Chapter 3. Configuration

Table of Contents

3.1. The Object Hierarchy
3.2. The Object Model
3.2.1. Formal definition of the object model
3.2.2. Common attributes
3.3. Configuration Methods
3.4. Data types
3.4.1. Sending and receiving values
3.4.2. Lists of values
3.4.3. Set of possible values
3.4.4. Dates, times, and durations
3.4.5. Colours
3.4.6. Passwords and secrets
3.4.7. IP addresses
3.4.7.1. Simple IP addresses
3.4.7.2. Subnets and prefixes
3.4.7.3. Ranges
3.5. Web User Interface Overview
3.5.1. User Interface layout
3.5.1.1. Customising the layout
3.5.2. Config pages and the object hierarchy
3.5.2.1. Configuration categories
3.5.2.2. Object settings
3.5.3. Navigating around the User Interface
3.5.4. Backing up / restoring the configuration
3.6. Configuration using XML
3.6.1. Introduction to XML
3.6.2. The root element - <config>
3.6.3. Viewing or editing XML
3.6.4. Example XML configuration
3.7. Downloading/Uploading the configuration
3.7.1. Download
3.7.2. Upload

3.1. The Object Hierarchy

The FB9000 has, at its core, a configuration based on a hierarchy of objects, with each object having one or more attributes. An object has a type, which determines its role in the operation of the FB9000. The values of the attributes determine how that object affects operation. Attributes also have a type (or datatype), which defines the type of data that attribute specifies. This in turn defines what the valid syntax is for a value of that datatype - for example some are numeric, some are free-form strings, others are strings with a specific format, such as a dotted-quad IP address. Some examples of attribute values are :-

  • IP addresses, and subnet definitions in CIDR format e.g. 192.168.10.0/24
  • free-form descriptive text strings, e.g. a name for a firewall rule
  • Layer 4 protocol port numbers e.g. TCP ports
  • data rates used to control traffic shaping
  • enumerated values used to control a feature e.g. defining Ethernet port LED functions

The object hierarchy can be likened to a family-tree, with relationships between objects referred to using terms such as Parent, Child, Sibling, Ancestor and Descendant. This tree-like structure is used to :-

  • group a set of related objects, such as a set of firewall rules - the parent object acts as a container for a group of (child) objects, and may also contribute to defining the detailed behaviour of the group
  • define a context for an object - for example, an object used to define a locally-attached subnet is a child of an object that defines an interface, and as such defines that the subnet is accessible on that specific interface. Since multiple interfaces can exist, other interface objects establish different contexts for subnet objects.

Additional inter-object associations are established via attribute values that reference other objects, typically by name, e.g. a firewall rule can specify one of several destinations for log information to be sent when the rule is processed.