FireBrick FB9000 V1.61.010 configuration objects

Top level config

The top level config element contains all of the FireBrick configuration data.

config: Attributes
Attribute	Type	Description
ip	IPAddr	Config store IP address
patch	integer	Internal use, for s/w updates that change config syntax
serial	string	Serial number
timestamp	dateTime	Config store time, set automatically when config is saved
version	string	Code version
who	string	Config store username

config: Elements
Element	Type	Instances	Description
blackhole	blackhole	Optional, unlimited	Black hole (dropped packets) networks
cqm	cqm	Optional	Constant Quality Monitoring config
eap	eap	Optional, unlimited	User access control via EAP
ethernet	ethernet	Optional, unlimited	Ethernet port settings
interface	interface	Optional, up to 8192	Ethernet interface (port-group/vlan) and subnets
ip-group	ip-group	Optional, unlimited	Named IP groups
log	log	Optional, up to 63	Log target controls
loopback	loopback	Optional, unlimited	Extra local addresses
nowhere	blackhole	Optional, unlimited	Dead end (icmp error) networks
port	portdef	Optional, up to 10	Port grouping and naming
route	route	Optional, unlimited	Static routes
routing-tables	routing-table	Optional, unlimited	Routing table settings
services	services	Optional	General system services
system	system	Optional	System settings
user	user	Optional, unlimited	Admin users

System settings

The system settings are the top level attributes of the system which apply globally.

system: Attributes
Attribute	Type	Description	Default
busy-threshold	unsignedInt	Max non-idle time before damping eth rx (millisec)	200
comment	string	Comment
contact	string	Contact name
cpu-int-reserved	percentage 0-100	Min percentage of CPU earmarked for int processing	95
email	string	Contact email
eth-rx-qsize	unsignedInt	Size of eth driver Rx queue	256
eth-tx-qsize	unsignedInt	Size of eth driver Tx queue	512
home-status	boolean	Port status on home page	true
intro	string	Home page text
location	string	Location description
log	NMTOKEN	Log system events	Web/console
log-config	NMTOKEN	Log config load	Web/Flash/console
log-debug	NMTOKEN	Log system debug messages	Not logging
log-diagnostic	NMTOKEN	Log system diagnostic messages	Not logging
log-error	NMTOKEN	Log system errors	Web/Flash/console
log-eth	NMTOKEN	Log Ethernet messages	Web/console
log-eth-debug	NMTOKEN	Log Ethernet debug	Not logging
log-eth-error	NMTOKEN	Log Ethernet errors	Web/Flash/console
log-ppp-dump	ppp-dump	PPP dump format
log-route-nexthop	NMTOKEN	Log next hop changes	Not logged
log-stats	NMTOKEN	Log one second stats	Not logging
log-support	NMTOKEN	Log support messages (e.g. stack trace) Also works as log-panic, which is deprecated	Web logs
log-tcp-debug	NMTOKEN	Log TCP/TLS debug messages	Not logging
login-intro	string	Login page text
name	string	System hostname
port-led-brightness	percentage 0-100	Brightness of LEDs	50
port-status	boolean	Live port LEDs on status	true
pre-reboot-url	string	URL to GET prior to s/w reboot (typically to warn nagios)
soft-watchdog	boolean	Debug - use only if advised; do not use on an unattended FireBrick	false
source	string	Source of data, used in automated config management
status-led-colour	Colour	Default status LED colour Also works as led, which is deprecated	green
sw-update	autoloadtype	Load new software automatically	factory
sw-update-delay	fb-sw-update-delay 0-30	Number of days after release to wait before automatically upgrading	0
table	routetable 0-99	Routing table number for system functions (s/w updates, etc)	0

system: Elements
Element	Type	Instances	Description
link	link	Optional, unlimited	Intro links

Web links

Links to other web pages

link: Attributes
Attribute	Type	Description	Default
comment	string	Comment
level	user-level	Login level required	GUEST
name	string	Link name
source	string	Source of data, used in automated config management
text	string	Link text
url	string	Link address

Default source IP for services using a given table

Default source IP for traffic originated by this FireBrick

routing-table: Attributes
Attribute	Type	Description	Default
name	string	Name
source-ip	IP46Addr	Default source IP for services
table	routetable 0-99	Routing table number	Not optional

Admin users

User names, passwords and abilities for admin users

user: Attributes
Attribute	Type	Description	Default
allow	List of IPNameRange	Restrict logins to be from specific IP addresses
comment	string	Comment
config	config-access	Config access level	full
full-name	string	Full name
level	user-level	Login level	ADMIN
local-only	boolean	Restrict access to locally connected Ethernet subnets only	false
name	username (NMTOKEN)	User name	Not optional
otp-seed	OTP	OTP seed (do not edit by hand) Also works as otp, which is deprecated
password	Password	User password	Not optional
source	string	Source of data, used in automated config management
table	routetable 0-99	Restrict login to specific routing table	0
timeout	duration	Login idle timeout (zero to stay logged in, not recommended)	5:00

User access controlled by EAP

Identities, passwords and access methods for access controlled with EAP

eap: Attributes
Attribute	Type	Description	Default
comment	string	Comment
full-name	string	Full name
methods	Set of eap-method	Allowed methods	Not optional
name	string	User or account name	Not optional
password	Secret	User password	Not optional
source	string	Source of data, used in automated config management
subsystem	eap-subsystem	Access controlled subsystem	Not optional

Log target controls

Named logging target

log: Attributes
Attribute	Type	Description	Default
colour	Colour	Colour used in web display
comment	string	Comment
console	boolean	Log immediately to console
flash	boolean	Log immediately to slow flash memory (use with care)
jtag	boolean	Log immediately jtag (development use only)
name	NMTOKEN	Log target name	Not optional
source	string	Source of data, used in automated config management
system	boolean	Include system logs on web/cli view

log: Elements
Element	Type	Instances	Description
email	log-email	Optional, unlimited	Email settings
syslog	log-syslog	Optional, unlimited	Syslog settings

Syslog logger settings

Logging to a syslog server

log-syslog: Attributes
Attribute	Type	Description	Default
comment	string	Comment
facility	syslog-facility	Facility setting	LOCAL0
port	unsignedShort	Server port	514
server	IPNameAddr	Syslog server	Not optional
severity	syslog-severity	Severity setting	NOTICE
source	string	Source of data, used in automated config management
source-ip	IPAddr	Use specific source IP
system-logs	boolean	Include generic system log messages as well
table	routetable 0-99	Routing table number for sending syslogs	0

Email logger settings

Logging to email

log-email: Attributes
Attribute	Type	Description	Default
comment	string	Comment
delay	duration	Delay before sending, since first event to send	1:00
from	string	Source email address	One made up using serial number
hold-off	duration	Delay before sending, since last email	1:00:00
log	NMTOKEN	Log emailing process	Not logging
log-debug	NMTOKEN	Log emailing debug	Not logging
log-error	NMTOKEN	Log emailing errors	Not logging
port	unsignedShort	Server port	25
retry	duration	Delay before sending, since failed send	10:00
server	IPNameAddr	Smart host to use rather than MX
source	string	Source of data, used in automated config management
subject	string	Subject	From first line being logged
table	routetable 0-99	Routing table number for sending email	0
to	string	Target email address	Not optional

System services are various generic services that the system provides, and allows access controls and settings for these to be specified. The service is only active if the corresponding element is included in services, otherwise it is disabled.

services: Elements
Element	Type	Instances	Description
dns	dns-service	Optional	DNS service settings
http	http-service	Optional	Web server settings
snmp	snmp-service	Optional	SNMP server settings
telnet	telnet-service	Optional	Telnet server settings
time	time-service	Optional	System time server settings Also works as ntp, which is deprecated

Web service settings

Web management pages

http-service: Attributes
Attribute	Type	Description	Default
access-control-allow-origin	string	Additional HTTP header
allow	List of IPNameRange	List of IP ranges from which service can be accessed	Allow from anywhere
certlist	List of NMTOKEN	Certificate(s) to be used for HTTPS sessions	use any suitable
comment	string	Comment
content-security-policy	string	Additional HTTP header
css-url	string	Additional CSS for web control pages
https-port	unsignedShort	Service port for HTTPS access	443
js-url	string	Additional javascript for web control pages (logged in/trusted-ip)
local-only	boolean	Restrict access to locally connected Ethernet subnets only	true
log	NMTOKEN	Log events	Not logging
log-client	NMTOKEN	Log client accesses	Not logging
log-client-debug	NMTOKEN	Log client accesses (debug)	Not logging
log-debug	NMTOKEN	Log debug	Not logging
log-error	NMTOKEN	Log errors	Log as event
mode	http-mode	Security mode	http+https
port	unsignedShort	Service port for HTTP access	80
referrer-policy	string	Additional HTTP header	no-referrer
self-sign	boolean	Create self signed certificate for HTTPS when necessary	true
source	string	Source of data, used in automated config management
table	routetable 0-99	Routing table number for access to service	All
trusted	List of IPNameRange	List of allowed IP ranges from which additional access to certain functions is available
x-content-type-options	string	Additional HTTP header	nosniff
x-frame-options	string	Additional HTTP header	SAMEORIGIN
x-xss-protection	string	Additional HTTP header	1; mode=block

DNS service settings

DNS forwarding resolver service

dns-service: Attributes
Attribute	Type	Description	Default
allow	List of IPNameRange	List of IP ranges from which service can be accessed	Allow from anywhere
auto-dhcp	boolean	Forward and reverse DNS for names in DHCP using this domain
auto-dhcp-new	string	Name to use for last new DHCP allocation (since last reboot)
caching	boolean	Cache relayed DNS entries locally	true
comment	string	Comment
domain	string	Our domain
fallback	boolean	For incoming requests, if no server in required table, relay to any DNS available	true
fallback-table	routetable 0-99	For incoming requests, if no server in requesting table, relay to any DNS available in this table	Don't fallback
local-only	boolean	Restrict access to locally connected Ethernet subnets only	true
log	NMTOKEN	Log events	Not logging
log-debug	NMTOKEN	Log debug	Not logging
log-error	NMTOKEN	Log errors	Log as event
log-interface	List of NMTOKEN	Only do normal log for specific interface(s)	All interfaces
resolvers	List of IPAddr	Recursive DNS resolvers to use
resolvers-table	routetable 0-99	Routing table for specified resolvers	as table / 0
source	string	Source of data, used in automated config management
table	routetable 0-99	Routing table number for access to service	All

dns-service: Elements
Element	Type	Instances	Description
block	dns-block	Optional, unlimited	Fixed local DNS host blocks
host	dns-host	Optional, unlimited	Fixed local DNS host entries

Fixed local DNS host settings

DNS forwarding resolver service

dns-host: Attributes
Attribute	Type	Description	Default
comment	string	Comment
ip	List of IPAddr	IP addresses to serve (or our IP if omitted)	Our IP
name	List of string	Host names (can use * as a part of a domain)	Not optional
restrict-interface	List of NMTOKEN	Only apply on certain interface(s)
restrict-to	List of IPNameRange	List of IP ranges to which this is served Also works as restrict, which is deprecated
reverse	boolean	Map reverse DNS as well
source	string	Source of data, used in automated config management
table	routetable 0-99	Routing table applicable	any
ttl	unsignedInt	Time to live	60

Fixed local DNS blocks

DNS forwarding resolver service

dns-block: Attributes
Attribute	Type	Description	Default
comment	string	Comment
name	List of string	Host names (can use * as a part of a domain)	Not optional
restrict-interface	List of NMTOKEN	Only apply on certain interface(s)
restrict-to	List of IPNameRange	List of IP ranges to which this is served Also works as restrict, which is deprecated
source	string	Source of data, used in automated config management
table	routetable 0-99	Routing table applicable	any
ttl	unsignedInt	Time to live	60

Telnet service settings

Telnet control interface

telnet-service: Attributes
Attribute	Type	Description	Default
allow	List of IPNameRange	List of IP ranges from which service can be accessed	Allow from anywhere
comment	string	Comment
local-only	boolean	Restrict access to locally connected Ethernet subnets only	true
log	NMTOKEN	Log events	Not logging
log-debug	NMTOKEN	Log debug	Not logging
log-error	NMTOKEN	Log errors	Log as event
port	unsignedShort	Service port	23
prompt	string	Prompt	system name
source	string	Source of data, used in automated config management
table	routetable 0-99	Routing table number for access to service	All

SNMP service settings

The SNMP service has general service settings and also specific attributes for SNMP such as community

snmp-service: Attributes
Attribute	Type	Description	Default
allow	List of IPNameRange	List of IP ranges from which service can be accessed	Allow from anywhere
comment	string	Comment
community	Secret	Community string	public
local-only	boolean	Restrict access to locally connected Ethernet subnets only	false
log	NMTOKEN	Log events	Not logging
log-debug	NMTOKEN	Log debug	Not logging
log-error	NMTOKEN	Log errors	Log as event
port	unsignedShort	Service port	161
source	string	Source of data, used in automated config management
table	routetable 0-99	Routing table number for access to service	All

System time server settings

The time settings define which NTP servers to synchronize the system clock from, and provide controls for daylight saving (summer time). The defaults are those that apply to the EU

time-service: Attributes
Attribute	Type	Description	Default
allow	List of IPNameRange	List of IP ranges from which service can be accessed	Allow from anywhere
comment	string	Comment
legacy-timeserver	boolean	Serve legacy TIME service on UDP port 37	true
local-only	boolean	Restrict access to locally connected Ethernet subnets only	true
log	NMTOKEN	Log events	Not logging
log-debug	NMTOKEN	Log debug	Not logging
log-error	NMTOKEN	Log errors	Log as event
maxpoll	duration	NTP maximum poll rate	1024
minpoll	duration	NTP minimum poll rate	64
ntp-control-allow	List of IPNameRange	List of IP ranges from which control (ntpq) requests can be accessed	Allow from anywhere
ntp-control-local-only	boolean	Restrict control (ntpq) access to locally connected Ethernet subnets only	true
ntp-control-table	routetable 0-99	Routing table number for incoming control (ntpq) requests	All
ntp-peer-table	routetable 0-99	Routing table number used for outgoing ntp peer requests	0
ntp-servers	List of IPNameAddr	List of NTP time servers (IP or hostname) from which time may be synchronized and served by ntp (Null list disables NTP) Also works as ntpserver, which is deprecated	ntp.firebrick.ltd.uk
source	string	Source of data, used in automated config management
table	routetable 0-99	Routing table number for access to service	All
tz1-name	string	Timezone 1 name	GMT
tz1-offset	duration	Timezone 1 offset from UTC	0
tz12-date	datenum 1-31	Timezone 1 to 2 earliest date in month	25
tz12-day	day	Timezone 1 to 2 day of week of change	Sun
tz12-month	month	Timezone 1 to 2 month	Mar
tz12-time	time	Timezone 1 to 2 local time of change	01:00:00
tz2-name	string	Timezone 2 name	BST
tz2-offset	duration	Timezone 2 offset from UTC	1:00:00
tz21-date	datenum 1-31	Timezone 2 to 1 earliest date in month	25
tz21-day	day	Timezone 2 to 1 day of week of change	Sun
tz21-month	month	Timezone 2 to 1 month	Oct
tz21-time	time	Timezone 2 to 1 local time of change	02:00:00

Physical port controls

Physical port attributes

ethernet: Attributes
Attribute	Type	Description	Default
autoneg	boolean	Perform link auto-negotiation	true
clocking	LinkClock	Gigabit clock setting	prefer-slave
flow	LinkFlow	Flow control setting	none
lacp	boolean	Send LACP packets	Auto
left-led-colour	Colour	Override left (RX) LED colour	Green(1G)/Magenta(10G)
port	port	Physical port	Not optional
right-led-colour	Colour	Override right (TX) LED colour	Yellow(1G)/Cyan(10G)
send-fault	LinkFault	Send fault status
shutdown	boolean	Power down this port	false

Port grouping and naming

portdef: Attributes
Attribute	Type	Description	Default
comment	string	Comment
name	NMTOKEN	Name	Not optional
ports	Set of port	Physical port(s)	Not optional
source	string	Source of data, used in automated config management
trunk	trunk-mode	Trunk ports	l2-hash

Port-group/VLAN interface settings

The interface definition relates to a specific physical port group and VLAN. It includes subnets and VRRP that apply to that interface.

interface: Attributes
Attribute	Type	Description	Default
allow-6in4	boolean	Handle 6in4 (protocol 41) packets	false
comment	string	Comment
graph	graphname (token)	Graph name
link	NMTOKEN	Interface to which this is linked at layer 2
log	NMTOKEN	Log events	Not logging
log-debug	NMTOKEN	Log debug	Not logging
log-dhcp	NMTOKEN	Log DHCP events not related to a pool	Not logging
log-error	NMTOKEN	Log errors	Log as event
mtu	mtu 576-2000	MTU for this interface	1500
name	NMTOKEN	Name
pd	boolean	Available for IPv6 prefix delegation	If not WAN and not ra-client and no ra subnets
ping	IPAddr	Ping address to add loss/latency to graph for interface
port	NMTOKEN	Port group name	Not optional
ra-client	boolean	Accept IPv6 RA and create auto config subnets and routes	If WAN set
restrict-mac	boolean	Use only one MAC on this interface
source	string	Source of data, used in automated config management
source-filter	sfoption	Source filter traffic received via this interface
source-filter-table	routetable 0-99	Routing table to use for source filtering checks	interface table
table	routetable 0-99	Routing table applicable	0
vlan	vlan 0-4095	VLAN ID (0=untagged)	0
wan	boolean	Do not consider this interface 'local' for 'local-only' checks

interface: Elements
Element	Type	Instances	Description
dhcp	dhcps	Optional, unlimited	DHCP server settings
subnet	subnet	Optional, unlimited	IP subnet on the interface
vrrp	vrrp	Optional, unlimited	VRRP settings

Subnet settings

Subnet settings define the IP address(es) of the FireBrick, and also allow default routes to be set.

subnet: Attributes
Attribute	Type	Description	Default
accept-dns	boolean	Accept DNS servers specified by DHCP	true
arp-timeout	unsignedShort	Max lifetime on ARP and ND	60
broadcast	boolean	If broadcast address allowed	false
comment	string	Comment
dhcp-class	string	DHCP client option 60 (Class)	FB-type
dhcp-client-id	string	DHCP client option 61 (Client-Identifier)	MAC
gateway	List of IPAddr	One or more gateways to install
ip	List of IPSubnet	One or more IP/len	Automatic by DHCP
localpref	unsignedInt	Localpref for subnet (highest wins)	4294967295
mtu	mtu 576-2000	MTU for subnet	As interface
name	string	Name
proxy-arp	boolean	Answer ARP/ND by proxy if we have routing	false
ra	ramode	If to announce IPv6 RA for this subnet	false
ra-autonomous	boolean	RA 'A' (autonomous) flag	If managed not set
ra-dns	List of IP6Addr	List of recursive DNS servers in route announcements	Our IP
ra-dnssl	List of string	List of DNS search domains in route announcements
ra-managed	boolean	RA 'M' (managed) flag
ra-max	ra-max 4-1800	Max RA send interval	600
ra-min	ra-min 3-1350	Min RA send interval	ra-max/3
ra-mtu	unsignedShort	MTU to use on RA	As subnet
ra-onlink	boolean	RA 'L' (onlink) flag	true
ra-other	boolean	RA 'O' (other) flag
simple-dhcpv6	boolean	Simple DHCPv6 (fixed addresses)
source	string	Source of data, used in automated config management
test	IPAddr	Test link state using ARP/ND for this IP
ttl	unsignedByte	TTL for originating traffic via subnet	64

VRRP settings

VRRP settings provide virtual router redundancy for the FireBrick. Profile inactive does not disable vrrp but forces vrrp low priority. Use different VRID on different VLANs.

vrrp: Attributes
Attribute	Type	Description	Default
answer-ping	boolean	Whether to answer PING to VRRP IPs when master	true
comment	string	Comment
delay	unsignedInt	Delay after routing established before priority returns to normal	60
interval	unsignedShort	Transit interval (centiseconds)	100
ip	List of IPAddr	One or more IP addresses to announce	Not optional
log	NMTOKEN	Log events	Not logging
log-error	NMTOKEN	Log errors	log as event
low-priority	unsignedByte	Lower priority applicable until routing established	1
name	NMTOKEN	Name
preempt	boolean	Whether pre-empt allowed	true
priority	unsignedByte	Normal priority	100
source	string	Source of data, used in automated config management
use-vmac	boolean	Whether to use the special VMAC or use normal MAC	true
version3	boolean	Use only version 3	v2 for IPv4, v3 for IPv6
vrid	unsignedByte	VRID	42

DHCP server settings

Settings for DHCP server

dhcps: Attributes
Attribute	Type	Description	Default
boot	IP4Addr	Next/boot server
boot-file	string	Boot filename
broadcast	boolean	Broadcast replies even if not requested
circuit	string	Agent info circuit match
class	string	Vendor class match
client-name	string	Client name match
comment	string	Comment
dns	List of IP4Addr	DNS resolvers	Our IP
domain	string	DNS domain	From system settings
domain-search	string	DNS domain search list (list will be truncated to fit one attribute)
force	boolean	Send all options even if not requested
gateway	IP4Subnet	Gateway	Our IP
ip	List of IP4Range	Address pool	0.0.0.0/0
lease	duration	Lease length	2:00:00
log	NMTOKEN	Log events	Not logging
log-decline	NMTOKEN	Log events (declined)	Not logging
log-move	NMTOKEN	Log events (moved)	Not logging
log-new	NMTOKEN	Log events (new)	Not logging
log-release	NMTOKEN	Log events (released)	Not logging
log-renew	NMTOKEN	Log events (renewed)	Not logging
log-reuse	NMTOKEN	Log events (reused)	Not logging
mac	List of up to 12 macprefix (hexBinary)	Partial or full client hardware (MAC) addresses (or client-id MAC if specified)
mac-local	boolean	Match only local or non local MAC addresses
name	string	Name
ntp	List of IP4Addr	NTP server	Our IP
source	string	Source of data, used in automated config management
syslog	List of IP4Addr	Syslog server
time	List of IP4Addr	Time server	Our IP

dhcps: Elements
Element	Type	Instances	Description
send	dhcp-attr-hex	Optional, unlimited	Additional attributes to send (hex)
send-ip	dhcp-attr-ip	Optional, unlimited	Additional attributes to send (IP)
send-number	dhcp-attr-number	Optional, unlimited	Additional attributes to send (numeric)
send-string	dhcp-attr-string	Optional, unlimited	Additional attributes to send (string)

DHCP server attributes (hex)

Additional DHCP server attributes (hex)

dhcp-attr-hex: Attributes
Attribute	Type	Description	Default
comment	string	Comment
force	boolean	Send even if not requested
id	unsignedByte	Attribute type code/tag	Not optional
name	string	Name
value	hexBinary	Value	Not optional
vendor	boolean	Add as vendor specific option (under option 43)

DHCP server attributes (string)

Additional DHCP server attributes (string)

dhcp-attr-string: Attributes
Attribute	Type	Description	Default
comment	string	Comment
force	boolean	Send even if not requested
id	unsignedByte	Attribute type code/tag	Not optional
name	string	Name
value	string	Value	Not optional
vendor	boolean	Add as vendor specific option (under option 43)

DHCP server attributes (numeric)

Additional DHCP server attributes (numeric)

dhcp-attr-number: Attributes
Attribute	Type	Description	Default
comment	string	Comment
force	boolean	Send even if not requested
id	unsignedByte	Attribute type code/tag	Not optional
name	string	Name
value	unsignedInt	Value	Not optional
vendor	boolean	Add as vendor specific option (under option 43)

DHCP server attributes (IP)

Additional DHCP server attributes (IP)

dhcp-attr-ip: Attributes
Attribute	Type	Description	Default
comment	string	Comment
force	boolean	Send even if not requested
id	unsignedByte	Attribute type code/tag	Not optional
name	string	Name
value	IP4Addr	Value	Not optional
vendor	boolean	Add as vendor specific option (under option 43)

Static routes

Static routes define prefixes which are permanently in the routing table, and whether these should be announced by routing protocols or not.

route: Attributes
Attribute	Type	Description	Default
comment	string	Comment
gateway	List of IPAddr	One or more target gateway IPs	Not optional
graph	graphname (token)	Graph name
ip	List of IPPrefix	One or more network prefixes	Not optional
localpref	unsignedInt	Localpref of network (highest wins)	4294967295
name	string	Name
source	string	Source of data, used in automated config management
speed	unsignedInt	Egress rate limit (b/s)
table	routetable 0-99	Routing table number	0

Dead end networks

Networks that go nowhere

blackhole: Attributes
Attribute	Type	Description	Default
comment	string	Comment
ip	List of IPPrefix	One or more network prefixes	Not optional
localpref	unsignedInt	Localpref of network (highest wins)	4294967295
name	string	Name
source	string	Source of data, used in automated config management
table	routetable 0-99	Routing table number	0

Locally originated networks

Loopback addresses define local IP addresses

loopback: Attributes
Attribute	Type	Description	Default
comment	string	Comment
ip	List of IPAddr	One or more local network addresses	Not optional
localpref	unsignedInt	Localpref of network (highest wins)	4294967295
name	string	Name
source	string	Source of data, used in automated config management
table	routetable 0-99	Routing table number	0

Constant Quality Monitoring settings

Constant quality monitoring (graphs and data) have a number of settings. Most of the graphing settings can be overridden when a graph is collected so these define the defaults in many cases.

cqm: Attributes
Attribute	Type	Description	Default
auto-refresh-list	boolean	Auto refresh graph list pages (for trusted IPs)	true
ave	Colour	Colour for average latency	#08f
axis	Colour	Axis colour	black
background	Colour	Background colour	white
bottom	unsignedByte	Pixels space at bottom of graph	11
dateformat	string	Date format	%Y-%m-%d
dayformat	string	Day format	%a
fail	Colour	Colour for failed (dropped) seconds	red
fail-level	unsignedInt	Fail level not expected on low usage	1
fail-level1	unsignedByte	Loss level 1	3
fail-level2	unsignedByte	Loss level 2	50
fail-score	unsignedByte	Score for fail and low usage	200
fail-score1	unsignedByte	Score for on/above level 1	100
fail-score2	unsignedByte	Score for on/above level 2	200
fail-usage	unsignedInt	Usage below which fail is not expected	128000
fblogo	Colour	Colour for logo	#bd1220
graticule	Colour	Graticule colour	grey
heading	string	Heading of graph
hourformat	string	Hour format	%H
key	unsignedByte	Pixels space for key	90
label-ave	string	Label for average latency	Ave
label-fail	string	Label for seconds (%) failed	%Fail
label-latency	string	Label for latency	Latency
label-max	string	Label for maximum latency	Max
label-min	string	Label for minimum latency	Min
label-off	string	Label for off line seconds	Off
label-period	string	Label for period	Period
label-poll	string	Label for polls	Polls
label-rej	string	Label for rejected seconds	%Reject
label-rx	string	Label for Rx traffic level	Rx
label-score	string	Label for score	Score
label-sent	string	Label for seconds polled	Sent
label-time	string	Label for time	Time
label-traffic	string	Label for traffic level	Traffic (bit/s)
label-tx	string	Label for Tx traffic level	Tx
latency-level	unsignedInt	Latency level not expected on low usage	100000000
latency-level1	unsignedInt	Latency level 1 (ns)	100000000
latency-level2	unsignedInt	Latency level 2 (ns)	500000000
latency-score	unsignedByte	Score for high latency and low usage	200
latency-score1	unsignedByte	Score for on/above level 1	10
latency-score2	unsignedByte	Score for on/above level 2	20
latency-usage	unsignedInt	Usage below which latency is not expected	128000
left	unsignedByte	Pixels space left of main graph	0
log	NMTOKEN	Log events	Not logging
marker-width	string	Stroke width for marker (+) on tx/rx (e.g. 4)
max	Colour	Colour for maximum latency	green
min	Colour	Colour for minimum latency	#008
ms-max	positiveInteger	ms max height	500
off	Colour	Colour for off line seconds	#c8f
outside	Colour	Colour for outer border	transparent
rej	Colour	Colour for off line seconds	#f8c
right	unsignedByte	Pixels space right of main graph	50
rx	Colour	Colour for Rx traffic level	#800
secret	Secret	Secret for SHA1 coded URLs
sent	Colour	Colour for polled seconds	#ff8
stroke-width	string	Stroke line for tx/rx	4 if no marker
subheading	string	Subheading of graph
svg-css	string	URL for SVG CSS instead of local style settings
svg-title	boolean	Include mouseover title text on svg
text	Colour	Colour for text	black
text1	string	Text line 1
text2	string	Text line 2
text3	string	Text line 3
text4	string	Text line 4
timeformat	string	Time format	%Y-%m-%d %H:%M:%S
top	unsignedByte	Pixels space at top of graph	4
tx	Colour	Colour for Tx traffic level	#080

IP Group

Named IP group

ip-group: Attributes
Attribute	Type	Description	Default
comment	string	Comment
ip	List of IPRange	One or more IP ranges or IP/len
name	string	Name	Not optional
source	string	Source of data, used in automated config management
users	List of NMTOKEN	Include IP of (time limited) logged in web users

User login level

User login level - commands available are restricted according to assigned level.

Tag	Description
NOBODY	Unknown or not logged in user
GUEST	Guest user
USER	Normal unprivileged user
ADMIN	System administrator
DEBUG	System debugger

PPP dump format

Tag	Description
default	Mixed hex/decode
decoded	Decoded only
decoded+raw	Decoded + raw
raw	Raw hex

Type of s/w auto load

Tag	Description
false	Do no auto load
factory	Load factory releases
beta	Load beta test releases
alpha	Load test releases

Type of access user has to config

Tag	Description
none	No access unless explicitly listed
view	View only access (no passwords)
read	Read only access (with passwords)
demo	Full view and edit access but can only test config, not save
test	Full view and edit access but must test save config first
full	Full view and edit access

Subsystem with EAP access control

Tag	Description
IPsec	IPsec/IKEv2 VPN

EAP access method

Tag	Description
MD5	MD5 Challenge
MSChapV2	MS Challenge

Syslog severity

Log severity - different loggable events log at different levels.

Tag	Description
EMERG	System is unstable
ALERT	Action must be taken immediately
CRIT	Critical conditions
ERR	Error conditions
WARNING	Warning conditions
NOTICE	Normal but significant events
INFO	Informational
DEBUG	Debug level messages
NO-LOGGING	No logging

Syslog facility

Syslog facility, usually used to control which log file the syslog is written to.

Tag	Description
KERN	Kernel messages
USER	User level messges
MAIL	Mail system
DAEMON	System Daemons
AUTH	Security/auth
SYSLOG	Internal to syslogd
LPR	Printer
NEWS	News
UUCP	UUCP
CRON	Cron deamon
AUTHPRIV	private security/auth
FTP	File transfer
12	Unused
13	Unused
14	Unused
15	Unused
LOCAL0	Local 0
LOCAL1	Local 1
LOCAL2	Local 2
LOCAL3	Local 3
LOCAL4	Local 4
LOCAL5	Local 5
LOCAL6	Local 6
LOCAL7	Local 7

HTTP/HTTPS security mode

Tag	Description
http-only	No HTTPS access
http+https	Both HTTP and HTTPS access
https-only	No HTTP access
redirect-to-https	HTTP accesses are redirected to use HTTPS
redirect-to-https-except-trusted	HTTP accesses are redirected to use HTTPS (except trusted IPs)

Month name (3 letter)

Tag	Description
Jan	January
Feb	February
Mar	March
Apr	April
May	May
Jun	June
Jul	July
Aug	August
Sep	September
Oct	October
Nov	November
Dec	December

Day name (3 letter)

Tag	Description
Sun	Sunday
Mon	Monday
Tue	Tuesday
Wed	Wednesday
Thu	Thursday
Fri	Friday
Sat	Saturday

Physical port

Tag	Description
0	Port 0 (not valid) (deprecated)
1	Port 1
2	Port 2
3	Port 3
4	Port 4
5	Port 5
6	Port 6
7	Port 7
8	Port 8
9	Port 9
10	Port 10

Physical port flow control setting

Tag	Description
none	No flow control
symmetric	Can support two-way flow control
send-pauses	Can send pauses but does not support pause reception
any	Can receive pauses and may send pauses if required

Physical port Gigabit clock master/slave setting

Tag	Description
prefer-master	Master status negotiated; preference for master
prefer-slave	Master status negotiated; preference for slave
force-master	Master status forced
force-slave	Slave status forced

Link fault type to send

Tag	Description
false	No fault
true	Send fault
off-line	Send offline fault (1G)
ane	Send ANE fault (1G)

Trunk port mode

Tag	Description
false	Not trunking
random	Random trunking
l2-hash	L2 hashed trunking
l23-hash	L2 and L3 hashed trunking
l3-hash	L3 hashed trunking

IPv6 route announce level

IPv6 route announcement mode and level

Tag	Description
false	Do not announce
low	Announce as low priority
medium	Announce as medium priority
high	Announce as high priority
true	Announce as default (medium) priority

Source filter option

Tag	Description
false	No source filter checks
blackhole	Check replies blackholed
nowhere	Check replies valid
self	Check replies valid and not self
true	Check replies down same port/vlan

Basic types

Type	Description
string	text string
token	text string
hexBinary	hex coded binary data
integer	integer (-2147483648-2147483647)
positiveInteger	positive integer (1-4294967295)
unsignedInt	unsigned integer (0-4294967295)
unsignedShort	unsigned short integer (0-65535)
unsignedByte	unsigned byte integer (0-255)
boolean	Boolean
dateTime	YYYY-MM-DDTHH:MM:SS date/time
time	HH:MM:SS time
NMTOKEN	String with no spaces
void	Internal use
IPAddr	IP address
IPNameAddr	IP address or name
IP4Addr	IPv4 address
IP6Addr	IPv6 address
IP46Addr	IPv4 + IPv6 address
IPPrefix	IP address / bitlen
IPRange	IP address / bitlen or range
IPNameRange	IP address / bitlen or range or name
IP4Range	IPv4 address / bitlen or range
IP4Prefix	IPv4 address / bitlen
IPSubnet	IP address / bitlen
IP4Subnet	IPv4 address / bitlen
IPFilter	Route filter
Password	Password
OTP	OTP
Community	xxx:xxx community
PortRange	xxx-xxx port range
Colour	#rgb #rrggbb #rgba #rrggbbaa colour
Secret	Secret/passphrase
duration	Period [[HH:]MM:]SS
fb-sw-update-delay	[unsignedByte] Number of days to delay upgrade by (0-30)
percentage	[unsignedByte] Percentage (0 .. 100) (0-100)
routetable	[unsignedByte] Route table number (0-99)
username	[NMTOKEN] Login name
ipnamerangelist	[IPNameRange] List of IPranges or ip groups
nmtokenlist	[NMTOKEN] List of NMTOKEN
stringlist	[string] List of strings
iplist	[IPAddr] List of IP addresses
ipnamelist	[IPNameAddr] List of IP addresses or domain names
datenum	[unsignedByte] Day number in month (1-31)
subnetlist	[IPSubnet] List of subnets
ra-max	[unsignedShort] Route announcement max interval (seconds) (4-1800)
ra-min	[unsignedShort] Route announcement min interval (seconds) (3-1350)
ip6list	[IP6Addr] List of IPv6 addresses
mtu	[unsignedShort] Max transmission unit (576-2000)
vlan	[unsignedShort] VLAN ID (0=untagged) (0-4095)
ip4rangelist	[IP4Range] List of IP4ranges
macprefixlist	[macprefix] List of strings
macprefix	[hexBinary] MAC prefix
ip4list	[IP4Addr] List of IPv4 addresses
graphname	[token] Graph name
prefixlist	[IPPrefix] List of IP Prefixes
iprangelist	[IPRange] List of IPranges
userlist	[username] List of user names
prefix4list	[IP4Prefix] List of IPv4 Prefixes
filterlist	[IPFilter] List of IP Prefix filters
communitylist	[Community] List of BGP communities
portlist	[PortRange] List of protocol port ranges
protolist	[unsignedByte] List of IP protocols
unsignedIntList	[unsignedInt] List of integers
routetableset	[routetable] Set of routetables
aslist	[unsignedIntList] List of AS numbers
vlan-nz	[unsignedShort] VLAN ID (1-4095)
dates	[datenum] Set of dates
cug	[unsignedShort] CUG ID (1-32767)
tun-id	[unsignedShort] Local tunnel ID (1-100)
ses-id	[unsignedShort] Local session ID (1-500)
hostname	[NMTOKEN] Host name
sip-error	[unsignedShort] SIP error code (400-699)
shaper-limit	[unsignedShort] Shaper limit (ms) (0-1000)