1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
|
############
Route Policy
############
Route and IPv6 route policies are defined in this section. This route policies
can then be associated to interfaces.
*************
Configuration
*************
Route
=====
.. cfgcmd:: set policy route <text>
This command creates a new route policy, identified by <text>.
.. cfgcmd:: set policy route <text> description <text>
Set description for the route policy.
.. cfgcmd:: set policy route <text> enable-default-log
Option to log packets hitting default-action.
.. cfgcmd:: set policy route <text> rule <1-9999> description <text>
Set description for rule in route policy.
.. cfgcmd:: set policy route <text> rule <1-9999> action drop
Set rule action to drop.
.. cfgcmd:: set policy route <text> rule <1-9999> destination address
<match_criteria>
Set match criteria based on destination address, where <match_criteria>
could be:
* <x.x.x.x>: IP address to match.
* <x.x.x.x/x>: Subnet to match.
* <x.x.x.x>-<x.x.x.x>: IP range to match.
* !<x.x.x.x>: Match everything except the specified address.
* !<x.x.x.x/x>: Match everything except the specified subnet.
* !<x.x.x.x>-<x.x.x.x>: Match everything except the specified range.
.. cfgcmd:: set policy route <text> rule <1-9999> destination group
<address-group|network-group|port-group> <text>
Set destination match criteria based on groups, where <text> would be the
group name/identifier.
.. cfgcmd:: set policy route <text> rule <1-9999> destination port
<match_criteria>
Set match criteria based on destination port, where <match_criteria> could
be:
* <port name>: Named port (any name in /etc/services, e.g., http).
* <1-65535>: Numbered port.
* <start>-<end>: Numbered port range (e.g., 1001-1005).
Multiple destination ports can be specified as a comma-separated list. The
whole list can also be "negated" using '!'. For example:
'!22,telnet,http,123,1001-1005'
.. cfgcmd:: set policy route <text> rule <1-9999> disable
Option to disable rule.
.. cfgcmd:: set policy route <text> rule <1-9999> fragment
<match-grag|match-non-frag>
Set IP fragment match, where:
* match-frag: Second and further fragments of fragmented packets.
* match-non-frag: Head fragments or unfragmented packets.
.. cfgcmd:: set policy route <text> rule <1-9999> icmp <code|type|type-name>
Set ICMP match criterias, based on code and/or types. Types could be
referenced by number or by name.
.. cfgcmd:: set policy route <text> rule <1-9999> ipsec
<match-ipsec|match-none>
Set IPSec inbound match criterias, where:
* match-ipsec: match inbound IPsec packets.
* match-none: match inbound non-IPsec packets.
.. cfgcmd:: set policy route <text> rule <1-9999> limit burst <0-4294967295>
Set maximum number of packets to alow in excess of rate
.. cfgcmd:: set policy route <text> rule <1-9999> limit rate <text>
Set maximum average matching rate. Format for rate: integer/time_unit, where
time_unit could be any one of second, minute, hour or day.For example
1/second implies rule to be matched at an average of once per second.
.. cfgcmd:: set policy route <text> rule <1-9999> log <enable|disable>
Option to enable or disable log matching rule.
.. cfgcmd:: set policy route <text> rule <1-9999> log <text>
Option to log matching rule.
.. cfgcmd:: set policy route <text> rule <1-9999> protocol
<text|0-255|tcp_udp|all|!protocol>
Set protocol to match. Protocol name in /etc/protocols or protocol number,
or "tcp_udp" or "all". Also, protocol could be denied by using !.
.. cfgcmd:: set policy route <text> rule <1-9999> recent <count|time>
<1-255|0-4294967295>
Set parameters for matching recently seen sources. This match could be used
by seeting count (source address seen more than <1-255> times) and/or time
(source address seen in the last <0-4294967295> seconds).
.. cfgcmd:: set policy route <text> rule <1-9999> set dscp <0-63>
Set packet modifications: Packet Differentiated Services Codepoint (DSCP)
.. cfgcmd:: set policy route <text> rule <1-9999> set mark <1-2147483647>
Set packet modifications: Packet marking
.. cfgcmd:: set policy route <text> rule <1-9999> set table <main|1-200>
Set packet modifications: Routing table to forward packet with.
.. cfgcmd:: set policy route <text> rule <1-9999> set tcp-mss <500-1460>
Set packet modifications: Explicitly set TCP Maximum segment size value.
.. cfgcmd:: set policy route <text> rule <1-9999> source address
<match_criteria>
Set match criteria based on source address, where <match_criteria> could be:
* <x.x.x.x>: IP address to match.
* <x.x.x.x/x>: Subnet to match.
* <x.x.x.x>-<x.x.x.x>: IP range to match.
* !<x.x.x.x>: Match everything except the specified address.
* !<x.x.x.x/x>: Match everything except the specified subnet.
* !<x.x.x.x>-<x.x.x.x>: Match everything except the specified range.
.. cfgcmd:: set policy route <text> rule <1-9999> source group
<address-group|network-group|port-group> <text>
Set source match criteria based on groups, where <text> would be the group
name/identifier.
.. cfgcmd:: set policy route <text> rule <1-9999> source port <match_criteria>
Set match criteria based on source port, where <match_criteria> could be:
* <port name>: Named port (any name in /etc/services, e.g., http).
* <1-65535>: Numbered port.
* <start>-<end>: Numbered port range (e.g., 1001-1005).
Multiple source ports can be specified as a comma-separated list. The whole
list can also be "negated" using '!'. For example:
'!22,telnet,http,123,1001-1005'
.. cfgcmd:: set policy route <text> rule <1-9999> state
<established|invalid|new|related> <disable|enable>
Set match criteria based on session state.
.. cfgcmd:: set policy route <text> rule <1-9999> tcp flags <text>
Set match criteria based on tcp flags. Allowed values for TCP flags: SYN ACK
FIN RST URG PSH ALL. When specifying more than one flag, flags should be
comma-separated. For example : value of 'SYN,!ACK,!FIN,!RST' will only match
packets with the SYN flag set, and the ACK, FIN and RST flags unset.
.. cfgcmd:: set policy route <text> rule <1-9999> time monthdays <text>
Set monthdays to match rule on. Format for monthdays: 2,12,21.
To negate add ! at the front eg. !2,12,21
.. cfgcmd:: set policy route <text> rule <1-9999> time startdate <text>
Set date to start matching rule. Format for date: yyyy-mm-dd. To specify
time of date with startdate, append 'T' to date followed by time in 24 hour
notation hh:mm:ss. For eg startdate value of 2009-01-21T13:30:00 refers to
21st Jan 2009 with time 13:30:00.
.. cfgcmd:: set policy route <text> rule <1-9999> time starttime <text>
Set time of day to start matching rule. Format of time: hh:mm:ss using 24
hours notation.
.. cfgcmd:: set policy route <text> rule <1-9999> time stopdate <text>
Set date to stop matching rule. Format for date: yyyy-mm-dd. To specify time
of date with stopdate, append 'T' to date followed by time in 24 hour
notation hh:mm:ss. For eg startdate value of 2009-01-21T13:30:00 refers to
21st Jan 2009 with time 13:30:00.
.. cfgcmd:: set policy route <text> rule <1-9999> time stoptime <text>
Set time of day to stop matching rule. Format of time: hh:mm:ss using 24
hours notation.
.. cfgcmd:: set policy route <text> rule <1-9999> time utc
Interpret times for startdate, stopdate, starttime and stoptime to be UTC.
.. cfgcmd:: set policy route <text> rule <1-9999> time weekdays
Weekdays to match rule on. Format for weekdays: Mon,Thu,Sat. To negate add !
at the front eg. !Mon,Thu,Sat.
IPv6 Route
==========
.. cfgcmd:: set policy ipv6-route <text>
This command creates a new IPv6 route policy, identified by <text>.
.. cfgcmd:: set policy ipv6-route <text> description <text>
Set description for the IPv6 route policy.
.. cfgcmd:: set policy ipv6-route <text> enable-default-log
Option to log packets hitting default-action.
.. cfgcmd:: set policy ipv6-route <text> rule <1-9999> action drop
Set rule action to drop.
.. cfgcmd:: set policy ipv6-route <text> rule <1-9999> description <text>
Set description for rule in IPv6 route policy.
.. cfgcmd:: set policy ipv6-route <text> rule <1-9999> destination address
<match_criteria>
Set match criteria based on destination IPv6 address, where <match_criteria>
could be:
* <h:h:h:h:h:h:h:h>: IPv6 address to match.
* <h:h:h:h:h:h:h:h/x>: IPv6 prefix to match.
* <h:h:h:h:h:h:h:h>-<h:h:h:h:h:h:h:h>: IPv6 range to match.
* !<h:h:h:h:h:h:h:h>: Match everything except the specified address.
* !<h:h:h:h:h:h:h:h/x>: Match everything except the specified prefix.
* !<h:h:h:h:h:h:h:h>-<h:h:h:h:h:h:h:h>: Match everything except the
specified range.
.. cfgcmd:: set policy ipv6-route <text> rule <1-9999> destination port
<match_criteria>
Set match criteria based on destination port, where <match_criteria> could
be:
* <port name>: Named port (any name in /etc/services, e.g., http).
* <1-65535>: Numbered port.
* <start>-<end>: Numbered port range (e.g., 1001-1005).
Multiple destination ports can be specified as a comma-separated list. The
whole list can also be "negated" using '!'. For example:
'!22,telnet,http,123,1001-1005'.
.. cfgcmd:: set policy ipv6-route <text> rule <1-9999> disable
Option to disable rule.
.. cfgcmd:: set policy ipv6-route <text> rule <1-9999> icmpv6 type <icmpv6_typ>
Set ICMPv6 match criterias, based on ICMPv6 type/code name.
.. cfgcmd:: set policy ipv6-route <text> rule <1-9999> ipsec
<match-ipsec|match-none>
Set IPSec inbound match criterias, where:
* match-ipsec: match inbound IPsec packets.
* match-none: match inbound non-IPsec packets.
.. cfgcmd:: set policy ipv6-route <text> rule <1-9999> limit burst
<0-4294967295>
Set maximum number of packets to alow in excess of rate
.. cfgcmd:: set policy ipv6-route <text> rule <1-9999> limit rate <text>
Set maximum average matching rate. Format for rate: integer/time_unit, where
time_unit could be any one of second, minute, hour or day.For example
1/second implies rule to be matched at an average of once per second.
.. cfgcmd:: set policy ipv6-route <text> rule <1-9999> log <enable|disable>
Option to enable or disable log matching rule.
.. cfgcmd:: set policy ipv6-route <text> rule <1-9999> log <text>
Option to log matching rule.
.. cfgcmd:: set policy ipv6-route <text> rule <1-9999> protocol
<text|0-255|tcp_udp|all|!protocol>
Set IPv6 protocol to match. IPv6 protocol name from /etc/protocols or
protocol number, or "tcp_udp" or "all". Also, protocol could be denied by
using !.
.. cfgcmd:: set policy ipv6-route <text> rule <1-9999> recent <count|time>
<1-255|0-4294967295>
Set parameters for matching recently seen sources. This match could be used
by seeting count (source address seen more than <1-255> times) and/or time
(source address seen in the last <0-4294967295> seconds).
.. cfgcmd:: set policy ipv6-route <text> rule <1-9999> set dscp <0-63>
Set packet modifications: Packet Differentiated Services Codepoint (DSCP)
.. cfgcmd:: set policy ipv6-route <text> rule <1-9999> set mark <1-2147483647>
Set packet modifications: Packet marking.
.. cfgcmd:: set policy ipv6-route <text> rule <1-9999> set table <main|1-200>
Set packet modifications: Routing table to forward packet with.
.. cfgcmd:: set policy ipv6-route <text> rule <1-9999> set tcp-mss
<pmtu|500-1460>
Set packet modifications: pmtu option automatically set to Path Maximum
Transfer Unit minus 60 bytes. Otherwise, expliicitly set TCP MSS value from
500 to 1460.
.. cfgcmd:: set policy ipv6-route <text> rule <1-9999> source address
<match_criteria>
Set match criteria based on IPv6 source address, where <match_criteria>
could be:
* <h:h:h:h:h:h:h:h>: IPv6 address to match
* <h:h:h:h:h:h:h:h/x>: IPv6 prefix to match
* <h:h:h:h:h:h:h:h>-<h:h:h:h:h:h:h:h>: IPv6 range to match
* !<h:h:h:h:h:h:h:h>: Match everything except the specified address
* !<h:h:h:h:h:h:h:h/x>: Match everything except the specified prefix
* !<h:h:h:h:h:h:h:h>-<h:h:h:h:h:h:h:h>: Match everything except the
specified range
.. cfgcmd:: set policy ipv6-route <text> rule <1-9999> source mac-address
<MAC_address|!MAC_address>
Set source match criteria based on MAC address. Declare specific MAC address
to match, or match everything except the specified MAC.
.. cfgcmd:: set policy ipv6-route <text> rule <1-9999> source port
<match_criteria>
Set match criteria based on source port, where <match_criteria> could be:
* <port name>: Named port (any name in /etc/services, e.g., http).
* <1-65535>: Numbered port.
* <start>-<end>: Numbered port range (e.g., 1001-1005).
Multiple source ports can be specified as a comma-separated list. The whole
list can also be "negated" using '!'. For example:
'!22,telnet,http,123,1001-1005'.
.. cfgcmd:: set policy ipv6-route <text> rule <1-9999> state
<established|invalid|new|related> <disable|enable>
Set match criteria based on session state.
.. cfgcmd:: set policy ipv6-route <text> rule <1-9999> tcp flags <text>
Set match criteria based on tcp flags. Allowed values for TCP flags: SYN ACK
FIN RST URG PSH ALL. When specifying more than one flag, flags should be
comma-separated. For example : value of 'SYN,!ACK,!FIN,!RST' will only match
packets with the SYN flag set, and the ACK, FIN and RST flags unset.
.. cfgcmd:: set policy ipv6-route <text> rule <1-9999> time monthdays <text>
Set monthdays to match rule on. Format for monthdays: 2,12,21.
To negate add ! at the front eg. !2,12,21
.. cfgcmd:: set policy ipv6-route <text> rule <1-9999> time startdate <text>
Set date to start matching rule. Format for date: yyyy-mm-dd. To specify
time of date with startdate, append 'T' to date followed by time in 24 hour
notation hh:mm:ss. For eg startdate value of 2009-01-21T13:30:00 refers to
21st Jan 2009 with time 13:30:00.
.. cfgcmd:: set policy ipv6-route <text> rule <1-9999> time starttime <text>
Set time of day to start matching rule. Format of time: hh:mm:ss using 24
hours notation.
.. cfgcmd:: set policy ipv6-route <text> rule <1-9999> time stopdate <text>
Set date to stop matching rule. Format for date: yyyy-mm-dd. To specify time
of date with stopdate, append 'T' to date followed by time in 24 hour
notation hh:mm:ss. For eg startdate value of 2009-01-21T13:30:00 refers to
21st Jan 2009 with time 13:30:00.
.. cfgcmd:: set policy ipv6-route <text> rule <1-9999> time stoptime <text>
Set time of day to stop matching rule. Format of time: hh:mm:ss using 24
hours notation.
.. cfgcmd:: set policy ipv6-route <text> rule <1-9999> time utc
Interpret times for startdate, stopdate, starttime and stoptime to be UTC.
.. cfgcmd:: set policy ipv6-route <text> rule <1-9999> time weekdays
Weekdays to match rule on. Format for weekdays: Mon,Thu,Sat. To negate add !
at the front eg. !Mon,Thu,Sat.
|
