FireBrick FB9000 User Manual
   Next

FireBrick FB9000 User Manual

This User Manual documents Software version V2.00.100

Copyright © 2012-2023 FireBrick Ltd.

Table of Contents

Preface
1. Introduction
1.1. The FB9000
1.1.1. Where do I start?
1.1.2. What can it do?
1.1.3. Ethernet port capabilities
1.2. About this Manual
1.2.1. Version
1.2.2. Intended audience
1.2.3. Technical details
1.2.4. Document style
1.2.5. Document conventions
1.2.6. Comments and feedback
1.3. Additional Resources
1.3.1. Technical Support
1.3.2. IRC Channel
1.3.3. Application Notes
1.3.4. Training Courses
2. Getting Started
2.1. IP addressing
2.2. Accessing the web-based user interface
2.2.1. Initial configuration
3. Configuration
3.1. The Object Hierarchy
3.2. The Object Model
3.2.1. Formal definition of the object model
3.2.2. Common attributes
3.3. Configuration Methods
3.4. Configuration upgrades and versioning
3.5. Data types
3.5.1. Sending and receiving values
3.5.2. Lists of values
3.5.3. Set of possible values
3.5.4. Dates, times, and durations
3.5.5. Colours
3.5.6. Passwords and secrets
3.5.7. IP addresses
3.5.7.1. Simple IP addresses
3.5.7.2. Subnets and prefixes
3.5.7.3. Ranges
3.5.7.4. Prefix filters
3.6. Web User Interface Overview
3.6.1. User Interface layout
3.6.2. Config pages and the object hierarchy
3.6.2.1. Configuration categories
3.6.2.2. Object settings
3.6.3. Navigating around the User Interface
3.6.4. Backing up / restoring the configuration
3.6.5. Customising the layout
3.7. Configuration using XML
3.7.1. Introduction to XML
3.7.2. The root element - <config>
3.7.3. Viewing or editing XML
3.7.4. Example XML configuration
3.8. Downloading/Uploading the configuration
3.8.1. Download
3.8.2. Upload
4. System Administration
4.1. User Management
4.1.1. Login level
4.1.2. Configuration access level
4.1.3. Login idle timeout
4.1.4. Restricting user logins
4.1.4.1. Restrict by IP address
4.1.4.2. Logged in IP address
4.1.4.3. Restrict by profile
4.1.5. Password change
4.1.6. One Time Password (OTP)
4.2. General System settings
4.2.1. System name (hostname)
4.2.2. Administrative details
4.2.3. System-level event logging control
4.2.4. Home page web links
4.3. Software Upgrades
4.3.1. Software release types
4.3.1.1. Breakpoint releases
4.3.2. Identifying current software version
4.3.3. Internet-based upgrade process
4.3.3.1. Manually initiating upgrades
4.3.3.2. Controlling automatic software updates
4.3.4. Manual upgrade
4.4. Boot Process
4.4.1. LED indications
4.4.1.1. Status LED indications
4.4.1.2. Port LEDs
5. Event Logging
5.1. Overview
5.1.1. Log targets
5.1.1.1. Logging to Flash memory
5.1.1.2. Logging to the Console
5.2. Enabling logging
5.3. Logging to external destinations
5.3.1. Syslog
5.3.2. Email
5.3.2.1. E-mail process logging
5.4. Factory reset configuration log targets
5.5. Performance
5.6. Viewing logs
5.6.1. Viewing logs in the User Interface
5.6.2. Viewing logs in the CLI environment
5.7. System-event logging
5.8. Using Profiles
6. Interfaces and Subnets
6.1. Relationship between Interfaces and Physical Ports
6.1.1. Port groups
6.1.2. Interfaces
6.2. Defining port groups
6.3. Defining an interface
6.3.1. Defining subnets
6.3.1.1. Source filtering
6.3.1.2. Using DHCP to configure a subnet
6.3.1.3. Using SLAAC (IPv6 router announcements) to configure a subnet
6.3.1.4. Providing IPv6 addresses to devices on a network (IPv6 router announcements)
6.3.1.5. IPv6 prefix delegated subnets
6.3.2. Setting up DHCP server parameters
6.3.2.1. Fixed/Static DHCP allocations
6.3.2.2. Restricted allocations
6.3.2.3. Special DHCP options
6.3.2.4. Logging
6.3.3. DHCP Relay Agent
6.4. Physical port settings
6.4.1. Disabling auto-negotiation
6.4.2. Setting port speed
6.4.3. Setting duplex mode
6.4.4. Defining port LED functions
7. Session Handling
7.1. Routing vs. Firewalling
7.2. Session Tracking
7.2.1. Session termination
7.3. Session Rules
7.3.1. Overview
7.3.2. Processing flow
7.3.3. Defining Rule-Sets and Rules
7.3.3.1. Recommended method of implementing firewalling
7.3.3.2. Changes to session traffic
7.3.3.3. Graphing and traffic shaping
7.3.3.4. Configuring session time-outs
7.3.3.5. Load balancing
7.3.3.6. Clashes
7.3.3.7. NAT-PMP / PCP (Port Control Protocol)
7.4. Network Address Translation
7.4.1. When to use NAT
7.4.2. NAT ALGs
7.4.3. Setting NAT in rules
7.4.4. What NAT does
7.4.5. NAT with PPPoE
7.4.6. NAT with other types of external routing
7.4.7. Mixing NAT and non NAT
7.4.8. Carrier grade NAT
7.4.9. Using NAT setting on subnets
8. Routing
8.1. Routing logic
8.2. Routing targets
8.2.1. Subnet routes
8.2.2. Routing to an IP address (gateway route)
8.2.3. Special targets
8.3. Dynamic route creation / deletion
8.4. Routing tables
8.5. Bonding
8.6. Route overrides
9. Profiles
9.1. Overview
9.2. Creating/editing profiles
9.2.1. Timing control
9.2.2. Tests
9.2.2.1. General tests
9.2.2.2. Time/date tests
9.2.2.3. Ping tests
9.2.3. Inverting overall test result
9.2.4. Manual override
9.2.5. Scripting
10. Traffic Shaping
10.1. Graphs and Shapers
10.1.1. Graphs
10.1.2. Shapers
10.1.3. Ad hoc shapers
10.1.4. Long term shapers
10.1.5. Shared shapers
10.2. Multiple shapers
10.3. Basic principles
11. PPPoE
11.1. PPPoE client
11.2. Types of DSL line and router in the United Kingdom
11.3. Definining PPPoE client links
11.3.1. IPv6
11.3.2. Additional options
11.3.2.1. MTU and TCP fix
11.3.2.2. Service and ac-name
11.3.2.3. Logging
11.3.2.4. Speed and graphs
11.4. PPPoE BRAS
11.4.1. Additional options
12. MQTT
12.1. Limitations
12.2. Features
12.3. Integration with FireBrick operations
12.3.1. Profiles
12.3.2. VoIP
12.3.3. DHCP
12.3.4. RADIUS
13. Tunnels
13.1. IPsec (IP Security)
13.1.1. Introduction
13.1.1.1. Integrity checking
13.1.1.2. Encryption
13.1.1.3. Authentication
13.1.1.4. IKE
13.1.1.5. Manual Keying
13.1.1.6. Identities and the Authentication Mechanism
13.1.2. Setting up IPsec connections
13.1.2.1. Global IPsec parameters
13.1.2.2. IKE proposals
13.1.2.3. IKE roaming IP pools
13.1.2.4. IKE connections
13.1.2.4.1. IKE connection mode and type
13.1.2.4.2. IKE and IPsec proposal lists
13.1.2.4.3. Authentication and IKE identities
13.1.2.4.4. IP addresses
13.1.2.4.5. Road Warrior connections
13.1.2.4.6. Routing
13.1.2.4.7. Other parameters
13.1.2.5. Setting up Manual Keying
13.1.2.5.1. IP endpoints
13.1.2.5.2. Algorithms and keys
13.1.2.5.3. Routing
13.1.2.5.4. Mode
13.1.2.5.5. Other parameters
13.1.3. Using EAP with IPsec/IKE
13.1.4. Using certificates with IPsec/IKE
13.1.5. Choice of algorithms
13.1.6. NAT Traversal
13.1.7. Configuring a Road Warrior server
13.1.8. Connecting to non-FireBrick devices
13.1.8.1. Using StrongSwan on Linux
13.1.8.2. Setting up a Road Warrior VPN on an Android client
13.1.8.3. Setting up a Road Warrior VPN on an iOS (iPhone/iPad) client
13.1.8.4. Manual keying using Linux ipsec-tools
13.2. FB105 tunnels
13.2.1. Tunnel wrapper packets
13.2.2. Setting up a tunnel
13.2.3. Viewing tunnel status
13.2.4. Dynamic routes
13.2.5. Tunnel bonding
13.2.6. Tunnels and NAT
13.2.6.1. FB9000 doing NAT
13.2.6.2. Another device doing NAT
13.3. L2TP tunnelling
13.3.1. Incoming tunnel
13.3.2. Incoming session
13.3.3. Outgoing connection
13.3.4. High availability L2TP
13.3.4.1. Interpreting HA statistics
13.3.4.2. HA best practice
13.4. Ether tunnelling
14. System Services
14.1. Protecting the FB9000
14.2. Common settings
14.3. HTTP Server configuration
14.3.1. Access control
14.3.1.1. Trusted addresses
14.3.2. HTTPS access
14.4. Telnet Server configuration
14.4.1. Access control
14.5. DNS configuration
14.5.1. Auto DHCP DNS
14.5.2. Local DNS responses
14.5.3. Blocking DNS names
14.6. NTP configuration
14.7. SNMP configuration
14.8. RADIUS configuration
14.8.1. RADIUS server (platform RADIUS)
14.8.2. RADIUS client
14.8.2.1. RADIUS client settings
14.8.2.2. Server blacklisting
15. Network Diagnostic Tools
15.1. Firewalling check
15.2. Access check
15.3. Packet Dumping
15.3.1. Dump parameters
15.3.2. Security settings required
15.3.3. IP address matching
15.3.4. Packet types
15.3.5. Snaplen specification
15.3.6. Using the web interface
15.3.7. Using an HTTP client
15.3.7.1. Example using curl and tcpdump
16. VRRP
16.1. Virtual Routers
16.2. Configuring VRRP
16.2.1. Advertisement Interval
16.2.2. Priority
16.3. Using a virtual router
16.4. VRRP versions
16.4.1. VRRP version 2
16.4.2. VRRP version 3
16.5. Compatibility
17. BGP
17.1. What is BGP?
17.2. BGP Setup
17.2.1. Overview
17.2.2. Standards
17.2.3. Simple example setup
17.2.4. Peer type
17.2.5. Route filtering
17.2.5.1. Matching attributes
17.2.5.2. Action attributes
17.2.6. Well known community tags
17.2.7. Announcing black hole routes
17.2.8. Grey holes
17.2.9. Announcing dead end routes
17.2.10. Bad optional path attributes
17.2.11. <network> element
17.2.12. <route>, <subnet> and other elements
17.2.13. Route feasibility testing
17.2.14. Status
17.2.15. Diagnostics
17.2.16. Router startup and shutdown
17.2.17. TTL security
18. Internet Service Providers
18.1. Background
18.1.1. How it all began
18.1.2. Point to Point Protocol
18.1.3. L2TP
18.1.4. Broadband
18.1.5. RADIUS
18.1.6. BGP
18.2. Incoming L2TP connections
18.3. The importance of CQM graphs
18.4. Authentication
18.5. Accounting
18.6. RADIUS Control messages
18.7. PPPoE
18.8. Typical configuration
18.8.1. Interlink subnet
18.8.2. BGP with carrier
18.8.3. RADIUS session steering
18.8.4. L2TP endpoints
18.8.5. ISP RADIUS
19. Command Line Interface
A. Factory Reset Procedure
B. CIDR and CIDR Notation
C. MAC Addresses usage
C.1. Multiple MAC addresses?
C.2. How the FireBrick allocates MAC addresses
C.2.1. Interface
C.2.2. Subnet
C.2.3. PPPoE
C.2.4. Running out of MACs
C.3. Forcing particular MAC addresses
C.4. MAC address on label
C.5. Using with a DHCP server
D. Scripted access
D.1. Tools
D.2. Access control
D.2.1. Username and password
D.2.2. OTP
D.2.3. Allow list
D.2.4. Allowed access
D.3. XML data for common functions
D.4. XML data from diagnostics and tests
D.4.1. Cross site scripting security
D.4.2. Arguments to scripts
D.5. Special URLs
D.6. Web sockets
E. VLANs : A primer
F. Supported L2TP Attribute/Value Pairs
F.1. Start-Control-Connection-Request
F.2. Start-Control-Connection-Reply
F.3. Start-Control-Connection-Connected
F.4. Stop-Control-Connection-Notification
F.5. Hello
F.6. Incoming-Call-Request
F.7. Incoming-Call-Reply
F.8. Incoming-Call-Connected
F.9. Outgoing-Call-Request
F.10. Outgoing-Call-Reply
F.11. Outgoing-Call-Connected
F.12. Call-Disconnect-Notify
F.13. WAN-Error-Notify
F.14. Set-Link-Info
F.15. Notes
F.15.1. BT specific notes
F.15.2. IP over LCP
G. Supported RADIUS Attribute/Value Pairs for L2TP operation
G.1. Authentication request
G.2. Authentication response
G.2.1. Accepted authentication
G.2.1.1. Prefix Delegation
G.2.2. Rejected authentication
G.3. Accounting Start
G.4. Accounting Interim
G.5. Accounting Stop
G.6. Disconnect
G.7. Change of Authorisation
G.8. Filter ID
G.9. Notes
G.9.1. L2TP relay
G.9.2. LCP echo and CQM graphs
G.9.3. IP over LCP
G.9.4. Closed User Group
G.9.5. Routing table
H. FireBrick specific SNMP objects
H.1. Conventions
H.1.1. IP addresses as indices
H.2. Firebrick-specific structures for BGP
H.2.1. Structure definitions
H.2.1.1. The list of BGP peers for this Firebrick
H.2.2. Enum Definitions
H.3. Firebrick-specific structures for IPSec
H.3.1. Structure definitions
H.3.1.1. fbIPsecGeneral
H.3.1.2. The list of IPsec connections for this Firebrick
H.3.2. Enum Definitions
H.4. Firebrick-specific structures for L2TP
H.4.1. Structure definitions
H.4.1.1. fbL2tpGeneralTunnels
H.4.1.2. fbL2tpGeneralSessions
H.4.1.3. The list of L2TP peers for this Firebrick
H.5. Firebrick CPU usage
H.5.1. Structure definitions
H.5.1.1. CPU usage for this Firebrick
H.6. Firebrick system stats
H.6.1. Structure definitions
H.6.1.1. The table of runtime stats for this Firebrick
H.7. Monitoring for general system features
H.7.1. Structure definitions
H.7.1.1. The list of readings for this Firebrick
H.8. System wide status
H.8.1. Structure definitions
H.8.1.1. fbGlobalMemory
H.8.1.2. fbGlobalBuffers
I. Command line reference
I.1. General commands
I.1.1. Trace off
I.1.2. Trace on
I.1.3. Uptime
I.1.4. General status
I.1.5. Memory usage
I.1.6. Process/task usage
I.1.7. Login
I.1.8. Logout
I.1.9. See XML configuration
I.1.10. Load XML configuration
I.1.11. Show profile status
I.1.12. Enable profile control switch
I.1.13. Disable profile control switch
I.1.14. Show RADIUS servers
I.1.15. Show DNS resolvers
I.2. Networking commands
I.2.1. Subnets
I.2.2. Renegotiate DHCP for a subnet
I.2.3. Ping and trace
I.2.4. Show a route from the routing table
I.2.5. List routes
I.2.6. List routing next hops
I.2.7. See DHCP allocations
I.2.8. Clear DHCP allocations
I.2.9. Lock DHCP allocations
I.2.10. Unlock DHCP allocations
I.2.11. Name DHCP allocations
I.2.12. Show ARP/ND status
I.2.13. Show VRRP status
I.2.14. Send Wake-on-LAN packet
I.3. Firewalling commands
I.3.1. Check access to services
I.3.2. Check firewall logic
I.4. Logging commands
I.4.1. Show Log
I.5. BGP commands
I.5.1. Show BGP
I.5.2. Show BGP Peer
I.5.3. Show BGP Summary
I.5.4. Show BGP Routes
I.5.5. Clear BGP
I.5.6. Refresh BGP
I.5.7. Refresh BGP
I.6. PPPoE commands
I.6.1. Show PPPoE
I.6.2. Show PPPoE
I.6.3. Clear PPPoE
I.7. L2TP commands
I.7.1. Show L2TP
I.7.2. Show L2TP Tunnels
I.7.3. Clear L2TP All
I.7.4. Show L2TP Tunnel
I.7.5. Show L2TP Tunnel
I.7.6. Show L2TP Sessions
I.7.7. Show L2TP Session
I.7.8. Clear L2TP Tunnel
I.7.9. Clear L2TP Tunnel
I.7.10. Clear L2TP Session
I.8. Advanced commands
I.8.1. Panic
I.8.2. Reboot
I.8.3. Screen width
I.8.4. Make outbound command session
I.8.5. Show command sessions
I.8.6. Kill command session
I.8.7. Flash memory list
I.8.8. Delete block from flash
I.8.9. Boot log
I.8.10. Flash log
J. Constant Quality Monitoring - technical details
J.1. Broadband back-haul providers
J.2. Access to graphs and csvs
J.2.1. Trusted access
J.2.2. Dated information
J.2.3. Authenticated access
J.3. Graph display options
J.3.1. Scaleable Vector Graphics
J.3.2. Data points
J.3.3. Additional text
J.3.4. Other colours and spacing
J.4. Overnight archiving
J.4.1. Full URL format
J.4.2. load handling
J.5. Graph scores
J.6. Creating graphs, and graph names
J.7. Ping
J.7.1. Automated ping control
J.7.2. Bulk ping configuration via a URL
J.7.3. Stopping Ping Graphs
K. Hashed passwords
K.1. Password hashing
K.1.1. Salt
K.2. One Time Password seed hashing
L. Configuration Objects
L.1. Top level
L.1.1. config: Top level config
L.2. Objects
L.2.1. system: System settings
L.2.2. link: Web links
L.2.3. routing-table: Default source IP for services using a given table
L.2.4. user: Admin users
L.2.5. eap: User access controlled by EAP
L.2.6. log: Log target controls
L.2.7. log-syslog: Syslog logger settings
L.2.8. log-email: Email logger settings
L.2.9. services: System services
L.2.10. http-service: Web service settings
L.2.11. dns-service: DNS service settings
L.2.12. dns-host: Fixed local DNS host settings
L.2.13. dns-block: Fixed local DNS blocks
L.2.14. radius-service: RADIUS service definition
L.2.15. radius-service-match: Matching rules for RADIUS service
L.2.16. radius-server: RADIUS server settings
L.2.17. mqtt-service: MQTT
L.2.18. mqtts-config: Secure MQTTS service
L.2.19. mqtt-config: Insecure MQTT service
L.2.20. mqtt-external: External MQTT/MQTTS connection
L.2.21. mqtt-map: MQTT message mapping
L.2.22. telnet-service: Telnet service settings
L.2.23. snmp-service: SNMP service settings
L.2.24. time-service: System time server settings
L.2.25. ethernet: Physical port controls
L.2.26. sampling: Packet sampling configuration
L.2.27. portdef: Port grouping and naming
L.2.28. interface: Port-group/VLAN interface settings
L.2.29. subnet: Subnet settings
L.2.30. subnet-template: Subnet option templates for RA
L.2.31. vrrp: VRRP settings
L.2.32. dhcps: DHCP server settings
L.2.33. dhcp-attr-hex: DHCP server attributes (hex)
L.2.34. dhcp-attr-string: DHCP server attributes (string)
L.2.35. dhcp-attr-number: DHCP server attributes (numeric)
L.2.36. dhcp-attr-ip: DHCP server attributes (IP)
L.2.37. pppoe: PPPoE settings
L.2.38. ppp-route: PPP routes
L.2.39. route: Static routes
L.2.40. network: Locally originated networks
L.2.41. blackhole: Dead end networks
L.2.42. loopback: Locally originated networks
L.2.43. namedbgpmap: Mapping and filtering rules of BGP prefixes
L.2.44. bgprule: Individual mapping/filtering rule
L.2.45. bgp: Overall BGP settings
L.2.46. bgppeer: BGP peer definitions
L.2.47. bgpmap: Mapping and filtering rules of BGP prefixes
L.2.48. cqm: Constant Quality Monitoring settings
L.2.49. l2tp: L2TP settings
L.2.50. l2tp-outgoing: L2TP settings for outgoing L2TP connections
L.2.51. l2tp-incoming: L2TP settings for incoming L2TP connections
L.2.52. l2tp-relay: Relay and local authentication rules for L2TP
L.2.53. fb105: FB105 tunnel definition
L.2.54. fb105-route: FB105 routes
L.2.55. ipsec-ike: IPsec configuration (IKEv2)
L.2.56. ike-connection: connection configuration
L.2.57. ipsec-route: IPsec tunnel routes
L.2.58. ike-roaming: IKE roaming IP pools
L.2.59. ike-proposal: IKE security proposal
L.2.60. ipsec-proposal: IPsec AH/ESP proposal
L.2.61. ipsec-manual: peer configuration
L.2.62. ping: Ping/graph definition
L.2.63. profile: Control profile
L.2.64. profile-date: Test passes if within any of the time ranges specified
L.2.65. profile-time: Test passes if within any of the date/time ranges specified
L.2.66. profile-ping: Test passes if any addresses are pingable
L.2.67. shaper: Traffic shaper
L.2.68. shaper-override: Traffic shaper override based on profile
L.2.69. ip-group: IP Group
L.2.70. route-override: Routing override rules
L.2.71. session-route-rule: Routing override rule
L.2.72. session-route-share: Route override load sharing
L.2.73. rule-set: Firewall/mapping rule set
L.2.74. session-rule: Firewall rules
L.2.75. session-share: Firewall load sharing
L.2.76. etun: Ether tunnel
L.2.77. dhcp-relay: DHCP server settings for remote / relayed requests
L.3. Data types
L.3.1. user-level: User login level
L.3.2. ppp-dump: PPP dump format
L.3.3. autoloadtype: Type of s/w auto load
L.3.4. config-access: Type of access user has to config
L.3.5. eap-subsystem: Subsystem with EAP access control
L.3.6. eap-method: EAP access method
L.3.7. syslog-severity: Syslog severity
L.3.8. syslog-facility: Syslog facility
L.3.9. http-mode: HTTP/HTTPS security mode
L.3.10. radiuspriority: Options for controlling platform RADIUS response priority tagging
L.3.11. radiustype: Type of RADIUS server
L.3.12. mqtt-brokers: Select MQTT brokers
L.3.13. month: Month name (3 letter)
L.3.14. day: Day name (3 letter)
L.3.15. port: Physical port
L.3.16. LinkFlow: Physical port flow control setting
L.3.17. LinkClock: Physical port Gigabit clock master/slave setting
L.3.18. LinkFault: Link fault type to send
L.3.19. sampling-protocol: Sampling protocol
L.3.20. trunk-mode: Trunk port mode
L.3.21. ramode: IPv6 route announce level
L.3.22. bgpmode: BGP announcement mode
L.3.23. sampling-mode: Sampling mode
L.3.24. sfoption: Source filter option
L.3.25. pppoe-mode: Type of PPPoE connection
L.3.26. pppoe-calling: Additional prefix on PPPoE calling ID
L.3.27. peertype: BGP peer type
L.3.28. ha-set: High availability set ID
L.3.29. radius-nas: NAS IP to report
L.3.30. ipsec-type: IPsec encapsulation type
L.3.31. ike-authmethod: authentication method
L.3.32. ike-mode: connection setup mode
L.3.33. ipsec-auth-algorithm: IPsec authentication algorithm
L.3.34. ipsec-crypt-algorithm: IPsec encryption algorithm
L.3.35. ike-PRF: IKE Pseudo-Random Function
L.3.36. ike-DH: IKE Diffie-Hellman group
L.3.37. ike-ESN: IKE Sequence Number support
L.3.38. ipsec-encapsulation: Manually keyed IPsec encapsulation mode
L.3.39. switch: Profile manual setting
L.3.40. dynamic-graph: Type of dynamic graph
L.3.41. firewall-action: Firewall action
L.4. Basic types
Index

List of Figures

2.1. Initial web page in factory reset state
3.1. Icons for configuration categories
3.2. The "Setup" category
3.3. Editing an "Interface" object
3.4. Show hidden attributes
3.5. Attribute definitions
3.6. Navigation controls
4.1. Setting up a new user
4.2. Software upgrade available notification
4.3. Manual Software upload
7.1. Example sessions created by drop and reject actions
7.2. Processing flow chart for rule-sets and session-rules
C.1. Product label showing MAC address range

List of Tables

2.1. IP addresses for computer
2.2. IP addresses to access the FireBrick
2.3. IP addresses to access the FireBrick
3.1. Special character sequences
4.1. User login levels
4.2. Configuration access levels
4.3. General administrative details attributes
4.4. Attributes controlling auto-upgrades
4.5. Status LED indications
5.1. Logging attributes
5.2. System-Event Logging attributes
6.1. Port LED functions
6.2. Example modified Port LED functions
7.1. Default timeouts for session tracking
7.2. Action attribute values
8.1. Example route targets
13.1. IPsec algorithm key lengths
13.2. IKE / IPsec algorithm proposals
13.3. HA statistic definitions
14.1. List of system services
14.2. List of system services
15.1. Packet dump parameters
15.2. Packet types that can be captured
17.1. Peer types
17.2. Communities
17.3. Network attributes
C.1. DHCP client names used
D.1. Special URLs
F.1. SCCRQ
F.2. SCCRP
F.3. SCCCN
F.4. StopCCN
F.5. HELLO
F.6. ICRQ
F.7. ICRP
F.8. ICCN
F.9. OCRQ
F.10. OCRP
F.11. OCCN
F.12. CDN
F.13. WEN
F.14. SLI
G.1. Access-request
G.2. Access-Accept
G.3. Access-Reject
G.4. Accounting-Start
G.5. Accounting-Interim
G.6. Accounting-Stop
G.7. Disconnect
G.8. Change-of-Authorisation
G.9. Filter-ID
H.1. Indices
H.2. Fields
H.3. FbBgpPeerState - The state of a BGP peer
H.4. Fields
H.5. Indices
H.6. Fields
H.7. FbIPsecConState - The state of an IPsec connection
H.8. Fields
H.9. Fields
H.10. Indices
H.11. Fields
H.12. Indices
H.13. Fields
H.14. Indices
H.15. Fields
H.16. Indices
H.17. Fields
H.18. Fields
H.19. Fields
J.1. File types
J.2. Colours
J.3. Text
J.4. Text
J.5. URL formats
L.1. config: Attributes
L.2. config: Elements
L.3. system: Attributes
L.4. system: Elements
L.5. link: Attributes
L.6. routing-table: Attributes
L.7. user: Attributes
L.8. eap: Attributes
L.9. log: Attributes
L.10. log: Elements
L.11. log-syslog: Attributes
L.12. log-email: Attributes
L.13. services: Elements
L.14. http-service: Attributes
L.15. dns-service: Attributes
L.16. dns-service: Elements
L.17. dns-host: Attributes
L.18. dns-block: Attributes
L.19. radius-service: Attributes
L.20. radius-service: Elements
L.21. radius-service-match: Attributes
L.22. radius-server: Attributes
L.23. mqtt-service: Attributes
L.24. mqtt-service: Elements
L.25. mqtts-config: Attributes
L.26. mqtt-config: Attributes
L.27. mqtt-external: Attributes
L.28. mqtt-map: Attributes
L.29. telnet-service: Attributes
L.30. snmp-service: Attributes
L.31. time-service: Attributes
L.32. ethernet: Attributes
L.33. sampling: Attributes
L.34. portdef: Attributes
L.35. interface: Attributes
L.36. interface: Elements
L.37. subnet: Attributes
L.38. subnet-template: Attributes
L.39. vrrp: Attributes
L.40. dhcps: Attributes
L.41. dhcps: Elements
L.42. dhcp-attr-hex: Attributes
L.43. dhcp-attr-string: Attributes
L.44. dhcp-attr-number: Attributes
L.45. dhcp-attr-ip: Attributes
L.46. pppoe: Attributes
L.47. pppoe: Elements
L.48. ppp-route: Attributes
L.49. route: Attributes
L.50. network: Attributes
L.51. blackhole: Attributes
L.52. loopback: Attributes
L.53. namedbgpmap: Attributes
L.54. namedbgpmap: Elements
L.55. bgprule: Attributes
L.56. bgp: Attributes
L.57. bgp: Elements
L.58. bgppeer: Attributes
L.59. bgppeer: Elements
L.60. bgpmap: Attributes
L.61. bgpmap: Elements
L.62. cqm: Attributes
L.63. l2tp: Attributes
L.64. l2tp: Elements
L.65. l2tp-outgoing: Attributes
L.66. l2tp-outgoing: Elements
L.67. l2tp-incoming: Attributes
L.68. l2tp-incoming: Elements
L.69. l2tp-relay: Attributes
L.70. fb105: Attributes
L.71. fb105: Elements
L.72. fb105-route: Attributes
L.73. ipsec-ike: Attributes
L.74. ipsec-ike: Elements
L.75. ike-connection: Attributes
L.76. ike-connection: Elements
L.77. ipsec-route: Attributes
L.78. ike-roaming: Attributes
L.79. ike-proposal: Attributes
L.80. ipsec-proposal: Attributes
L.81. ipsec-manual: Attributes
L.82. ipsec-manual: Elements
L.83. ping: Attributes
L.84. profile: Attributes
L.85. profile: Elements
L.86. profile-date: Attributes
L.87. profile-time: Attributes
L.88. profile-ping: Attributes
L.89. shaper: Attributes
L.90. shaper: Elements
L.91. shaper-override: Attributes
L.92. ip-group: Attributes
L.93. route-override: Attributes
L.94. route-override: Elements
L.95. session-route-rule: Attributes
L.96. session-route-rule: Elements
L.97. session-route-share: Attributes
L.98. rule-set: Attributes
L.99. rule-set: Elements
L.100. session-rule: Attributes
L.101. session-rule: Elements
L.102. session-share: Attributes
L.103. etun: Attributes
L.104. dhcp-relay: Attributes
L.105. dhcp-relay: Elements
L.106. user-level: User login level
L.107. ppp-dump: PPP dump format
L.108. autoloadtype: Type of s/w auto load
L.109. config-access: Type of access user has to config
L.110. eap-subsystem: Subsystem with EAP access control
L.111. eap-method: EAP access method
L.112. syslog-severity: Syslog severity
L.113. syslog-facility: Syslog facility
L.114. http-mode: HTTP/HTTPS security mode
L.115. radiuspriority: Options for controlling platform RADIUS response priority tagging
L.116. radiustype: Type of RADIUS server
L.117. mqtt-brokers: Select MQTT brokers
L.118. month: Month name (3 letter)
L.119. day: Day name (3 letter)
L.120. port: Physical port
L.121. LinkFlow: Physical port flow control setting
L.122. LinkClock: Physical port Gigabit clock master/slave setting
L.123. LinkFault: Link fault type to send
L.124. sampling-protocol: Sampling protocol
L.125. trunk-mode: Trunk port mode
L.126. ramode: IPv6 route announce level
L.127. bgpmode: BGP announcement mode
L.128. sampling-mode: Sampling mode
L.129. sfoption: Source filter option
L.130. pppoe-mode: Type of PPPoE connection
L.131. pppoe-calling: Additional prefix on PPPoE calling ID
L.132. peertype: BGP peer type
L.133. ha-set: High availability set ID
L.134. radius-nas: NAS IP to report
L.135. ipsec-type: IPsec encapsulation type
L.136. ike-authmethod: authentication method
L.137. ike-mode: connection setup mode
L.138. ipsec-auth-algorithm: IPsec authentication algorithm
L.139. ipsec-crypt-algorithm: IPsec encryption algorithm
L.140. ike-PRF: IKE Pseudo-Random Function
L.141. ike-DH: IKE Diffie-Hellman group
L.142. ike-ESN: IKE Sequence Number support
L.143. ipsec-encapsulation: Manually keyed IPsec encapsulation mode
L.144. switch: Profile manual setting
L.145. dynamic-graph: Type of dynamic graph
L.146. firewall-action: Firewall action
L.147. Basic data types

List of Examples

H.1.
H.2.
   Next
   Preface