Routing table number |
| tag | List of Community | - | List of community tags |
Network blocks that are announced but not actually added to internal routes - note that blackhole and nowhere objects can also announce but not add routing.
Table K.44. network: Attributes
| Attribute | Type | Default | Description |
| as-path | List up to 10 unsignedInt | - | Custom AS path as if network received |
| bgp | bgpmode | true | BGP announce mode for routes |
| comment | string | - | Comment |
| ip | List of IPPrefix | Not optional | One or more network prefixes |
| localpref | unsignedInt | 4294967295 | Localpref of network (highest wins) |
| name | string | - | Name |
| profile | NMTOKEN | - | Profile name |
| source | string | - | Source of data, used in automated config management |
| table | (unsignedByte 0-99) routetable | 0 | Routing table number |
| tag | List of Community | - | List of community tags |
Networks that go nowhere
Table K.45. blackhole: Attributes
| Attribute | Type | Default | Description |
| as-path | List up to 10 unsignedInt | - | Custom AS path as if network received |
| bgp | bgpmode | false | BGP announce mode for routes |
| comment | string | - | Comment |
| ip | List of IPPrefix | Not optional | One or more network prefixes |
| localpref | unsignedInt | 4294967295 | Localpref of network (highest wins) |
| name | string | - | Name |
| no-fib | boolean | - | Route not in forwarding, only for EBGP |
| profile | NMTOKEN | - | Profile name |
| source | string | - | Source of data, used in automated config management |
| table | (unsignedByte 0-99) routetable | 0 | Routing table number |
| tag | List of Community | - | List of community tags |
Loopback addresses define local IP addresses
Table K.46. loopback: Attributes
| Attribute | Type | Default | Description |
| as-path | List up to 10 unsignedInt | - | Custom AS path as if network received |
| bgp | bgpmode | Auto | BGP announce mode for routes |
| comment | string | - | Comment |
| ip | List of IPAddr | Not optional | One or more local network addresses |
| localpref | unsignedInt | 4294967295 | Localpref of network (highest wins) |
| name | string | - | Name |
| profile | NMTOKEN | - | Profile name |
| source | string | - | Source of data, used in automated config management |
| table | (unsignedByte 0-99) routetable | 0 | Routing table number |
| tag | List of Community | - | List of community tags |
This defines a set of named rules for mapping and filtering of prefixes to/from a BGP peer.
Table K.48. namedbgpmap: Elements
| Element | Type | Instances | Description |
| match | bgprule | Optional, unlimited | List rules, in order of checking |
An individual rule for BGP mapping/filtering
Table K.49. bgprule: Attributes
| Attribute | Type | Default | Description |
| as-origin | unsignedInt | - | AS that must be last in path to match |
| as-present | unsignedInt | - | AS that must be present in path to match |
| comment | string | - | Comment |
| community | Community | - | Community that must be present to match |
| detag | List of Community | - | List of community tags to remove |
| drop | boolean | - | Do not import/export this prefix |
| localpref | unsignedInt | - | Set localpref (highest wins) |
| med | unsignedInt | - | Set MED |
| name | string | - | Name |
| no-community | Community | - | Community that must not be present to match |
| pad | unsignedByte | - | Pad (prefix stuff) our AS on export by this many, can be zero to not send our AS |
| prefix | List of IPFilter | - | Prefixes that this rule applies to |
| source | string | - | Source of data, used in automated config management |
| tag | List of Community | - | List of community tags to add |
The BGP element defines general BGP settings and a list of peer definitions for the individual BGP peers.
Table K.50. bgp: Attributes
| Attribute | Type | Default | Description |
| as | unsignedInt | - | Our AS |
| blackhole-community | Community | - | Community tag to mark black hole routes |
| cluster-id | IP4Addr | - | Our cluster ID |
| comment | string | - | Comment |
| dead-end-community | Community | - | Community tag to mark dead end routes |
| greyhole-community | Community | - | Community tag to mark black hole routes with no-fib |
| id | IP4Addr | - | Our router ID |
| log | NMTOKEN | Not logging | Log events |
| name | string | - | Name |
| source | string | - | Source of data, used in automated config management |
| table | (unsignedByte 0-99) routetable | 0 | Routing table number |
Table K.51. bgp: Elements
| Element | Type | Instances | Description |
| peer | bgppeer | Optional, up to 500 | List of peers/neighbours |
The peer definition specifies the attributes of an individual peer. Multiple IP addresses can be specified, typically for IPv4 and IPv6 addresses for the same peer, but this can be used for a group of similar peers.
Table K.52. bgppeer: Attributes
| Attribute | Type | Default | Description |
| add-own-as | boolean | - | Add our AS on exported routes |
| allow-export | boolean | true for customer | Ignore no-export community and export anyway |
| allow-only-their-as | boolean | - | Only accept routes that are solely the peers AS |
| allow-own-as | boolean | - | Allow our AS inbound |
| as | unsignedInt | - | Peer AS |
| blackhole-community | Community | Not announced on EBGP, our blackhole-community if IBGP | Egress community tag to mark black hole routes |
| capability-as4 | boolean | true | If supporting AS4 |
| capability-graceful-restart | boolean | true | If supporting Graceful Restart |
| capability-mpe-ipv4 | boolean | true | If supporting MPE for IPv4 |
| capability-mpe-ipv6 | boolean | true | If supporting MPE for IPv6 |
| capability-route-refresh | boolean | true | If supporting Route Refresh |
| clean-shutdown-wait | duration | - | Resend routes at low priority when +ve, withdraw routes when -ve and delay for the absolute value on shutdown |
| clean-startup-wait | duration | - | Don't announce routes within this time of reboot |
| comment | string | - | Comment |
| drop-default | boolean | false | Ignore default route received |
| export-filters | List of NMTOKEN | - | Named export filters to apply |
| export-med | unsignedInt | - | Set MED on exported routes (unless export filter sets it) |
| holdtime | unsignedInt | 30 | Hold time |
| ignore-bad-optional-partial | boolean | true | Ignore routes with a recognised badly formed optional that is flagged partial |
| import-filters | List of NMTOKEN | - | Named import filters to apply |
| import-localpref | unsignedInt | - | Set localpref on imported routes (unless import filter sets it) |
| import-tag | List of Community | - | List of community tags to add in addition to any import filters |
| in-soft | boolean | - | Mark received routes as soft |
| ip | List of IPAddr | - | One or more IPs of neighbours (omit to allow incoming) |
| log-debug | NMTOKEN | Not logging | Log debug |
| max-prefix | unsignedInt | - | Limit prefixes (IPv4+IPv6) |
| md5 | Secret | - | MD5 signing secret |
| name | string | - | Name |
| next-hop-self | boolean | false | Force us as next hop outbound |
| no-fib | boolean | - | Don't include received routes in packet forwarding |
| pad | unsignedByte | - | Pad (prefix stuff) our AS on export by this many |
| profile | NMTOKEN | - | Profile name |
| reduce-recursion | boolean | false | Override incoming next hop if not local subnet |
| restart-time | unsignedShort | - | Time to tell other end to expect us to take to restart (defaults to holdtime) |
| same-ip-type | boolean | true | Only accept/send IPv4 routes to IPv4 peers and IPv6 routes to IPv6 peers |
| send-default | boolean | false | Send a default route to this peer |
| send-no-routes | boolean | false | Don't send any normal routes |
| source | string | - | Source of data, used in automated config management |
| timer-idle | unsignedInt | 60 | Idle time after error |
| timer-openwait | unsignedInt | 10 | Time to wait for OPEN on connection |
| timer-retry | unsignedInt | 10 | Time to retry the neighbour |
| ttl-security | byte | - | Enable RFC5082 TTL security (if +ve, 1 to 127), i.e. 1 for adjacent router. If -ve (-1 to -128) set forced sending TTL, i.e. -1 for TTL of 1 sending, and not checking. |
| type | peertype | normal | Type of neighbour (affects some defaults) |
| use-vrrp-as-self | boolean | true if customer/transit type | Use VRRP address as self if possible |
This defines the rules for mapping and filtering of prefixes to/from a BGP peer.
Table K.54. bgpmap: Attributes
| Attribute | Type | Default | Description |
| comment | string | - | Comment |
| detag | List of Community | - | List of community tags to remove |
| drop | boolean | - | Do not import/export this prefix |
| localpref | unsignedInt | - | Set localpref (highest wins) |
| med | unsignedInt | - | Set MED |
| prefix | List of IPFilter | - | Drop all that are not in this prefix list |
| source | string | - | Source of data, used in automated config management |
| tag | List of Community | - | List of community tags to add |
Table K.55. bgpmap: Elements
| Element | Type | Instances | Description |
| match | bgprule | Optional, unlimited | List rules, in order of checking |
Constant quality monitoring (graphs and data) have a number of settings. Most of the graphing settings can be overridden when a graph is collected so these define the defaults in many cases.
Table K.56. cqm: Attributes
| Attribute | Type | Default | Description |
| auto-refresh-list | boolean | true | Auto refresh graph list pages (for trusted IPs) |
| ave | Colour | #08f | Colour for average latency |
| axis | Colour | black | Axis colour |
| background | Colour | white | Background colour |
| bottom | unsignedByte | 11 | Pixels space at bottom of graph |
| dateformat | string | %Y-%m-%d | Date format |
| dayformat | string | %a | Day format |
| fail | Colour | red | Colour for failed (dropped) seconds |
| fail-level | unsignedInt | 1 | Fail level not expected on low usage |
| fail-level1 | unsignedByte | 3 | Loss level 1 |
| fail-level2 | unsignedByte | 50 | Loss level 2 |
| fail-score | unsignedByte | 200 | Score for fail and low usage |
| fail-score1 | unsignedByte | 100 | Score for on/above level 1 |
| fail-score2 | unsignedByte | 200 | Score for on/above level 2 |
| fail-usage | unsignedInt | 128000 | Usage below which fail is not expected |
| fblogo | Colour | #bd1220 | Colour for logo |
| graticule | Colour | grey | Graticule colour |
| heading | string | - | Heading of graph |
| hourformat | string | %H | Hour format |
| key | unsignedByte | 90 | Pixels space for key |
| label-ave | string | Ave | Label for average latency |
| label-damp | string | Damp% | Label for % shaper damping |
| label-fail | string | %Fail | Label for seconds (%) failed |
| label-latency | string | Latency | Label for latency |
| label-max | string | Max | Label for maximum latency |
| label-min | string | Min | Label for minimum latency |
| label-off | string | Off | Label for off line seconds |
| label-period | string | Period | Label for period |
| label-poll | string | Polls | Label for polls |
| label-rej | string | %Reject | Label for rejected seconds |
| label-rx | string | Rx | Label for Rx traffic level |
| label-score | string | Score | Label for score |
| label-sent | string | Sent | Label for seconds polled |
| label-shaper | string | Shaper | Label for shaper |
| label-time | string | Time | Label for time |
| label-traffic | string | Traffic (bit/s) | Label for traffic level |
| label-tx | string | Tx | Label for Tx traffic level |
| latency-level | unsignedInt | 100000000 | Latency level not expected on low usage |
| latency-level1 | unsignedInt | 100000000 | Latency level 1 (ns) |
| latency-level2 | unsignedInt | 500000000 | Latency level 2 (ns) |
| latency-score | unsignedByte | 200 | Score for high latency and low usage |
| latency-score1 | unsignedByte | 10 | Score for on/above level 1 |
| latency-score2 | unsignedByte | 20 | Score for on/above level 2 |
| latency-usage | unsignedInt | 128000 | Usage below which latency is not expected |
| left | unsignedByte | 0 | Pixels space left of main graph |
| log | NMTOKEN | Not logging | Log events |
| marker-width | string | - | Stroke width for marker (+) on tx/rx (e.g. 4) |
| max | Colour | green | Colour for maximum latency |
| min | Colour | #008 | Colour for minimum latency |
| ms-max | positiveInteger | 500 | ms max height |
| off | Colour | #c8f | Colour for off line seconds |
| outside | Colour | transparent | Colour for outer border |
| pppoe-dos-limit | unsignedInt | 10000 | Per poll tx packet drop limit for DOS protection on PPPoE incoming sessions |
| rej | Colour | #f8c | Colour for off line seconds |
| right | unsignedByte | 50 | Pixels space right of main graph |
| rx | Colour | #800 | Colour for Rx traffic level |
| secret | Secret | - | Secret for SHA1 coded URLs |
| sent | Colour | #ff8 | Colour for polled seconds |
| share-interface | NMTOKEN | - | Interface on which to broadcast data for shaper sharing |
| share-secret | Secret | - | Secret to validate shaper sharing |
| stroke-width | string | 4 if no marker | Stroke line for tx/rx |
| subheading | string | - | Subheading of graph |
| svg-css | string | - | URL for SVG CSS instead of local style settings |
| svg-title | boolean | - | Include mouseover title text on svg |
| text | Colour | black | Colour for text |
| text1 | string | - | Text line 1 |
| text2 | string | - | Text line 2 |
| text3 | string | - | Text line 3 |
| text4 | string | - | Text line 4 |
| timeformat | string | %Y-%m-%d %H:%M:%S | Time format |
| top | unsignedByte | 4 | Pixels space at top of graph |
| tx | Colour | #080 | Colour for Tx traffic level |
Table K.58. l2tp: Elements
| Element | Type | Instances | Description |
| incoming | l2tp-incoming | Optional, unlimited | Incoming L2TP connections |
L2TP tunnel settings for incoming L2TP connections
Table K.59. l2tp-incoming: Attributes
| Attribute | Type | Default | Description |
| advise-speed | unsignedInt | - | Advise clients of their egress rate (may be overridden by RADIUS) (b/s) - This is a FireBrick specific mechanism |
| allow | List of IPNameRange | - | List of IP ranges from which connects can be made |
| bgp | bgpmode | Auto | BGP announce mode for routes |
| comment | string | - | Comment |
| damping | boolean | false | Apply damping to sessions if limiting on shaper |
| dhcpv6dns | List of IP6Addr | System DNS resolvers | List of IPv6 DNS servers |
| dos-limit | unsignedInt | 10000 | Per second per session tx packet drop limit for DOS protection |
| fail-lockout | unsignedByte | 60 | Interval kept in failed state |
| graph | string | - | Graph name |
| hdlc | boolean | true | Send HDLC header (FF03) on all PPP frames |
| hello-interval | unsignedByte | 60 | Interval between HELLO messages |
| icmp-ppp | boolean | false | Use PPP endpoint for ICMP |
| ip6-checksum | boolean | true | Calculate checksum on IPv6 tunnels |
| ipv6ep | IP4Addr | - | Local end IPv4 for IPv6 tunnels |
| lcp-data-len | unsignedByte | - | LCP data field length |
| lcp-mru-fix | boolean | false | Restart LCP if RAS negotiated MRU is too high |
| lcp-rate | unsignedByte | 1 | LCP interval (seconds) |
| lcp-timeout | unsignedByte | 10 | LCP timeout (seconds) |
| local-hostname | string | System name | Hostname quoted on reply |
| local-ppp-ip | IP4Addr | - | Local end PPP IPv4 |
| log | NMTOKEN | Not logging | Log events |
| log-debug | NMTOKEN | Not logging | Log debug |
| log-error | NMTOKEN | Log as event | Log errors |
| mtu | (unsignedShort 576-2000) mtu | - | Default MTU for sessions in this tunnel |
| name | string | - | Name |
| open-timeout | unsignedByte | 60 | Interval before OPEN considered failed |
| operator-name | string | - | Value to send for Operator-Name AVP |
| payload-source-ip | IP46Addr | - | IP of our end when originating traffic to LAC |
| payload-table | (unsignedByte 0-99) routetable | 0 | Routing table number for payload traffic |
| ppp-final-timeout | unsignedByte | 60 | PPP total timeout (seconds) |
| ppp-init-timeout | unsignedByte | 10 | PPP initial timeout (seconds) |
| pppdns1 | IP4Addr | - | PPP DNS1 IPv4 default |
| pppdns2 | IP4Addr | - | PPP DNS2 IPv4 default |
| profile | NMTOKEN | - | Profile name |
| radius | string | - | Name for RADIUS server config to use |
| radius-nas-ip | radius-nas | lac | Pass remote (LAC) or local (LNS) as RADIUS NAS IP / port |
| receive-window | unsignedShort | Not sent | Receive window to advise on connection |
| remote-hostname | string | - | Hostname expected on connection |
| require-platform | boolean | false | All sessions require a platform RADIUS first |
| require-radius-acct | boolean | - | Close session if cannot do RADIUS accounting |
| retry-timeout | unsignedByte | 60 | Interval to retry sending control messages before fail |
| secret | Secret | - | Shared secret (for far end to check) |
| session-timeout | duration | - | Default session timeout |
| shutdown | boolean | false | Refuse all new sessions or tunnels |
| source | string | - | Source of data, used in automated config management |
| source-ip | IPAddr | - | IP of our end for relayed (on same table) |
| speed | unsignedInt | - | Default egress rate limit (b/s) |
| table | (unsignedByte 0-99) routetable | Any | Routing table number for L2TP session |
| tcp-mss-fix | boolean | false | Adjust MSS option in TCP SYN to fix session MSS |
Table K.60. l2tp-incoming: Elements
| Element | Type | Instances | Description |
| match | l2tp-relay | Optional, unlimited | Rules for relaying connections and local authentication |
Rules for relaying L2TP or local authentication
Table K.61. l2tp-relay: Attributes
| Attribute | Type | Default | Description |
| called-station-id | List of string | - | One or more patterns to match called-station-id |
| calling-station-id | List of string | - | One or more patterns to match calling-station-id |
| comment | string | - | Comment |
| graph | (token) graphname | - | Graph name |
| group-graph | (token) graphname | - | Secondary graph name |
| ip-over-lcp | boolean | - | Send IP over LCP (local auth) |
| lcp-echo-mim | boolean | - | Handle LCP echos in the middle on relayed connection |
| localpref | unsignedInt | 4294967295 | Localpref for remote-ppp-ip/routes (highest wins) |
| name | string | - | Name |
| password | Secret | - | Password check |
| payload-table | (unsignedByte 0-99) routetable | As per l2tp-incoming | Routing table number for payload traffic (or L2TP relay) |
| profile | NMTOKEN | - | Profile name |
| relay-hostname | string | - | Hostname for L2TP connection |
| relay-ip | List of IPAddr | - | Target IP(s) for L2TP connection |
| relay-pick | boolean | - | If set, try one of the relay IPs at random first |
| relay-secret | Secret | - | Shared secret for L2TP connection |
| remote-netmask | IP4Addr | - | Remote end PPP Netmask (local auth) |
| remote-ppp-ip | IP4Addr | - | Remote end PPP IPv4 (local auth) |
| routes | List of IPPrefix | - | Additional routes when link up (local auth) |
| rx-speed | unsignedInt | - | Send ingress rate (b/s) |
| source | string | - | Source of data, used in automated config management |
| tx-speed | unsignedInt | - | Egress rate limit (b/s) |
| username | List of string | - | One or more patterns to match username |
General on/off control profile used in various places in the config.
Table K.62. profile: Attributes
| Attribute | Type | Default | Description |
| and | List of NMTOKEN | - | Active if all specified profiles are active as well as all other tests passing, including 'not' |
| comment | string | - | Comment |
| control-switch-group | string | - | Heading to use when grouping in UI |
| control-switch-locks | boolean | false | Control switch requires unlock before use. |
| control-switch-users | List of NMTOKEN | Any users | Restrict users that have access to control switch |
| dhcp | List of IPNameAddr | - | Test passes if any specified addresses are active in DHCP |
| expect | boolean | none | Defines state considered 'Good' and shown green on status page |
| initial | boolean | true | Defines state at system startup (unless set), or new config, where not known/fixed |
| interval | duration | 1 | Time between tests |
| invert | boolean | - | Invert final result of testing |
| log | NMTOKEN | Not logging | Log target |
| log-debug | NMTOKEN | Not logging | Log additional information |
| name | NMTOKEN | Not optional | Profile name |
| not | NMTOKEN | - | Active if specified profile is inactive as well as all other tests passing, including 'and' |
| or | List of NMTOKEN | - | Active if any of these other profiles are active regardless of other tests (including 'not' or 'and') |
| ports | Set of port | - | Test passes if any of these physical ports are up |
| ppp | List of NMTOKEN | - | PPP link state (any of these are up) |
| recover | duration | 1 | Time before recover (i.e. how long test has been passing) |
| route | List of IPAddr | - | Test passes if all specified addresses are routeable |
| set | switch | - | Manual override. Test settings ignored; Control switches can use and/or/not/invert |
| source | string | - | Source of data, used in automated config management |
| table | (unsignedByte 0-99) routetable | - | Routing table for ping/route/dhcp |
| timeout | duration | 10 | Time before timeout (i.e. how long test has been failing) |
| uptime | unsignedShort | - | Minimum uptime (seconds) |
| vrrp | List of NMTOKEN | - | VRRP state (any of these is master) |
Table K.63. profile: Elements
| Element | Type | Instances | Description |
| date | profile-date | Optional, unlimited | Test passes if within any date range specified |
| ping | profile-ping | Optional | Test passes if address is answering pings |
| time | profile-time | Optional, unlimited | Test passes if within any time range specified |
Ping targets
Table K.66. profile-ping: Attributes
| Attribute | Type | Default | Description |
| comment | string | - | Comment |
| flow | unsignedShort | - | Flow label (IPv6) |
| gateway | IPAddr | - | Ping via specific gateway (bypasses session tracking if set) |
| ip | IPAddr | Not optional | Target IP |
| source | string | - | Source of data, used in automated config management |
| source-ip | IPAddr | - | Source IP |
| ttl | unsignedByte | - | Time to live / Hop limit |
Settings for a named traffic shaper
Table K.67. shaper: Attributes
| Attribute | Type | Default | Description |
| comment | string | - | Comment |
| name | (token) graphname | Not optional | Graph name |
| rx | unsignedLong | - | Rx rate limit/target (b/s) |
| rx-limit | (unsignedShort 0-1000) shaper-limit | 400ms | Rx low level burst limit (ms) - ½ for large packets |
| rx-max | unsignedLong | - | Rx rate limit max |
| rx-min | unsignedLong | - | Rx rate limit min |
| rx-min-burst | duration | - | Rx minimum allowed burst time |
| rx-step | unsignedLong | - | Rx rate reduction per hour |
| share | boolean | false | If shaper is shared with other devices |
| source | string | - | Source of data, used in automated config management |
| tx | unsignedLong | - | Tx rate limit/target (b/s) |
| tx-limit | (unsignedShort 0-1000) shaper-limit | 400ms | Tx low level burst limit (ms) - ½ for large packets |
| tx-max | unsignedLong | - | Tx rate limit max |
| tx-min | unsignedLong | - | Tx rate limit min |
| tx-min-burst | duration | - | Tx minimum allowed burst time |
| tx-step | unsignedLong | - | Tx rate reduction per hour |
Table K.68. shaper: Elements
| Element | Type | Instances | Description |
| override | shaper-override | Optional, unlimited | Profile specific variations on main settings |
Settings for a named traffic shaper
Table K.69. shaper-override: Attributes
| Attribute | Type | Default | Description |
| comment | string | - | Comment |
| profile | NMTOKEN | Not optional | Profile name |
| rx | unsignedLong | - | Rx rate limit/target (b/s) |
| rx-limit | (unsignedShort 0-1000) shaper-limit | 400ms | Rx low level burst limit (ms) - ½ for large packets |
| rx-max | unsignedLong | - | Rx rate limit max |
| rx-min | unsignedLong | - | Rx rate limit min |
| rx-min-burst | duration | - | Rx minimum allowed burst time |
| rx-step | unsignedLong | - | Rx rate reduction per hour |
| source | string | - | Source of data, used in automated config management |
| tx | unsignedLong | - | Tx rate limit/target (b/s) |
| tx-limit | (unsignedShort 0-1000) shaper-limit | 400ms | Tx low level burst limit (ms) - ½ for large packets |
| tx-max | unsignedLong | - | Tx rate limit max |
| tx-min | unsignedLong | - | Tx rate limit min |
| tx-min-burst | duration | - | Tx minimum allowed burst time |
| tx-step | unsignedLong | - | Tx rate reduction per hour |
Settings for DHCP server for relayed connections
Table K.71. dhcp-relay: Attributes
| Attribute | Type | Default | Description |
| allocation-table | (unsignedByte 0-99) routetable | Allocate same as request table | Routing table for allocations - suggest using separate tables for remote DHCP |
| allow | List of IPNameRange | Allow from anywhere | IPs allowed (e.g. allocated IPs for renewal) |
| relay | List of IPNameRange | Any relay | Relay server IP(s) |
| table | (unsignedByte 0-99) routetable | Allow any | Routing table applicable |
Table K.72. dhcp-relay: Elements
| Element | Type | Instances | Description |
| dhcp | dhcps | Optional, unlimited | DHCP server settings |
| |  | |
| Appendix K. Configuration Objects |  | K.3. Data types |