CLI Guide

The SonicOS Enterprise Command Line Interface (E-CLI) provides a concise and powerful way to configure Dell SonicWALL network security appliances without using the SonicOS Web based management interface. You can use the CLI commands individually on the command line, or in scripts for automating configuration tasks.

This appendix contains a categorized listing of Command Line Interface (CLI) commands for SonicOS 6.2 firmware. Each command is described, and where appropriate, an example of usage is included.

For a listing of Command Line Interface (CLI) commands for SonicOS 6.2 firmware, refer to the SonicOS 6.2 CLI Reference Guide.

This introduction contains the following sections:

Text Conventions

Input Data Format Specification

CLI Prompt Specification

Editing and Completion Features

Command Hierarchy

Passwords

Factory Reset to Defaults

Logging in to the SonicOS CLI

Configuring the Dell SonicWALL Network Security Appliance

Example: Configuring a Site-to-Site VPN Using the CLI

Note The complete SonicWALL CLI Command Reference is included in the SonicOS online help. To access the Command Reference, click the Help button from the SonicOS GUI, and then navigate to Appendices > CLI Guide.

Text Conventions

Bold text indicates a command executed by interacting with the user interface.

Courier bold text indicates commands and text entered using the CLI.

Italic text indicates the first occurrence of a new term, as well as a book title, and also emphasized text. In this command summary, items presented in italics represent user-specified information.

Items within angle brackets (“< >”) are required information.

Items within square brackets (“[ ]”) are optional information.

Items separated by a “pipe” (“|”) are options. You can select any of them.

Note Though a command string may be displayed on multiple lines in this guide, it must be entered on a single line with no carriage returns except at the end of the complete command.

Input Data Format Specification

The table below describes the data formats acceptable for most commands. H represents one or more hexadecimal digit (0-9 and A-F). D represents one or more decimal digit.

Table 4

Data

Data Format

MAC Address

HH:HH:HH:HH:HH:HH

MAC Address

HHHH.HHHH.HHHH

IP Address

D.D.D.D

IP Address

0xHHHHHHHH

Integer Values

D

Integer Values

0xH

Integer Range

D-D

Input Data Formats

CLI Prompt Specification

The firewall name, configurable via the SonicOS Web UI on the System > Administration page, is used in the prompts throughout the CLI, rather than the generic product name like NSA3600 or SM9600.

This allows the administrator to more easily identify which firewall is currently being managed, and to identify which firewalls are being used for which departments in a business structure. For example, the administrator could name several NSA3600s with names like Marketing, Tech Pubs, Engineering, Testing, etc.

If no firewall name is configured, the default is the serial number or MAC address of the device, resulting in a prompt such as:

C0EAE4599008>

In the examples in this document, we use NSA3600 as the configured name of the device and consequently as the prompt in the examples.

Editing and Completion Features

You can use individual keys and control-key combinations to assist you with the CLI. The table below describes the key and control-key combination functions.

Table 5

Key(s)

Function

Tab

Completes the current word

?

Displays possible command completions

CTRL+A

Moves cursor to the beginning of the command line

CTRL+B

Moves cursor to the previous character

CTRL+C

Exits the Quick Start Wizard at any time

CTRL+E

Moves cursor to the end of the command line

CTRL+F

Moves cursor to the next character

CTRL+K

Erases characters from the cursor to the end of the line

CTRL+N

Displays the next command in the command history

CTRL+P

Displays the previous command in the command history

CTRL+W

Erases the previous word

Left Arrow

Moves cursor to the previous character

Right Arrow

Moves the cursor to the next character

Up Arrow

Displays the previous command in the command history

Down Arrow

Displays the next command in the command history

Key Reference

Most configuration commands require completing all fields in the command. For commands with several possible completing commands, the Tab or ? key display all options.

: : : : myDevice> show [TAB]

alerts

interface

network

tech-support

arp

log

processes

tsr

content-filter

memory

route

web-management

cpu

messages

security-
services

zone

device

nat

status

zones

gms

netstat

system

 

The Tab key can also be used to finish a command if the command is uniquely identified by user input.

myDevice> show al [TAB]

displays

myDevice> show alerts

Additionally, commands can be abbreviated as long as the partial commands are unique. The following text:

myDevice> sho int inf

is an acceptable abbreviation for

myDevice> show interface info

Command Hierarchy

The CLI configuration manager allows you to control hardware and firmware of the appliance through a discreet mode and submode system. The commands for the appliance fit into the logical hierarchy shown below.

To configure items in a submode, activate the submode by entering a command in the mode above it.

For example, to set the default LAN interface speed or duplex, you must first enter configure, then interface x0 lan. To return to the higher Configuration mode, simply enter end or finished.

Configuration Security

SonicWALL Internet Security appliances allow easy, flexible configuration without compromising the security of their configuration or your network.

Passwords

The SonicWALL CLI currently uses the administrator’s password to obtain access. SonicWALL devices are shipped with a default password of password. Setting passwords is important in order to access the SonicWALL and configure it over a network.

Factory Reset to Defaults

If you are unable to connect to your device over the network, you can use the command restore to reset the device to factory defaults during a serial configuration session.

CAUTION The restore command erases all the settings on the appliance, leaving it in a factory default state.

Management Methods for the SonicWALL Network Security Appliance

You can configure the SonicWALL appliance using one of three methods:

• Using a serial connection and the configuration manager

– An IP address assignment is not necessary for appliance management.

– A device must be managed while physically connected via a serial cable.

• Web browser-based User Interface

– An IP address must have been assigned to the appliance for management or use the default of 192.168.168.168.

Initiating a Management Session using the CLI

Serial Management and IP Address Assignment

Follow the steps below to initiate a management session via a serial connection and set an IP address for the device.

Note The default terminal settings on the SonicWALL and modules is 80 columns by 25 lines. To ensure the best display and reduce the chance of graphic anomalies, use the same settings with the serial terminal software. The device terminal settings can be changed, if necessary. Use the standard ANSI setting on the serial terminal software.

1. Attach the included null modem cable to the appliance port marked CONSOLE. Attach the other end of the null modem cable to a serial port on the configuring computer.

2. Launch any terminal emulation application that communicates with the serial port connected to the appliance. Use these settings:

• 115,200 baud

• 8 data bits

• no parity

• 1 stop bit

• no flow control

3. Press Enter/Return. Initial information is displayed followed by a DEVICE NAME> prompt.

Initiating an SSH Management Session via Ethernet

Note This option works for customers administering a device that does not have a cable for console access to the CLI.

Follow the steps below to initiate an SSH management session through an Ethernet connection from a client to the appliance.

1. Attach an Ethernet cable to the interface port marked XO. Attach the other end of the Ethernet cable to an Ethernet port on the configuring computer.

2. Launch any terminal emulation application (such as PuTTY) that communicates via the Ethernet interface connected to the appliance.

3. Within the emulation application, enter the IP destination address for the appliance and enter 22 as the port number.

4. Select SSH as the connection type and open a connection.

Logging in to the SonicOS CLI

When the connection is established, log in to the security appliance:

1. At the User prompt enter the Admin’s username. Only the admin user will be able to login from the CLI. The default Admin username is admin. The default can be changed.

2. At the Password prompt, enter the Admin’s password. If an invalid or mismatched username or password is entered, the CLI prompt will return to User:, and a “CLI administrator login denied due to bad credentials” error message will be logged. There is no lockout facility on the CLI.

Configuring the Dell SonicWALL Network Security Appliance

You can configure the Dell SonicWALL network security appliance using one of three methods:

Configuring Features using the CLI on a Serial Connection via the Console Port

Configuring Features using the CLI in an SSH Management Session via Ethernet

Configuring Features using the Management Interface (Web UI)

 

Note To use the CLI on a serial connection or in an SSH management session, you need to use a terminal emulation application (such as Tera Term) or an SSH Client application (such as PuTTY). You can find suitable, free terminal emulators on the Internet.

Configuring Features using the Management Interface (Web UI)

 

Note To use the CLI on a serial connection or in an SSH management session, you need to use a terminal emulation application (such as Tera Term) or an SSH Client application (such as PuTTY). You can find suitable, free terminal emulators on the Internet.

Configuring Features using the CLI on a Serial Connection via the Console Port

You do not need to assign an IP address to the firewall to use the CLI on a serial connection to the Console port.

Note The default terminal settings on the firewall are 80 columns by 25 lines. To ensure the best display and reduce the chance of graphic anomalies, use the same settings with the serial terminal software. The device terminal settings can be changed, if necessary. Use the standard ANSI setting on the serial terminal software.

To configure features using the CLI on a serial connection via the console port:

1. Attach an RJ-45 to DB-9 serial cable to the appliance port marked CONSOLE. Attach the other end of the cable to a serial port on the configuring computer.

console_connection.jpg

 

 

The RJ-45 to DB-9 serial cable pin assignments are as follows:

RJ-45 connector

DB9 connector

Pin 1

Pin 9

Pin 2

Pin 1

Pin 3

Pin 4

Pin 4

Pin 5

Pin 5

Pin 2

Pin 6

Pin 3

Pin 7

Pin 8

Pin 8

Pin 7

 

Pin 6 – not used

The RJ-45 to DB-9 serial cable pin diagram is shown below:

 

DB9_RJ45_console_connections.jpg

 

 

2. Launch a terminal emulation application that communicates with the serial port connected to the appliance. Use these settings:

• 115,200 baud

• 8 data bits

• no parity

• 1 stop bit

• no flow control

 

3. Press Enter/Return. Initial information is displayed followed by a DEVICE NAME> prompt.

Configuring Features using the CLI in an SSH Management Session via Ethernet

You can use an SSH client to access the CLI by connecting to the appliance with an Ethernet cable. This option is useful for customers that do not have access to an RJ-45 to DB-9 serial cable for the Console port on the firewall.

To use SSH management, you must assign an IP address to X0 (LAN) or X1 (WAN), or use the default LAN IP address of 192.168.168.168.

To configure features using the CLI in an SSH management session via Ethernet:

1. Attach an Ethernet cable to the interface port marked X0. Attach the other end of the Ethernet cable to an Ethernet port on the configuring computer.

2. Launch a terminal emulation application or SSH client that communicates via Ethernet.

3. In the emulation application, enter the IP destination address for the X0 interface and enter 22 as the port number.

4. Select SSH as the connection type and open a connection.

Configuring Features using the Management Interface (Web UI)

You can manage the appliance securely from your Web browser using HTTPS by connecting to either the LAN or WAN IP address of the appliance, directly or over the network.

There are a number of features in SonicOS that cannot be configured using the CLI. The following features can only be configured in the SonicOS management interface (Web UI):

Category

Features

Dashboard

All features

System

License, Certificates, Settings (import, upload/download)

SonicPoint

All features

Firewall

App Rules

Firewall Settings

BWM

DPI-SSL

All features

Anti-Spam

All features

Users

Guest Services, Guest Accounts, Guest Status Security

Security Services

Summary, Content Filter, Client AV Enforcement, Anti-Spyware,
Geo-IP filter, Botnet Filter

WAN Acceleration

All features

AppFlow

All features

Log

All features

 

SafeMode

SafeMode is a limited Web management interface that provides a way to upload firmware from your computer and reboot the appliance.

The SafeMode feature allows you to recover quickly from uncertain configuration states with a simplified management interface that includes the same settings available on the System > Settings page.

For instructions on how to restart your firewall in SafeMode, refer to Using SafeMode to Upgrade Firmwareor see the Getting Started Guide for your appliance.

Note You cannot use the CLI commands in SafeMode.

Example: Configuring a Site-to-Site VPN Using the CLI

This section describes how to create a VPN policy using the Command Line Interface. You can configure all of the parameters using the CLI, and enable the VPN without using the Web management interface.

Note In this example, the VPN policy on the other end has already been created.

CLI Access

1. Use a DB9 to RJ45 connector to connect the serial port of your PC to the console port of your firewall.

2. Using a terminal emulator program (such as PuTTY or Tera Term) use the following parameters:

• 115,200 baud

• 8 bits

• No parity

• 1 stop bit

• No flow control

 

3. You may need to hit return two to three times to get to a command prompt, which will look similar to the following:

• NSA3600>

or

• SM9200>

 

4. If you have used any other CLI, such as Unix shell or Cisco IOS, this process should be relatively easy and similar. It has auto-complete so you do not have to type in the entire command.

5. When you need to make a configuration change, you must be in configure mode. To enter configure mode, type configure.

• NSA3600> configure

• (config[NSA3600])>

6. The command prompt changes and adds the word config to distinguish it from the normal mode. Now you can configure all the settings, enable and disable the VPNs, and configure the firewall.

Configuration

In this example, a site-to-site VPN is configured between two NSA 3600 appliances, with the following settings:

Local NSA 3600 (home):
WAN IP: 10.50.31.150
LAN subnet: 192.168.61.0
Mask 255.255.255.0

Remote NSA 3600 (office):
WAN IP: 10.50.31.104
LAN subnet: 192.168.15.0
Mask: 255.255.255.0

Authentication Method: IKE using a Pre-Shared Key
Phase 1 Exchange: Main Mode
Phase 1 Encryption: 3DES
Phase 1 Authentication SHA1
Phase 1 DH group: 2
Phase 1 Lifetime: 28800
Phase 2 Protocol: ESP
Phase 2 Encryption: 3DES
Phase 2 Authentication: SHA1
Phase 2 Lifetime: 28800
No PFS

 

1. In configure mode, create an address object for the remote network, specifying the name, zone assignment, type, and address. In this example, we use the name OfficeLAN:

(config[NSA3600]> address-object Office LAN
(config-address-object[OfficeLAN])>

Note The prompt has changed to indicate the configuration mode for the address object.

(config-address-object[OfficeLAN])> zone VPN
(config-address-object[OfficeLAN])> network 192.168.15.0 255.255.255.0
(config-address-object[OfficeLAN])> finished

2. To display the address object, type the command show address-object [name]:

NSA3600 > show address-object OfficeLAN

The output will be similar to the following:

address-object OfficeLAN
network 192.168.15.0 255.255.255.0
zone VPN

3. To create the VPN policy, type the command:

vpn policy [name] [authentication method]

(config[NSA3600])> vpn policy OfficeVPN pre-shared
(config-vpn[OfficeVPN])>

Note The prompt changes to indicate the configuration mode for the VPN policy. All the settings regarding this VPN will be entered here.

4. Configure the Pre-Shared Key. In this example, the Pre-Shared Key is sonicwall:

(config-vpn[OfficeVPN])> pre-shared-secret sonicwall

5. Configure the IPSec gateway:

(config-vpn[OfficeVPN])> gw ip-address 10.50.31.104

6. Define the local and the remote networks:

(config-vpn[OfficeVPN])> network local address-object "LAN Primary Subnet"
(config-vpn[OfficeVPN])> network remote address-object "OfficeLAN"

7. Configure the IKE and IPSec proposals:

(config-vpn[OfficeVPN])> proposal ike main encr triple-des auth sha1 dh 2
: lifetime 28800
(config-vpn[OfficeVPN])> proposal ipsec esp encr triple-des auth sha1 dh no
: lifetime 28800

8. In the Advanced tab in the UI configuration, enable keepalive on the VPN policy:

(config-vpn[OfficeVPN])> advanced keepalive

9. To enable the VPN policy, use the command vpn enable [name]:

(config[NSA3600])> vpn enable "OfficeVPN"

10. Use the finished command to save the VPN policy and exit from the VPN configure mode:

(config-vpn[OfficeVPN])> finished
(config[NSA3600])>

The configuration is complete.

Note The command prompt goes back to the configure mode prompt.

Viewing a VPN Configuration

To view a list of all the configured VPN policies:

1. Type the command show vpn policy. The output will be similar to the following:

(config[NSA3600])> show vpn policy

Policy: WAN GroupVPN (Disabled)
Key Mode: Pre-shared
Pre Shared Secret: DE65AD2228EED75A

Proposals:
IKE: Aggressive Mode, 3DES SHA, DH Group 2, 28800 seconds
IPSEC: ESP, 3DES SHA, No PFS, 28800 seconds

Advanced:
Allow NetBIOS OFF, Allow Multicast OFF
Management: HTTP OFF, HTTPS OFF
Lan Default GW: 0.0.0.0
Require XAUTH: ON, User Group: Trusted Users

Client:
Cache XAUTH Settings: Never
Virtual Adapter Settings: None
Allow Connections To: Split Tunnels
Set Default Route OFF, Apply VPN Access Control List OFF
Require GSC OFF
Use Default Key OFF

Policy: OfficeVPN (Enabled)
Key Mode: Pre-shared
Primary GW: 10.50.31.104
Secondary GW: 0.0.0.0
Pre Shared Secret: sonicwall

IKE ID:
Local: IP Address
Peer: IP Address

Network:
Local: LAN Primary Subnet
Remote: OfficeLAN

Proposals:
IKE: Main Mode, 3DES SHA, DH Group 2, 28800 seconds
IPSEC: ESP, 3DES SHA, No PFS, 28800 seconds

Advanced:
Keepalive ON, Add Auto-Rule ON, Allow NetBIOS OFF
Allow Multicast OFF
Management: HTTP ON, HTTPS ON
User Login: HTTP ON, HTTPS ON
Lan Default GW: 0.0.0.0
Require XAUTH: OFF
Bound To: Zone WAN

2. To view the configuration for a specific policy, specify the policy name in double quotes.
For example:

(config[NSA3600])> show vpn policy "OfficeVPN"

The output will be similar to the following:

Policy: OfficeVPN (Enabled)
Key Mode: Pre-shared
Primary GW: 10.50.31.104
Secondary GW: 0.0.0.0
Pre Shared Secret: sonicwall

IKE ID:
Local: IP Address
Peer: IP Address

Network:
Local: LAN Primary Subnet
Remote: OfficeLAN

Proposals:
IKE: Main Mode, 3DES SHA, DH Group 2, 28800 seconds
IPSEC: ESP, 3DES SHA, No PFS, 28800 seconds

Advanced:
Keepalive ON, Add Auto-Rule ON, Allow NetBIOS OFF
Allow Multicast OFF
Management: HTTP ON, HTTPS ON
User Login: HTTP ON, HTTPS ON
Lan Default GW: 0.0.0.0
Require XAUTH: OFF
Bound To: Zone WAN

3. Type the command show vpn sa [name] to see the active SA:

(config[NSA3600])> show vpn sa "OfficeVPN"

Policy: OfficeVPN
IKE SAs

GW: 10.50.31.150:500 --> 10.50.31.104:500
Main Mode, 3DES SHA, DH Group 2, Responder
Cookie: 0x0ac298b6328a670b (I), 0x28d5eec544c63690 (R)
Lifetime: 28800 seconds (28783 seconds remaining)

IPsec SAs

GW: 10.50.31.150:500 --> 10.50.31.104:500
(192.168.61.0 - 192.168.61.255) --> (192.168.15.0 - 192.168.15.255)
ESP, 3DES SHA, In SPI 0xed63174f, Out SPI 0x5092a0b2
Lifetime: 28800 seconds (28783 seconds remaining)

 

 

Contents

  • ecli/neighbor-discovery_show.cdl

Syntax

clear

Mode

All Modes

Description

Reset functions.

Syntax

export

Mode

All Modes

Description

Export system status or configuration.

Syntax

no

Mode

All Modes

Description

Negate a command or set its defaults.

Syntax

show

Mode

All Modes

Description

Show system status or configuration.

Syntax

cancel

Mode

All Modes (
excluding Top Level)

Description

Cancel current changes and return to the previous mode.

Example

cancel

Syntax

commit [ best-effort ]

Mode

All Modes (
excluding Top Level)

Description

Commits configuration changes.

Options

best-effortCommits only valid configuration (best effort).

Example

commit

Syntax

end

Mode

Config

Description

End configuration mode.

Example

end

Syntax

end

Mode

All Modes (
excluding Top Level) (excluding Config)

Description

Exits current mode and returns to global configuration mode.

Example

end

Syntax

exit

Mode

All Modes

Description

Exit the current mode.

Example

exit

Syntax

help

Mode

All Modes

Description

Display command help.

Example

help

Syntax

configure [ terminal ]

Mode

Top Level

Description

Enter configuration mode.

Options

terminalTerminal.

Example

configure

Syntax

clear screen

Mode

All Modes

Description

Disable command history for the current CLI session.

Example

clear screen

Syntax

no cli history

Mode

Top Level

Config

Description

Disable command history for the current CLI session.

Example

no cli history

Syntax

cli history [ size <UINT32> ]

Mode

Top Level

Config

Description

Enable command history for the current CLI session.

Options

sizeCommand history buffer size.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

cli history

Syntax

cli output-format { json | plain-text | xml }

Mode

All Modes

Description

Set the CLI output format.

Options

 
jsonRender all CLI output as JSON.
 
plain-textRender all CLI output as plain-text.
 
xmlRender all CLI output as XML.

Example

cli output plain-text

Syntax

cli show output-validation session

Mode

All Modes

Description

Enable show output syntax validation.

Example

cli show output-validation session

Syntax

no cli show output-validation session

Mode

All Modes

Description

Disable show output syntax validation.

Example

cli show output-validation session

Syntax

cli idle-timeout session <CLI_IDLE_TIMEOUT>

Mode

Top Level

Config

Description

Set the maximum time that a session can be idle before being logged off.

Options

<CLI_IDLE_TIMEOUT> Integer in the form: D OR 0xHH.
Max: 60
Example: 5

Example

cli idle-timeout session 5

Syntax

cli idle-timeout default <CLI_IDLE_TIMEOUT>

Mode

Top Level

Config

Description

Set the maximum time that a session can be idle before being logged off.

Options

<CLI_IDLE_TIMEOUT> Integer in the form: D OR 0xHH.
Max: 60
Example: 5

Example

cli idle-timeout default 5

Syntax

cli screen-width session <CLI_SCREEN_WIDTH>

Mode

Top Level

Config

Description

Set the number of characters on a line.

Options

<CLI_SCREEN_WIDTH> Integer in the form: D OR 0xHHHH.
Min: 80
Max: 2560
Example: 80

Example

cli screen-width session 80

Syntax

cli screen-width default <CLI_SCREEN_WIDTH>

Mode

Top Level

Config

Description

Set the number of characters on a line.

Options

<CLI_SCREEN_WIDTH> Integer in the form: D OR 0xHHHH.
Min: 80
Max: 2560
Example: 80

Example

cli screen-width default 80

Syntax

cli screen-length session <CLI_SCREEN_LENGTH>

Mode

Top Level

Config

Description

Set the number of lines on screen.

Options

<CLI_SCREEN_LENGTH> Integer in the form: D OR 0xHHHH.
Min: 24
Max: 1600
Example: 24

Example

cli screen-length session 24

Syntax

cli screen-length default <CLI_SCREEN_LENGTH>

Mode

Top Level

Config

Description

Set the number of lines on screen.

Options

<CLI_SCREEN_LENGTH> Integer in the form: D OR 0xHHHH.
Min: 24
Max: 1600
Example: 24

Example

cli screen-length default 24

Syntax

cli show-unmodified session

Mode

All Modes

Description

Show unmodified pending configuration changes.

Example

cli show-unmodified session

Syntax

cli show-unmodified default

Mode

All Modes

Description

Show unmodified pending configuration changes.

Example

cli show-unmodified default

Syntax

no cli show-unmodified session

Mode

All Modes

Description

Hide unmodified pending configuration changes.

Example

no cli show-unmodified session

Syntax

no cli show-unmodified default

Mode

All Modes

Description

Hide unmodified pending configuration changes.

Example

no cli show-unmodified default

Syntax

cli pager { default | session }

Mode

All Modes

Description

Enable cli pager.

Options

 
defaultDefault setting (changes take effect upon next login).
 
sessionApply to the current session.

Example

cli pager

Syntax

no cli pager { default | session }

Mode

All Modes

Description

Disable cli pager.

Options

 
defaultDefault setting (changes take effect upon next login).
 
sessionApply to the current session.

Example

no cli pager

Syntax

cli interactive-prompts { default | session }

Mode

All Modes

Description

Enable cli interactive prompts.

Options

 
defaultDefault setting (changes take effect upon next login).
 
sessionApply changes to the current session.

Example

cli interactive-prompts session

Syntax

no cli interactive-prompts { default | session }

Mode

All Modes

Description

Disable cli interactive prompts.

Options

 
defaultDefault setting (changes take effect upon next login).
 
sessionApply changes to the current session.

Example

no cli interactive-prompts session

Syntax

cli rest-api enable

Mode

Config

Description

Enable CLI REST-API.

Example

cli rest-api enable

Syntax

no cli rest-api enable

Mode

Config

Description

Disable CLI REST-API.

Example

no cli rest-api enable

Syntax

cli rest-api cors-support

Mode

Config

Description

Enable REST-API CORS (Cross-Origin Resource Sharing) support.

Example

cli rest-api cors

Syntax

no cli rest-api cors-support

Mode

Config

Description

Disable REST-API CORS (Cross-Origin Resource Sharing) support.

Example

no cli rest-api cors

Syntax

cli rest-api page { load | update } [ popup ]

Mode

All Modes

Description

REST-API page load/update.

Options

 
loadPage load.
 
updatePage update.
popupPopup.

Example

cli rest-api page load

Syntax

cli ftp user default <WORD>

Mode

Top Level

Config

Description

Configure the username for File Transfer Protocol (FTP) connections.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

cli ftp user default Administrator

Syntax

no cli ftp user default

Mode

Top Level

Config

Description

Configure anonymous username for File Transfer Protocol (FTP) connections.

Example

cli ftp user default

Syntax

cli ftp password default <ENC_PASSWORD>

Mode

Top Level

Config

Description

Configure the password for File Transfer Protocol (FTP) connections.

Options

<ENC_PASSWORD> Password.
Example: secret

Example

cli ftp password default mysecret

Syntax

no cli ftp password default

Mode

Top Level

Config

Description

Clear password for File Transfer Protocol (FTP) connections.

Example

no cli ftp password default

Syntax

cli banner { connection | login | logout } <WORD>

Mode

Config

Description

CLI banner configuration.

Options

 
connectionConfigure connection banner
 
loginConfigure login banner
 
logoutConfigure logout banner
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

cli banner connection "You have connected to System 88.\

Log in using a valid username and password combination."
cli banner login "You are now logged into System 88.\
Please do not make modifications without proper authorization."
cli banner logout "Thank you for visiting System 88.\
Login is now terminated."

Syntax

no cli banner { connection | login | logout }

Mode

Config

Description

Clear CLI banner message.

Options

 
connectionClear connection banner
 
loginClear login banner
 
logoutClear logout banner

Example

no cli banner connection

no cli banner login
no cli banner logout

Syntax

show current-config [ with-pending-config ]

Mode

All Modes (
excluding Top Level) (excluding Config)

Description

Show current configuration.

Options

with-pending-configView current configuration with pending changes included in the output.

Example

show current-config

Syntax

show current-config [ { custom | default } ] [ with-pending-config ] [ json | validate | xml ]

Mode

Top Level

Config

Description

Show current configuration.

Options

 
customShow custom configuration.
 
defaultShow system/factory default configuration.
with-pending-configView current configuration with pending changes included in the output.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show current-config

Syntax

show pending-config [ [ json | validate | xml ] ]

Mode

All Modes (
excluding Top Level)

Description

Show pending configuration.

Options

 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show pending-config

Syntax

show checksum [ { pending-config | with-pending-config } ]

Mode

All Modes

Options

 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show checksum

Syntax

show cli [ banner | data-model [ { group <INT32> | tag <WORD> } ] | data-store [ group <INT32> ] | debug | ftp | history [ top <UINT16> ] | idle-timeout | interactive-prompts | mode { { all | current | name <CDL_MODE_NAME> } } [ exclude global ] [ include [ cgi-nvp ] [ submodes ] ] | pager | rest-api | screen-length | screen-width | show-api | show-unmodified | staging-area [ { command-hash | current-mode } ] | token-types ]

Mode

All Modes

Description

Show a list of recent commands issued.

Options

 
bannerShow CLI Banner.
 
data-modelDisplay data model debug information.
 
groupGroup ID.
<INT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123
 
tagCGI tag name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
data-storeDisplay data store debug information.
groupGroup ID.
<INT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123
 
debugDisplay CLI debug information.
 
ftpDisplay CLI FTP configuration.
 
historyShow a list of recent keywords issued.
topShow the specified number of recent keywords issued.
<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123
 
idle-timeoutShow idle timeout.
 
interactive-promptsshow cli interactive prompts.
 
modeShow CLI mode command table.
 
allShow all CLI mode command tables.
 
currentShow current CLI mode command table.
 
nameShow CLI mode command table by name.
<CDL_MODE_NAME> CDL Mode name.
Example: config_mode
excludeExclude options.
globalExclude globally available commands.
includeInclude options.
cgi-nvpInclude CGI tag name and configuration value.
submodesInclude sub-modes.
 
pagerShow tty pager.
 
rest-apiShow CLI REST-API configuration or status.
 
screen-lengthShow screen length.
 
screen-widthShow screen width.
 
show-apiDisplay Show command API debug information.
 
show-unmodifiedShow unmodified settings.
 
staging-areaDisplay staging area debug information.
 
command-hashDisplay only the command hash.
 
current-modeDisplay only the current mode.
 
token-typesDisplay token type debug information.

Example

show cli history

Syntax

ping <HOSTNAME_MIXED> [ interface <WAN_MGMT_INTERFACE> ] [ ipv6-preferred ]

Mode

Top Level

Config

Description

Ping the specified host.

Options

<HOSTNAME_MIXED> IPV4: hostname in the form: D.D.D.D or hostname\nIPV6: host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: 2001:cdba:0000:0000:0000:0000:3257:9652\n
interfaceRoute ping request through the specified interface.
<WAN_MGMT_INTERFACE> WAN interface name.
Example: X1
ipv6-preferredPrefer to use IPv6 network.

Example

ping 10.10.10.1

ping fe00::1 ipv6-preferred
ping 10.10.10.1 interface X1

Syntax

traceroute <HOSTNAME_MIXED> [ interface <WAN_MGMT_INTERFACE> ] [ ipv6-preferred ]

Mode

Top Level

Config

Description

Traceroute to the specified host.

Options

<HOSTNAME_MIXED> IPV4: hostname in the form: D.D.D.D or hostname\nIPV6: host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: 2001:cdba:0000:0000:0000:0000:3257:9652\n
interfaceRoute traceroute request through the specified interface.
<WAN_MGMT_INTERFACE> WAN interface name.
Example: X1
ipv6-preferredPrefer to use IPv6 network.

Example

traceroute 10.10.10.1

traceroute fe00::1
traceroute www.sonicwall.com
traceroute 10.10.10.1 interface X1

Syntax

diag network-path <IP_V4V6_HOST>

Mode

Top Level

Config

Description

Find network path of the specified IP address.

Options

<IP_V4V6_HOST> IPV4: address in the form: D.D.D.D\nIPV6: address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: 2001:cdba:0000:0000:0000:0000:3257:9652

Example

diag network-path 10.10.10.1

diag network-path fe00::1

Syntax

network-path <IP_V4V6_HOST>

Mode

Top Level

Config

Description

Find network path of the specified IP address.

Options

<IP_V4V6_HOST> IPV4: address in the form: D.D.D.D\nIPV6: address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: 2001:cdba:0000:0000:0000:0000:3257:9652

Example

network-path 10.10.10.1

network-path fe00::1

Syntax

nslookup <HOSTNAME> [ ipv6 [ ipv4-dns <IPV4_HOST> ] [ ipv6-dns <IPV6_HOST> ] ]

Mode

Top Level

Config

Description

DNS lookup of the specified host.

Options

<HOSTNAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com
ipv6DNS lookup IPv6 host.
ipv4-dnsIPv4 DNS server.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
ipv6-dnsIPv6 DNS server.
<IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b

Example

nslookup 1001::1001 ipv6 ipv4-dns 10.10.10.1

nslookup ipv6.baidu.com ipv6 ipv6-dns 1001::1001
nslookup 10.10.10.1
nslookup www.sonicwall.com

Syntax

diag reverse-lookup <IPV6_HOST> [ ipv6 [ ipv4-dns <IPV4_HOST> ] [ ipv6-dns <IPV6_HOST> ] ]

Mode

Top Level

Config

Description

Resolve the specified reverse name.

Options

<IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b
ipv6DNS lookup IPv6 host.
ipv4-dnsIPv4 DNS server.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
ipv6-dnsIPv6 DNS server.
<IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b

Example

diag reverse-lookup 1001::1001 ipv6 ipv4-dns 10.10.10.1

diag reverse-lookup 10.10.10.1

Syntax

reverse-lookup <IPV6_HOST> [ ipv6 [ ipv4-dns <IPV4_HOST> ] [ ipv6-dns <IPV6_HOST> ] ]

Mode

Top Level

Config

Description

Resolve the specified reverse name.

Options

<IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b
ipv6DNS lookup IPv6 host.
ipv4-dnsIPv4 DNS server.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
ipv6-dnsIPv6 DNS server.
<IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b

Example

reverse-lookup 1001::1001 ipv6 ipv4-dns 10.10.10.1

reverse-lookup 10.10.10.1

Syntax

diag rbl-lookup ip <IPV4_HOST> domain <HOSTNAME> dns-server <IPV4_HOST>

Mode

Top Level

Config

Description

Lookup the specified realtime black list.

Options

ipRBL IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
domainRBL domain name.
<HOSTNAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com
dns-serverRBL DNS server.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

diag rbl-lookup ip 10.10.10.1 domain domainName dns-server 10.10.10.22

Syntax

rbl-lookup ip <IPV4_HOST> domain <HOSTNAME> dns-server <IPV4_HOST>

Mode

Top Level

Config

Description

Lookup the specified realtime black list.

Options

ipRBL IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
domainRBL domain name.
<HOSTNAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com
dns-serverRBL DNS server.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

rbl-lookup ip 10.10.10.1 domain domainName dns-server 10.10.10.22

Syntax

diag mxlookup <HOSTNAME_MIXED> [ port <IPV4_PORT> ]

Mode

Top Level

Config

Description

MX lookup and banner check the specified domain name and SMTP port.

Options

<HOSTNAME_MIXED> IPV4: hostname in the form: D.D.D.D or hostname\nIPV6: host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: 2001:cdba:0000:0000:0000:0000:3257:9652\n
portSpecified the SMTP port.
<IPV4_PORT> Integer in the form: D OR 0xHHHH.
Example: 80

Example

diag mxlookup 10.10.10.1 port 25

diag mxlookup fe00::1
diag mxlookup www.sonicwall.com

Syntax

mxlookup <HOSTNAME_MIXED> [ port <IPV4_PORT> ]

Mode

Top Level

Config

Description

MX lookup and banner check the specified domain name and SMTP port.

Options

<HOSTNAME_MIXED> IPV4: hostname in the form: D.D.D.D or hostname\nIPV6: host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: 2001:cdba:0000:0000:0000:0000:3257:9652\n
portSpecified the SMTP port.
<IPV4_PORT> Integer in the form: D OR 0xHHHH.
Example: 80

Example

mxlookup 10.10.10.1 port 25

mxlookup fe00::1
mxlookup www.sonicwall.com

Syntax

diag geo-lookup <IPV4_HOST>

Mode

Top Level

Config

Description

Check GEO location and lookup BOTNET server.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

diag geo-lookup 10.10.10.1

Syntax

geo-lookup <IPV4_HOST>

Mode

Top Level

Config

Description

Check GEO location and lookup BOTNET server.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

geo-lookup 10.10.10.1

Syntax

pmtu-discovery <HOSTNAME_MIXED> [ interface <WAN_MGMT_INTERFACE> ]

Mode

Top Level

Config

Description

Path MTU discovery to the specified host.

Options

<HOSTNAME_MIXED> IPV4: hostname in the form: D.D.D.D or hostname\nIPV6: host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: 2001:cdba:0000:0000:0000:0000:3257:9652\n
interfacePath MTU discovery request through the specified interface.
<WAN_MGMT_INTERFACE> WAN interface name.
Example: X1

Example

pmtu-discovery 10.10.10.1

pmtu-discovery 1001::1001
pmtu-discovery 10.10.10.1 interface X1

Syntax

diag show processes

Mode

All Modes

Description

Show all system processes.

Example

diag show processes

Syntax

diag show process <WORD>

Mode

All Modes

Description

Show a system process.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

diag show process tNtp

Syntax

diag show netstat

Mode

All Modes

Description

Show all active connections for Internet protocol sockets.

Example

diag show netstat

Syntax

diag show cores

Mode

All Modes

Description

Show all CPU core status information.

Example

diag show cores

Syntax

diag show core <UINT8>

Mode

All Modes

Description

Show CPU core status information.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

diag show core 1

Syntax

diag show multicore

Mode

All Modes

Description

Show multicore utilization information.

Example

diag show multicore

Syntax

diag show build-info

Mode

All Modes

Description

Show build information.

Example

diag show build-info

Syntax

diag show cpu

Mode

All Modes

Description

Show all cpu information.

Example

diag show cpu

Syntax

diag show fpa

Mode

All Modes

Description

Show fpa information.

Example

diag show fpa

Syntax

diag show mem-pools

Mode

All Modes

Description

Show mem-pools information.

Example

diag show mem-pools

Syntax

diag show memory

Mode

All Modes

Description

Show memory information.

Example

diag show memory

Syntax

diag show buf-memzone

Mode

All Modes

Description

Show buf-memzone information.

Example

diag show buf-memzone

Syntax

diag show memzone [ verbose ]

Mode

All Modes

Description

Show memzone information.

Options

verboseVerbose.

Example

diag show memzone

Syntax

diag show tracelog [ current | last ]

Mode

All Modes

Description

Show tracelog information.

Options

 
currentCurrent tracelog.
 
lastLast tracelog.

Example

diag show tracelog current

Syntax

diag clear cp-stats

Mode

All Modes

Description

Clear cp-related network driver counters.

Example

diag clear cp-stats

Syntax

diag show cp-stats

Mode

All Modes

Description

Show cp-related network driver counters.

Example

diag show cp-stats

Syntax

diag clear hw-stats

Mode

All Modes

Description

Clear octeon hardware statistics.

Example

diag clear hw-stats

Syntax

diag show hw-stats

Mode

All Modes

Description

Show octeon hardware statistics.

Example

diag show hw-stats

Syntax

diag show timer-counters

Mode

All Modes

Description

Show timer counters.

Example

diag show timer-counters

Syntax

diag show wd-stats

Mode

All Modes

Description

Show watchdog statistics.

Example

diag show wd-stats

Syntax

diag clear pp-stats

Mode

All Modes

Description

Clear packet processing statistics.

Example

diag clear pp-stats

Syntax

diag show pp-stats

Mode

All Modes

Description

Show packet processing statistics.

Example

diag show pp-stats

Syntax

diag clear active-utm

Mode

All Modes

Description

Clear active UTM statistics.

Example

diag clear active-utm

Syntax

diag show active-utm

Mode

All Modes

Description

Show active UTM statistics.

Example

diag show active-utm

Syntax

diag show debug interface <INTERFACE_NAME>

Mode

All Modes

Description

Show interface debug information.

Options

<INTERFACE_NAME> Interface name.
Example: X0

Example

diag show debug interface "X1"

Syntax

diag show alerts [ top <UINT32> ]

Mode

All Modes

Description

Show alerts.

Options

topMaximum alerts to display.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

diag show alerts

diag show alerts top 100

Syntax

diag show log [ top <UINT32> ]

Mode

All Modes

Description

Show log entries.

Options

topMaximum entries to display.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

diag show log

diag show log top 100

Syntax

diag show drop-stats

Mode

All Modes

Description

Show packet drop statistics.

Example

diag show drop-stats

Syntax

diag cli pager-test

Mode

All Modes

Description

CLI pager test.

Example

diag cli pager-test

Syntax

diag wmi ping-test [ ip <IPV4_HOST> | log | stop ]

Mode

All Modes

Description

Ping test.

Options

 
ipStart ping test at specified host IP.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
 
logLog ping test.
 
stopStop ping test.

Example

diag wmi ping-test log

Syntax

diag wmi reset

Mode

All Modes

Description

WMI reset.

Example

diag wmi reset

Syntax

diag wmi lsusb <UINT32>

Mode

All Modes

Description

WMI lsusb.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

diag wmi lsusb 4

Syntax

diag show wmi status

Mode

All Modes

Description

Show Wan Modem Interface (WMI) status.

Example

diag show wmi status

Syntax

diag show wmi configs

Mode

All Modes

Description

Show Wan Modem Interface Configurations.

Example

diag show wmi configs

Syntax

diag wmi set-primary-config <UINT32>

Mode

All Modes

Description

Set the primary Wan Modem configuration.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

diag wmi set-primary-config 2

Syntax

diag advanced x0-as-mgmt

Mode

Config

Description

Default to X0 instead of MGMT for safemode.

Example

diag advanced x0-as-mgmt

Syntax

diag no advanced x0-as-mgmt

Mode

Config

Description

Disable default to X0 instead of MGMT for safemode.

Example

diag no advanced x0-as-mgmt

Syntax

diag advanced tracelog { all | current | last }

Mode

Config

Description

Set tracelog.

Options

 
allAll.
 
currentCurrent.
 
lastLast.

Example

tracelog current

Syntax

diag advanced arp

Mode

Config

Description

Configure advanced diag ARP settings.

Example

diag advanced arp

Syntax

bridging

Mode

Diag Advanced ARP Settings

Description

Enable ARP bridging.

Example

bridging

Syntax

no bridging

Mode

Diag Advanced ARP Settings

Description

Disable ARP bridging.

Example

no bridging

Syntax

open-arp-behavior

Mode

Diag Advanced ARP Settings

Description

Enable open ARP behavior (WARNING: Insecure!!).

Example

open-arp-behavior

Syntax

no open-arp-behavior

Mode

Diag Advanced ARP Settings

Description

Disable open ARP behavior.

Example

no open-arp-behavior

Syntax

source-ip-validation

Mode

Diag Advanced ARP Settings

Description

Enable source IP address validation for being directly connected.

Example

source-ip-validation

Syntax

no source-ip-validation

Mode

Diag Advanced ARP Settings

Description

Disable source IP address validation for being directly connected.

Example

no source-ip-validation

Syntax

only-unicast

Mode

Diag Advanced ARP Settings

Description

Enable only allowing ARP entries with unicast addresses.

Example

only-unicast

Syntax

no only-unicast

Mode

Diag Advanced ARP Settings

Description

Disable only allowing ARP entries with unicast addresses.

Example

no only-unicast

Syntax

limit-nonresponsive

Mode

Diag Advanced ARP Settings

Description

Enable limiting ARPs of non-responsive IPs.

Example

limit-nonresponsive

Syntax

no limit-nonresponsive

Mode

Diag Advanced ARP Settings

Description

Disable limiting ARPs of non-responsive IPs.

Example

no limit-nonresponsive

Syntax

bypass-for-l2bridge

Mode

Diag Advanced ARP Settings

Description

Enable bypassing ARP processing on L2 bridge interfaces.

Example

bypass-for-l2bridge

Syntax

no bypass-for-l2bridge

Mode

Diag Advanced ARP Settings

Description

Disable bypassing ARP processing on L2 bridge interfaces.

Example

no bypass-for-l2bridge

Syntax

gratuitous-arp-compatibility

Mode

Diag Advanced ARP Settings

Description

Enable gratuitous ARP compatibility mode.

Example

gratuitous-arp-compatibility

Syntax

no gratuitous-arp-compatibility

Mode

Diag Advanced ARP Settings

Description

Disable gratuitous ARP compatibility mode.

Example

no gratuitous-arp-compatibility

Syntax

gratuitous-arp-limit [ amount <UINT32> ]

Mode

Diag Advanced ARP Settings

Description

Enable gratuitous ARP limiting and never broadcast more than set number gratuitous ARPs in any 60 second period.

Options

amountSet limit of gratuitous ARPs in any 60 second period.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

gratuitous-arp-limit amount 100

Syntax

no gratuitous-arp-limit

Mode

Diag Advanced ARP Settings

Description

Disable gratuitous ARP limiting.

Example

no gratuitous-arp-limit

Syntax

system-broadcast [ interval <UINT32> ]

Mode

Diag Advanced ARP Settings

Description

Enable periodically broadcast system ARPs and set the interval.

Options

intervalSet the interval for periodically broadcast system ARPs in minutes.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

system-broadcast interval 60

Syntax

no system-broadcast

Mode

Diag Advanced ARP Settings

Description

Disable periodically broadcast system ARPs.

Example

no system-broadcast

Syntax

ignore-arps-with-primary-mac-from-other-if

Mode

Diag Advanced ARP Settings

Description

Enable ignore ARPs with primary-gateway's MAC received on other interfaces.

Example

ignore-arps-with-primary-mac-from-other-if

Syntax

no ignore-arps-with-primary-mac-from-other-if

Mode

Diag Advanced ARP Settings

Description

Disable ignore ARPs with primary-gateway's MAC received on other interfaces.

Example

no ignore-arps-with-primary-mac-from-other-if

Syntax

display-mac-tracking

Mode

Diag Advanced ARP Settings

Description

Enable displaying of MAC tracking information.

Example

display-mac-tracking

Syntax

no display-mac-tracking

Mode

Diag Advanced ARP Settings

Description

Disable displaying of MAC tracking information.

Example

no display-mac-tracking

Syntax

send system-arps

Mode

Diag Advanced ARP Settings

Description

Send system ARPs.

Example

send system-arps

Syntax

diag advanced network

Mode

Config

Description

Configure advanced diag Network and Routing settings.

Example

diag advanced network

Syntax

flush-alternate-path-flows

Mode

Diag Advanced Network Settings

Description

Enable flushing flows on alternate path when normal route path is enabled (affects existing connections).

Example

flush-alternate-path-flows

Syntax

no flush-alternate-path-flows

Mode

Diag Advanced Network Settings

Description

Disable flushing flows on alternate path when normal route path is enabled (affects existing connections).

Example

no flush-alternate-path-flows

Syntax

update-route-version

Mode

Diag Advanced Network Settings

Description

Enable updating route version when route is enabled/disabled (affects existing connections).

Example

update-route-version

Syntax

no update-route-version

Mode

Diag Advanced Network Settings

Description

Disable updating route version when route is enabled/disabled (affects existing connections).

Example

no update-route-version

Syntax

tcp-packet-option-tagging

Mode

Diag Advanced Network Settings

Description

Enable TCP packet option tagging.

Example

tcp-packet-option-tagging

Syntax

no tcp-packet-option-tagging

Mode

Diag Advanced Network Settings

Description

Disable TCP packet option tagging.

Example

no tcp-packet-option-tagging

Syntax

fix-malformed-tcp-headers

Mode

Diag Advanced Network Settings

Description

Enable fix/ignore malformed TCP headers.

Example

fix-malformed-tcp-headers

Syntax

no fix-malformed-tcp-headers

Mode

Diag Advanced Network Settings

Description

Disable fix/ignore malformed TCP headers.

Example

no fix-malformed-tcp-headers

Syntax

sequence-number-randomization

Mode

Diag Advanced Network Settings

Description

Enable TCP sequence number randomization.

Example

sequence-number-randomization

Syntax

no sequence-number-randomization

Mode

Diag Advanced Network Settings

Description

Disable TCP sequence number randomization.

Example

no sequence-number-randomization

Syntax

syn-validation

Mode

Diag Advanced Network Settings

Description

Enable performing SYN validation when not operating in strict TCP compliance mode.

Example

syn-validation

Syntax

no syn-validation

Mode

Diag Advanced Network Settings

Description

Disable performing SYN validation when not operating in strict TCP compliance mode.

Example

no syn-validation

Syntax

clear ospf

Mode

Diag Advanced Network Settings

Description

Clear OSPF process.

Example

clear ospf

Syntax

clear dont-fragment-bit

Mode

Diag Advanced Network Settings

Description

Enable clear DF (don't fragment) bit.

Example

clear dont-fragment-bit

Syntax

no clear dont-fragment-bit

Mode

Diag Advanced Network Settings

Description

Disable clear DF (don't fragment) bit.

Example

no clear dont-fragment-bit

Syntax

active-active-clustering-wiremode

Mode

Diag Advanced Network Settings

Description

Allow wiremode in Active/Active clustering.

Example

active-active-clustering-wiremode

Syntax

no active-active-clustering-wiremode

Mode

Diag Advanced Network Settings

Description

Disable allow wiremode in Active / Active clustering.

Example

no active-active-clustering-wiremode

Syntax

dmz-icmp-redirect

Mode

Diag Advanced Network Settings

Description

Enable ICMP redirect on DMZ zone.

Example

dmz-icmp-redirect

Syntax

no dmz-icmp-redirect

Mode

Diag Advanced Network Settings

Description

Disable ICMP redirect on DMZ zone.

Example

no dmz-icmp-redirect

Syntax

learning-bridge-filter

Mode

Diag Advanced Network Settings

Description

Enable learning-bridge filtering on L2 bridge interfaces.

Example

learning-bridge-filter

Syntax

no learning-bridge-filter

Mode

Diag Advanced Network Settings

Description

Disable learning-bridge filtering on L2 bridge interfaces.

Example

no learning-bridge-filter

Syntax

diag advanced dhcp

Mode

Config

Description

Configure advanced diag DHCP settings.

Example

diag advanced dhcp

Syntax

network-pre-discovery

Mode

Diag Advanced DHCP Settings

Description

Enable DHCP server network pre-discovery.

Example

network-pre-discovery

Syntax

no network-pre-discovery

Mode

Diag Advanced DHCP Settings

Description

Disable DHCP server network pre-discovery.

Example

no network-pre-discovery

Syntax

conflict-detect-period <UINT16>

Mode

Diag Advanced DHCP Settings

Description

Set the DHCP server conflict detect period in seconds.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

conflict-detect-period 300

Syntax

resources-to-discover <UINT8>

Mode

Diag Advanced DHCP Settings

Description

Set number of DHCP resources to discover.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

resources-to-discover 10

Syntax

conflicted-resource-timeout <UINT16>

Mode

Diag Advanced DHCP Settings

Description

Set the timeout for conflicted resource to be rechecked in seconds.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

conflicted-resource-timeout 1800

Syntax

available-resource-timeout <UINT16>

Mode

Diag Advanced DHCP Settings

Description

Set the timeout for available resource to be rechecked in seconds.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

available-resource-timeout 600

Syntax

save leases

Mode

Diag Advanced DHCP Settings

Description

Save DHCP leases to flash.

Example

save leases

Syntax

dhcpnak

Mode

Diag Advanced DHCP Settings

Description

Enable sending DHCPNAK if the 'requested IP address' is on the wrong network.

Example

dhcpnak

Syntax

no dhcpnak

Mode

Diag Advanced DHCP Settings

Description

Disable sending DHCPNAK if the 'requested IP address' is on the wrong network.

Example

no dhcpnak

Syntax

lease-database-refresh-interval <UINT16>

Mode

Diag Advanced DHCP Settings

Description

Set time interval of DHCP lease database to be refreshed in seconds.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

lease_database_refresh_interval 600

Syntax

lease-database-refresh-number <UINT16>

Mode

Diag Advanced DHCP Settings

Description

Set number of DHCP leases in database to be refreshed.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

lease_database_refresh_number 10

Syntax

recycle-expired-lease

Mode

Diag Advanced DHCP Settings

Description

Enable aggressively recycle expired DHCP leases in advance.

Example

recycle-expired-lease

Syntax

no recycle-expired-lease

Mode

Diag Advanced DHCP Settings

Description

Disable aggressively recycle expired DHCP leases in advance.

Example

no recycle-expired-lease

Syntax

diag advanced voip

Mode

Config

Description

Configure advanced diag VoIP settings.

Example

diag advanced voip

Syntax

max-endpoints <UINT16>

Mode

Diag Advanced VoIP Settings

Description

Set the maximum 'public' VoIP endpoints.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

max-endpoints 2048

Syntax

no max-endpoints

Mode

Diag Advanced VoIP Settings

Description

Clear the maximum 'public' VoIP endpoints.

Example

no max-endpoints

Syntax

auto-add-sip

Mode

Diag Advanced VoIP Settings

Description

Enable auto-add SIP endpoints.

Example

auto-add-sip

Syntax

no auto-add-sip

Mode

Diag Advanced VoIP Settings

Description

Disable auto-add SIP endpoints.

Example

no auto-add-sip

Syntax

sip-transforms

Mode

Diag Advanced VoIP Settings

Description

Enable transforming SIP URIs to have an explicit port.

Example

sip-transforms

Syntax

no sip-transforms

Mode

Diag Advanced VoIP Settings

Description

Disable transforming SIP URIs to have an explicit port.

Example

no sip-transforms

Syntax

invite-flush

Mode

Diag Advanced VoIP Settings

Description

Enable flush active media for SIP INVITEs without SDP.

Example

flush-active-media

Syntax

no invite-flush

Mode

Diag Advanced VoIP Settings

Description

Disable flush active media for SIP INVITEs without SDP.

Example

no invite-flush

Syntax

invite-flush-unused

Mode

Diag Advanced VoIP Settings

Description

Enable flush unused media for SIP INVITEs without SDP.

Example

invite-flush-unused

Syntax

no invite-flush-unused

Mode

Diag Advanced VoIP Settings

Description

Disable flush unused media for SIP INVITEs without SDP.

Example

no invite-flush-unused

Syntax

reset sip-database

Mode

Diag Advanced VoIP Settings

Description

Reset sip database.

Example

reset sip-database

Syntax

diag advanced vpn

Mode

Config

Description

Configure advanced diag VPN settings.

Example

diag advanced vpn

Syntax

adjust-tcp-mss

Mode

Diag Advanced VPN Settings

Description

Enable adjusting TCP MSS option for VPN traffic.

Example

adjust-tcp-mss

Syntax

no adjust-tcp-mss

Mode

Diag Advanced VPN Settings

Description

Do not adjusting TCP MSS option for VPN traffic.

Example

no adjust-tcp-mss

Syntax

interoperable-ike-dh-exchange

Mode

Diag Advanced VPN Settings

Description

Enable using interoperable IKE DH exchange .

Example

interoperable-ike-dh-exchange

Syntax

no interoperable-ike-dh-exchange

Mode

Diag Advanced VPN Settings

Description

Disable using interoperable IKE DH exchange .

Example

no interoperable-ike-dh-exchange

Syntax

fragment-after-esp

Mode

Diag Advanced VPN Settings

Description

Enable fragmenting VPN packets after applying ESP.

Example

fragment-after-esp

Syntax

no fragment-after-esp

Mode

Diag Advanced VPN Settings

Description

Disable fragmenting VPN packets after applying ESP.

Example

no fragment-after-esp

Syntax

spi-cpi-parameter-index

Mode

Diag Advanced VPN Settings

Description

Enable using SPI/CPI parameter index for IPsec/IPcomp passthru connections.

Example

spi-cpi-parameter-index

Syntax

no spi-cpi-parameter-index

Mode

Diag Advanced VPN Settings

Description

Disable using SPI/CPI parameter index for IPsec/IPcomp passthru connections.

Example

no spi-cpi-parameter-index

Syntax

trust-built-in-ca

Mode

Diag Advanced VPN Settings

Description

Enable trust built-in CA certificates for IKE authentication and local certificate import.

Example

trust-built-in-ca

Syntax

no trust-built-in-ca

Mode

Diag Advanced VPN Settings

Description

Disable trust built-in CA certificates for IKE authentication and local certificate import.

Example

no trust-built-in-ca

Syntax

preserve-ike-port

Mode

Diag Advanced VPN Settings

Description

Enable preserve IKE port for pass through connections.

Example

preserve-ike-port

Syntax

no preserve-ike-port

Mode

Diag Advanced VPN Settings

Description

Disable preserve IKE port for pass through connections.

Example

no preserve-ike-port

Syntax

diag advanced encryption

Mode

Config

Description

Configure advanced diag encryption settings.

Example

diag advanced encryption

Syntax

hardware-encryption

Mode

Diag Advanced Encryption

Description

Enable hardware encryption.

Example

hardware-encryption

Syntax

no hardware-encryption

Mode

Diag Advanced Encryption

Description

Disable hardware encryption.

Example

no hardware-encryption

Syntax

hardware-rsa

Mode

Diag Advanced Encryption

Description

Enable hardware rsa.

Example

hardware-rsa

Syntax

no hardware-rsa

Mode

Diag Advanced Encryption

Description

Disable hardware RSA.

Example

no hardware-rsa

Syntax

rc4-only-cipher

Mode

Diag Advanced Encryption

Description

Enable RC4-only cipher suite support.

Example

rc4-only-cipher

Syntax

no rc4-only-cipher

Mode

Diag Advanced Encryption

Description

Disable RC4-only cipher suite support.

Example

no rc4-only-cipher

Syntax

diag advanced firewall

Mode

Config

Description

Configure advanced diag firewall settings.

Example

diag advanced firewall

Syntax

ftp-bounce-attack-protection

Mode

All Modes

Description

Enable FTP bounce attack protection.

Example

ftp-bounce-attack-protection

Syntax

no ftp-bounce-attack-protection

Mode

All Modes

Description

Disable FTP bounce attack protection.

Example

no ftp-bounce-attack-protection

Syntax

ftp-protocol-anomaly-attack-protection

Mode

All Modes

Description

Enable FTP protocol anomaly attack protection.

Example

ftp-protocol-anomaly-attack-protection

Syntax

no ftp-protocol-anomaly-attack-protection

Mode

All Modes

Description

Disable FTP protocol anomaly attack protection.

Example

no ftp-protocol-anomaly-attack-protection

Syntax

orphan-data-connection

Mode

All Modes

Description

Enable allow orphan data connections.

Example

orphan-data-connection

Syntax

no orphan-data-connection

Mode

All Modes

Description

Disable allow orphan data connections.

Example

no orphan-data-connection

Syntax

ip-spoof-checking

Mode

All Modes

Description

Enable IP spoof checking.

Example

ip-spoof-checking

Syntax

no ip-spoof-checking

Mode

All Modes

Description

Disable IP spoof checking.

Example

no ip-spoof-checking

Syntax

port-scan-detection

Mode

All Modes

Description

Enable port scan detection.

Example

port-scan-detection

Syntax

no port-scan-detection

Mode

All Modes

Description

Disable port scan detection.

Example

no port-scan-detection

Syntax

anticipated-connection-timeout <UINT32>

Mode

All Modes

Description

Set timeout for anticipated TCP/UDP connections (seconds).

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

anticipated-connection-timeout 10

Syntax

no anticipated-connection-timeout

Mode

All Modes

Description

Clear timeout for anticipated TCP/UDP connections (seconds).

Example

no anticipated-connection-timeout

Syntax

anticipated-connection-parent-termination

Mode

All Modes

Description

Enable termination of parent on timeout of anticipated TCP/UDP connections.

Example

anticipated-connection-parent-termination

Syntax

no anticipated-connection-parent-termination

Mode

All Modes

Description

Disable termination of parent on timeout of anticipated TCP/UDP connections.

Example

no anticipated-connection-parent-termination

Syntax

anticipated-media-timeout <UINT32>

Mode

All Modes

Description

Set timeout for anticipated media connections(seconds).

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

anticipated-media-timeout 60

Syntax

no anticipated-media-timeout

Mode

All Modes

Description

Clear timeout for anticipated media connections(seconds).

Example

no anticipated-media-timeout

Syntax

anticipated-media-parent-termination

Mode

All Modes

Description

Enable termination of parent on timeout of anticipated media connections.

Example

anticipated-media-parent-termination

Syntax

no anticipated-media-parent-termination

Mode

All Modes

Description

Disable termination of parent on timeout of anticipated media connections.

Example

no anticipated-media-parent-termination

Syntax

trace-connections-port <IPV4_PORT>

Mode

All Modes

Description

Set TCP port to trace connections to.

Options

<IPV4_PORT> Integer in the form: D OR 0xHHHH.
Example: 80

Example

trace-connections-port 8080

Syntax

no trace-connections-port

Mode

All Modes

Description

Clear TCP port to trace connections to.

Example

no trace-connections-port

Syntax

include-tcp-data-connection

Mode

All Modes

Description

Enable include TCP data connections in traces.

Example

include-tcp-data-connection

Syntax

no include-tcp-data-connection

Mode

All Modes

Description

Disable include TCP data connections in traces.

Example

no include-tcp-data-connection

Syntax

track-bandwidth-usage

Mode

All Modes

Description

Enable tracking bandwidth usage for default traffic.

Example

track-bandwidth-usage

Syntax

no track-bandwidth-usage

Mode

All Modes

Description

Disable tracking bandwidth usage for default traffic.

Example

no track-bandwidth-usage

Syntax

decrease-connection-count-after-close

Mode

All Modes

Description

Enable decreasing connection count immediately after TCP connection close.

Example

decrease-connection-count-after-close

Syntax

no decrease-connection-count-after-close

Mode

All Modes

Description

Disable decreasing connection count immediately after TCP connection close.

Example

no decrease-connection-count-after-close

Syntax

tcp-state-manipulation-dos-protection

Mode

All Modes

Description

Enable protection against TCP state manipulation DoS.

Example

tcp-state-manipulation-dos-protection

Syntax

no tcp-state-manipulation-dos-protection

Mode

All Modes

Description

Disable protection against TCP state manipulation DoS.

Example

no tcp-state-manipulation-dos-protection

Syntax

sequential-addresses

Mode

All Modes

Description

Enable allocation of sequential addresses when performing many-to-few NAT.

Example

sequential-addresses

Syntax

no sequential-addresses

Mode

All Modes

Description

Disable allocation of sequential addresses when performing many-to-few NAT.

Example

no sequential-addresses

Syntax

default-policy-editable

Mode

All Modes

Description

Enable the ability to remove and fully edit auto-added access rules and NATs.

Example

default-policy-editable

Syntax

no default-policy-editable

Mode

All Modes

Description

Disable the ability to remove and fully edit auto-added access rules and NATs.

Example

no default-policy-editable

Syntax

udp-icmp-flood-detecting

Mode

All Modes

Description

Enable aggressive UDP/ICMP flood detecting.

Example

udp-icmp-flood-detecting

Syntax

no udp-icmp-flood-detecting

Mode

All Modes

Description

Disable aggressive UDP/ICMP flood detecting.

Example

no udp-icmp-flood-detecting

Syntax

clear connections

Mode

All Modes

Description

Clear connections.

Example

flush connections

Syntax

diag advanced support-windows-messenger

Mode

Config

Description

Enable support for windows messenger.

Example

diag advanced support-windows-messenger

Syntax

diag no advanced support-windows-messenger

Mode

Config

Description

Disable support for windows messenger..

Example

diag no advanced support-windows-messenger

Syntax

diag advanced security-services

Mode

Config

Description

Configure advanced diag security services settings.

Example

diag advanced security-services

Syntax

dpi-engine

Mode

Diag Advanced Security Services Settings

Description

Enable DPI engine.

Example

dpi-engine

Syntax

no dpi-engine

Mode

Diag Advanced Security Services Settings

Description

Disable DPI engine.

Example

no dpi-engine

Syntax

bidirectional-ips

Mode

Diag Advanced Security Services Settings

Description

Enable applying IPS signatures bidirectionally.

Example

bidirectional-ips

Syntax

no bidirectional-ips

Mode

Diag Advanced Security Services Settings

Description

Disable applying IPS signatures bidirectionally.

Example

no bidirectional-ips

Syntax

dpi-ip-fragment-reassembly

Mode

Diag Advanced Security Services Settings

Description

Enable IP fragment reassembly in DPI.

Example

dpi-ip-fragment-reassembly

Syntax

no dpi-ip-fragment-reassembly

Mode

Diag Advanced Security Services Settings

Description

Disable IP fragment reassembly in DPI.

Example

no dpi-ip-fragment-reassembly

Syntax

dev-debug

Mode

Diag Advanced Security Services Settings

Description

Enable extra dev debug info.

Example

dev-debug

Syntax

no dev-debug

Mode

Diag Advanced Security Services Settings

Description

Disable extra dev debug info.

Example

no dev-debug

Syntax

smtp-chunking-modification

Mode

Diag Advanced Security Services Settings

Description

Enable App-Firewall SMTP CHUNKING modification.

Example

smtp-chunking-modification

Syntax

no smtp-chunking-modification

Mode

Diag Advanced Security Services Settings

Description

Disable App-Firewall SMTP CHUNKING modification.

Example

no smtp-chunking-modification

Syntax

skype-detection-sig

Mode

Diag Advanced Security Services Settings

Description

Enable skype detection sig (sid: 2).

Example

skype-detection-sig

Syntax

no skype-detection-sig

Mode

Diag Advanced Security Services Settings

Description

Disable skype detection sig (sid: 2).

Example

no skype-detection-sig

Syntax

pop3-auto-deletion

Mode

Diag Advanced Security Services Settings

Description

Enable gateway AV POP3 auto deletion.

Example

pop3-auto-deletion

Syntax

no pop3-auto-deletion

Mode

Diag Advanced Security Services Settings

Description

Disable gateway AV POP3 auto deletion.

Example

no pop3-auto-deletion

Syntax

pop3-uidl-rewriting

Mode

Diag Advanced Security Services Settings

Description

Enable gateway AV POP3 UIDL rewriting.

Example

pop3-uidl-rewriting

Syntax

no pop3-uidl-rewriting

Mode

Diag Advanced Security Services Settings

Description

Disable gateway AV POP3 UIDL rewriting.

Example

no pop3-uidl-rewriting

Syntax

smb-read-write-enforcement

Mode

Diag Advanced Security Services Settings

Description

Enable gateway AV SMB read/write ordering enforcement.

Example

smb-read-write-enforcement

Syntax

no smb-read-write-enforcement

Mode

Diag Advanced Security Services Settings

Description

Disable gateway AV SMB read/write ordering enforcement.

Example

no smb-read-write-enforcement

Syntax

log-virus-uri

Mode

Diag Advanced Security Services Settings

Description

Enable log virus URI.

Example

log-virus-uri

Syntax

no log-virus-uri

Mode

Diag Advanced Security Services Settings

Description

Disable log virus URI.

Example

no log_virus_uri

Syntax

offset-qualifier-signature

Mode

Diag Advanced Security Services Settings

Description

Enable apply signatures containing file offset qualifiers <br> that trigger on TCP streams with unidentified protocols.

Example

offset-qualifier-signature

Syntax

no offset-qualifier-signature

Mode

Diag Advanced Security Services Settings

Description

Disable apply signatures containing file offset qualifiers <br> that trigger on TCP streams with unidentified protocols.

Example

no offset-qualifier-signature

Syntax

minimum-http-header-length <UINT16>

Mode

Diag Advanced Security Services Settings

Description

Set minimum HTTP header length (0 to disable).

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

minimum-http-header-length 0

Syntax

no minimum-http-header-length

Mode

Diag Advanced Security Services Settings

Description

Clear minimum HTTP header length (0 to disable).

Example

no minimum-http-header-length

Syntax

incremental-signature-updates

Mode

Diag Advanced Security Services Settings

Description

Enable incremental updates to IDP, GAV and SPY signature databases.

Example

incremental-signature-updates

Syntax

no incremental-signature-updates

Mode

Diag Advanced Security Services Settings

Description

Disable incremental updates to IDP, GAV and SPY signature databases.

Example

no incremental-signature-updates

Syntax

force-utm-offload

Mode

Diag Advanced Security Services Settings

Description

Enable force UTM offload.

Example

force-utm-offload

Syntax

no force-utm-offload

Mode

Diag Advanced Security Services Settings

Description

Disable force UTM offload.

Example

no force-utm-offload

Syntax

utm-traffic-offload <UINT8>

Mode

Diag Advanced Security Services Settings

Description

Set Active/Active UTM traffic Offload percentage.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

utm-traffic-offload 60

Syntax

no utm-traffic-offload

Mode

Diag Advanced Security Services Settings

Description

Clear Active/Active UTM traffic Offload percentage.

Example

no utm-traffic-offload

Syntax

limit-dpi-tcp-window-advertisement [ maximum <UINT16> ]

Mode

Diag Advanced Security Services Settings

Description

Enable enforcement of a limit on maximum allowed advertised TCP window with any DPI-based service enabled and set the maximum allowed.

Options

maximumSet the maximum allowed advertised TCP window with any DPI-based service enabled.
<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

limit-dpi-tcp-window-advertisement maximum 256

Syntax

no limit-dpi-tcp-window-advertisement

Mode

Diag Advanced Security Services Settings

Description

Disable enforcement of a limit on maximum allowed advertised TCP window with any DPI-based service enabled.

Example

no limit-dpi-tcp-window-advertisement

Syntax

threshold-limit <UINT32>

Mode

Diag Advanced Security Services Settings

Description

Threshold above which size limits are enforced on regex automaton.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

threshold-limit 5000

Syntax

maximum-regex-automaton-size <UINT32>

Mode

Diag Advanced Security Services Settings

Description

Maximum allowed size for regex automaton.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

maximum-regex-automaton-size 10000

Syntax

signature-database-reload

Mode

Diag Advanced Security Services Settings

Description

Enable signature database reload.

Example

signature-database-reload

Syntax

no signature-database-reload

Mode

Diag Advanced Security Services Settings

Description

Disable signature database reload.

Example

no signature-database-reload

Syntax

process-ips-signatures

Mode

Diag Advanced Security Services Settings

Description

Enable processing of IPS signatures.

Example

process-ips-signatures

Syntax

no process-ips-signatures

Mode

Diag Advanced Security Services Settings

Description

Disable processing of IPS signatures.

Example

no process-ips-signatures

Syntax

process-gav-signatures

Mode

Diag Advanced Security Services Settings

Description

Enable processing of GAV signatures.

Example

process-gav-signatures

Syntax

no process-gav-signatures

Mode

Diag Advanced Security Services Settings

Description

Disable processing of GAV signatures.

Example

no process-gav-signatures

Syntax

process-anti-spyware-signatures

Mode

Diag Advanced Security Services Settings

Description

Enable processing of Anti-Spyware signatures.

Example

process-anti-spyware-signatures

Syntax

no process-anti-spyware-signatures

Mode

Diag Advanced Security Services Settings

Description

Disable processing of Anti-Spyware signatures.

Example

no process-anti-spyware-signatures

Syntax

process-app-signatures

Mode

Diag Advanced Security Services Settings

Description

Enable processing of App signatures.

Example

process-app-signatures

Syntax

no process-app-signatures

Mode

Diag Advanced Security Services Settings

Description

Disable processing of App signatures.

Example

no process-app-signatures

Syntax

optimal-value [ val <UINT32> ]

Mode

Diag Advanced Security Services Settings

Description

Enable optimal value and set the value.

Options

valSet the optimal value.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

optimal-value 10240

Syntax

no optimal-value

Mode

Diag Advanced Security Services Settings

Description

Disable optimal value and set the value.

Example

no optimal-value

Syntax

limit-ips-cft-scan

Mode

Diag Advanced Security Services Settings

Description

Eable limit IPS CFT scan.

Example

limit-ips-cft-scan

Syntax

no limit-ips-cft-scan

Mode

Diag Advanced Security Services Settings

Description

Disable limit IPS CFT scan.

Example

no limit-ips-cft-scan

Syntax

enforce-cfs-host-tag-search

Mode

Diag Advanced Security Services Settings

Description

Enable enforcement of host tag search for CFS.

Example

enforce-cfs-host-tag-search

Syntax

no enforce-cfs-host-tag-search

Mode

Diag Advanced Security Services Settings

Description

Disable enforcement of host tag search for CFS.

Example

no enforce-cfs-host-tag-search

Syntax

local-cfs-server [ primary <IPV4_HOST> ] [ secondary <IPV4_HOST> ]

Mode

Diag Advanced Security Services Settings

Description

Enable local CFS server and set the IP addresses.

Options

primaryPrimary local CFS server.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
secondarySecondary local CFS server.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

local-cfs-server

local-cfs-server primary 10.10.10.10
local-cfs-server secondary 10.10.10.11

Syntax

no local-cfs-server

Mode

Diag Advanced Security Services Settings

Description

Disable local CFS server.

Example

no local-cfs-server

Syntax

client-anti-virus-timeout <UINT32>

Mode

Diag Advanced Security Services Settings

Description

Set client AV cache timeout (minutes).

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

client-anti-virus-timeout 5

Syntax

reset av-info

Mode

Diag Advanced Security Services Settings

Description

Reset AV info.

Example

reset av-info

Syntax

reset licenses

Mode

Diag Advanced Security Services Settings

Description

Reset licenses and security services info.

Example

reset licenses

Syntax

reset client-content-filtering info

Mode

Diag Advanced Security Services Settings

Description

Reset client CF enforcement info.

Options

infoReset client CF enforcement info.

Example

reset client-content-filtering info

Syntax

reset client-content-filtering cache

Mode

Diag Advanced Security Services Settings

Description

Reset client CF enforcement cache.

Options

cacheReset client CF enforcement cache.

Example

reset client-content-filtering cache

Syntax

reset http-clientless-notification-cache

Mode

Diag Advanced Security Services Settings

Description

Reset HTTP clientless notification cache.

Example

reset http-clientless-notification-cache

Syntax

reset cloud-av-cache

Mode

Diag Advanced Security Services Settings

Description

Reset cloud AV cache.

Example

reset cloud-av-cache

Syntax

cloud-av-server [ host <HOSTNAME> ]

Mode

Diag Advanced Security Services Settings

Description

Enable private cloud AV server and set the IP address.

Options

hostPrivate cloud AV server IP or name.
<HOSTNAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com

Example

cloud-av-server

cloud-av-server host 10.10.10.12

Syntax

no cloud-av-server

Mode

Diag Advanced Security Services Settings

Description

Disable private cloud AV server.

Example

no cloud-av-server

Syntax

diag advanced dpi-ssl

Mode

Config

Description

Configure advanced diag DPI-SSL settings.

Example

diag advanced dpi-ssl

Syntax

rewritten-certificate-sn-modifier <UINT16>

Mode

Diag Advanced DPI-SSL Settings

Description

Set rewritten certificate SN modifier.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

rewritten-certificate-sn-modifier 1

Syntax

client-spoofed-certificate-caching

Mode

Diag Advanced DPI-SSL Settings

Description

Enable client spoofed certificate caching.

Example

client-spoofed-certificate-caching

Syntax

no client-spoofed-certificate-caching

Mode

Diag Advanced DPI-SSL Settings

Description

Disable client spoofed certificate caching.

Example

no client-spoofed-certificate-caching

Syntax

remove-tcp-timestamp-option

Mode

Diag Advanced DPI-SSL Settings

Description

Enable removing TCP timestamp option.

Example

remove-tcp-timestamp-option

Syntax

no remove-tcp-timestamp-option

Mode

Diag Advanced DPI-SSL Settings

Description

Disable removing TCP timestamp option.

Example

no remove-tcp-timestamp-option

Syntax

drop-ssl-on-low-memory

Mode

Diag Advanced DPI-SSL Settings

Description

Enable dropping SSL packets when memory low.

Example

drop-ssl-on-low-memory

Syntax

no drop-ssl-on-low-memory

Mode

Diag Advanced DPI-SSL Settings

Description

Disable dropping SSL packets when memory low.

Example

no drop-ssl-on-low-memory

Syntax

proxyless-ssl-when-limit-exceeded

Mode

Diag Advanced DPI-SSL Settings

Description

Enable allowing SSL without proxy when connection limit exceeded.

Example

proxyless-ssl-when-limit-exceeded

Syntax

no proxyless-ssl-when-limit-exceeded

Mode

Diag Advanced DPI-SSL Settings

Description

Disable allowing SSL without proxy when connection limit exceeded.

Example

no proxyless-ssl-when-limit-exceeded

Syntax

endpoint-tcp-window-setup

Mode

Diag Advanced DPI-SSL Settings

Description

Enable endpoint TCP window setup.

Example

endpoint-tcp-window-setup

Syntax

no endpoint-tcp-window-setup

Mode

Diag Advanced DPI-SSL Settings

Description

Disable endpoint TCP window setup.

Example

no endpoint-tcp-window-setup

Syntax

server-facing-session-reuse

Mode

Diag Advanced DPI-SSL Settings

Description

Enable server facing session reuse.

Example

server-facing-session-reuse

Syntax

no server-facing-session-reuse

Mode

Diag Advanced DPI-SSL Settings

Description

Disable server facing session reuse.

Example

no server-facing-session-reuse

Syntax

block-untrusted-certificate-connections

Mode

Diag Advanced DPI-SSL Settings

Description

Enable blocking connections to sites with untrusted certificates.

Example

block-untrusted-certificate-connections

Syntax

no block-untrusted-certificate-connections

Mode

Diag Advanced DPI-SSL Settings

Description

Disable blocking connections to sites with untrusted certificates.

Example

no block-untrusted-certificate-connections

Syntax

max-stream-offset <UINT16>

Mode

Diag Advanced DPI-SSL Settings

Description

Set max stream offset to check for SSL client-hello resemblance.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

max-stream-offset 512

Syntax

no max-stream-offset

Mode

Diag Advanced DPI-SSL Settings

Description

Clear max stream offset to check for SSL client-hello resemblance.

Example

no max-stream-offset

Syntax

tcp-window-multiplier <UINT8>

Mode

Diag Advanced DPI-SSL Settings

Description

Set TCP window multiplier (N *64k).

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

tcp-window-multiplier 8

Syntax

max-proxied-connections <UINT16>

Mode

Diag Advanced DPI-SSL Settings

Description

Set the override for max proxied SSL connections.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

max-proxied-connections 0

Syntax

no max-proxied-connections

Mode

Diag Advanced DPI-SSL Settings

Description

Clear the override for max proxied SSL connections.

Example

no max-proxied-connections

Syntax

update-security-services-info

Mode

Diag Advanced DPI-SSL Settings

Description

Update licenses and security services info.

Example

update-security-services-info

Syntax

ssl-version { ssl-v23 | ssl-v3 | tls-v1 }

Mode

Diag Advanced DPI-SSL Settings

Description

Set ssl version.

Options

 
ssl-v23ssl version23.
 
ssl-v3ssl version3.0.
 
tls-v1tls version1.0.

Example

ssl-version ssl-v3

Syntax

cipher-method { aes128-sha1 | aes256-sha1 | default | rc4-md5 | tripldes-sha1 }

Mode

Diag Advanced DPI-SSL Settings

Description

Set ssl cipher method.

Options

 
aes128-sha1AES128_SHA1 cipermethod.
 
aes256-sha1AES256-SHA1 ciper method.
 
defaultDefault cipher method.
 
rc4-md5RC4-MD5 cipermethod.
 
tripldes-sha13DES-SHA1 cipermethod.

Example

cipher-method default

Syntax

diag advanced high-availability

Mode

Config

Description

Configure advanced diag High Availability settings.

Example

diag advanced high-availability

Syntax

idle-monitor

Mode

Diag Advanced High Availability Settings

Description

Enable network monitor probing on idle unit.

Example

idle-monitor

Syntax

no idle-monitor

Mode

Diag Advanced High Availability Settings

Description

Disable network monitor probing on idle unit.

Example

no idle-monitor

Syntax

suppress-active-transition-alarm

Mode

Diag Advanced High Availability Settings

Description

Enable suppressing alarm on HA transition to active.

Example

suppress-active-transition-alarm

Syntax

no suppress-active-transition-alarm

Mode

Diag Advanced High Availability Settings

Description

Disable suppressing alarm on HA transition to active.

Example

no suppress-active-transition-alarm

Syntax

restart-backup-on-watchdog

Mode

Diag Advanced High Availability Settings

Description

Enable always restarting HA backup for watchdog task.

Example

restart-backup-on-watchdog

Syntax

no restart-backup-on-watchdog

Mode

Diag Advanced High Availability Settings

Description

Disable always restarting HA backup for watchdog task .

Example

no restart-backup-on-watchdog

Syntax

interleave-cache

Mode

Diag Advanced High Availability Settings

Description

Enable interleave connection cache state synchronization messages.

Example

interleave-cache

Syntax

no interleave-cache

Mode

Diag Advanced High Availability Settings

Description

Disable interleave connection cache state synchronization messages.

Example

no interleave-cache

Syntax

transparent-mode-gratuitous-arp

Mode

Diag Advanced High Availability Settings

Description

Enable sending gratuitous ARP to DMZ or LAN on transparent mode while HA failover.

Example

transparent-mode-gratuitous-arp

Syntax

no transparent-mode-gratuitous-arp

Mode

Diag Advanced High Availability Settings

Description

Disable sending gratuitous ARP to DMZ or LAN on transparent mode while HA failover.

Example

no transparent-mode-gratuitous-arp

Syntax

max-transparent-mode-gratuitous-arps <UINT32>

Mode

Diag Advanced High Availability Settings

Description

Set maximum number of gratuitous ARP of transparent mode per interface while HA failover.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

max-transparent-mode-gratuitous-arps 256

Syntax

max-gratuitous-arps <UINT32>

Mode

Diag Advanced High Availability Settings

Description

Set maximum number of gratuitous ARP while HA failover.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

max-gratuitous-arps 1

Syntax

diag advanced pppoe

Mode

Config

Description

Configure advanced diag PPPoE settings.

Example

diag advanced pppoe

Syntax

lcp-requests

Mode

Diag Advanced PPPoE Settings

Description

Enable allowing LCP requests to PPPoE server.

Example

lcp-requests

Syntax

no lcp-requests

Mode

Diag Advanced PPPoE Settings

Description

Disable allowing LCP requests to PPPoE server.

Example

no lcp-requests

Syntax

log-lcp-echo

Mode

Diag Advanced PPPoE Settings

Description

Enable logging LCP echo requests and replies between client and server.

Example

log-lcp-echo

Syntax

no log-lcp-echo

Mode

Diag Advanced PPPoE Settings

Description

Disable logging LCP echo requests and replies between client and server.

Example

no log-lcp-echo

Syntax

end-of-list-tag

Mode

Diag Advanced PPPoE Settings

Description

Enable PPPoE End-Of-List tag.

Example

end-of-list-tag

Syntax

no end-of-list-tag

Mode

Diag Advanced PPPoE Settings

Description

Disable PPPoE End-Of-List tag.

Example

no end-of-list-tag

Syntax

netmask <IPV4_HOST>

Mode

Diag Advanced PPPoE Settings

Description

Set PPPoE netmask.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

netmask 255.255.255.252

Syntax

no netmask

Mode

Diag Advanced PPPoE Settings

Description

Clear PPPoE netmask.

Example

no netmask

Syntax

diag advanced dial-up

Mode

Config

Description

Configure advanced diag dial-up settings.

Example

diag advanced dial-up

Syntax

display-status

Mode

Diag Advanced Dial-Up Settings

Description

Enable display dialup status on console.

Example

display-status

Syntax

no display-status

Mode

Diag Advanced Dial-Up Settings

Description

Disable display dialup status on console.

Example

no display-status

Syntax

max-pppdu-failure <UINT16>

Mode

Diag Advanced Dial-Up Settings

Description

Set PPPDU max configuration failure number.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

max-pppdu-failure 9

Syntax

reset

Mode

Diag Advanced Dial-Up Settings

Description

Restart dial-up devices.

Example

reset

Syntax

diag advanced dpi-sateful-firewall-sec

Mode

Config

Description

DPI and stateful firewall security.

Example

diag advanced dpi-sateful-firewall-sec

Syntax

diag advanced sateful-firewall-sec

Mode

Config

Description

Stateful firewall security.

Example

diag advanced sateful-firewall-sec

Syntax

diag advanced management

Mode

Config

Description

Configure advanced diag management settings.

Example

diag advanced management

Syntax

standby-management-sa

Mode

Diag Advanced Management Settings

Description

Enable using standby management SA.

Example

standby-management-sa

Syntax

no standby-management-sa

Mode

Diag Advanced Management Settings

Description

Disable using standby management SA.

Example

no standby-management-sa

Syntax

gms-preempts-admin

Mode

Diag Advanced Management Settings

Description

Enable allowing SGMS to preempt a logged in administrator.

Example

gms-preempts-admin

Syntax

no gms-preempts-admin

Mode

Diag Advanced Management Settings

Description

Disable allowing SGMS to preempt a logged in administrator.

Example

no gms-preempts-admin

Syntax

http-management

Mode

Diag Advanced Management Settings

Description

Allow management via HTTP.

Example

http-management

Syntax

no http-management

Mode

Diag Advanced Management Settings

Description

Disable allow management via HTTP.

Example

no http-management

Syntax

classic-view

Mode

Diag Advanced Management Settings

Description

Show classic address Objects, services and NAT polcies view pages.

Example

classic-view

Syntax

no classic-view

Mode

Diag Advanced Management Settings

Description

Disable show classic address objects, services and NAT polcies view pages.

Example

no classic-view

Syntax

online-help-url { default | override [ url <WORD> ] }

Mode

Diag Advanced Management Settings

Description

Set the online help URL.

Options

 
defaultUse the default global help system URL.
 
overrideOverride the default using the configured value.
urlSet URL.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

online-help-url url "help.mysonicwall.com/help.asp"

Syntax

diag advanced user-authentication

Mode

Config

Description

Configure advanced diag user authentication settings.

Example

diag advanced user-authentication

Syntax

post-authentication-redirect-url <URL>

Mode

Diag Advanced User Authentication Settings

Description

Set post authentication user redirect URL.

Options

<URL> URL in the form: http://host/file.
Example: http://www.example.com/products/

Example

post-authentication-redirect-url "10.10.10.10/welcome.asp"

Syntax

no post-authentication-redirect-url

Mode

Diag Advanced User Authentication Settings

Description

Clear post authentication user redirect URL.

Example

no post-authentication-redirect-url

Syntax

logout users

Mode

Diag Advanced User Authentication Settings

Description

Logout all users.

Example

logout users

Syntax

log-all-sso-attempts [ { sso-auth-log [ buffer-full { stop | wrap } | max-buffer <UINT32> ] } | event-log ]

Mode

Diag Advanced User Authentication Settings

Description

Enable logging an audit trail of all SSO attempts in the event log.

Options

 
sso-auth-logLog in in memory to download as ssoAuthLog.wri.
 
buffer-fullWhen buffer is full.
 
stopWhen buffer is full, stop logging.
 
wrapEnable including SSO polling, wrap logging.
 
max-bufferMax buffer size.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123
 
event-logLog in the event log.

Example

log-all-sso-attempts

Syntax

no log-all-sso-attempts

Mode

Diag Advanced User Authentication Settings

Description

Disable logging and audit trail of all SSO attempts in the event log.

Example

no log-all-sso-attempts

Syntax

user-ip { all | group <ADDR_GROUP_NAME> | name <ADDR_NAME> }

Mode

Diag Advanced User Authentication Settings

Description

Set user ip address object name or group name.

Options

 
allAll.
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server

Example

user-ip group "ALL X1 Managemetn IP"

Syntax

include-sso-polling

Mode

Diag Advanced User Authentication Settings

Description

Set log include SSO polling.

Example

include-sso-polling

Syntax

no include-sso-polling

Mode

Diag Advanced User Authentication Settings

Description

Disable log include SSO polling.

Example

no include-sso-polling

Syntax

include-sso-bypass

Mode

Diag Advanced User Authentication Settings

Description

Set log include SSO bypass.

Example

include-sso-bypass

Syntax

no include-sso-bypass

Mode

Diag Advanced User Authentication Settings

Description

Disable log include SSO bypass.

Example

no include-sso-bypass

Syntax

include-additional-non-initiation

Mode

Diag Advanced User Authentication Settings

Description

Set log additional non initiation of SSO.

Example

include-additional-non-initiation

Syntax

no include-additional-non-initiation

Mode

Diag Advanced User Authentication Settings

Description

Disable log additional non initiation of SSO.

Example

no include-additional-non-initiation

Syntax

sso-agent-verison-negotiation <UINT32>

Mode

Diag Advanced User Authentication Settings

Description

Set version try to negotiate SSO agent protocol to(default version 5).

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

sso-agent-verison-negotiation 5

Syntax

no sso-agent-verison-negotiation

Mode

Diag Advanced User Authentication Settings

Description

Disable to negotiate SSO agent protocol version.

Example

no sso-agent-verison-negotiation

Syntax

diag advanced diagnostics

Mode

Config

Description

Configure advanced diag diagnostics settings.

Example

diag advanced diagnostics

Syntax

setup-tool-server

Mode

Diag Advanced Diagnostics Settings

Description

Enable SonicSetup/Setuptool server.

Example

setup-tool-server

Syntax

no setup-tool-server

Mode

Diag Advanced Diagnostics Settings

Description

Disable SonicSetup/Setuptool server.

Example

no setup-tool-server

Syntax

trace-message-level { error | fatal | info | verbose | warning }

Mode

Diag Advanced Diagnostics Settings

Description

Set the trace message level.

Options

 
errorError.
 
fatalFatal.
 
infoInfo.
 
verboseVerbose.
 
warningWarning.

Example

trace-message-level

Syntax

auto-restart [ every <UINT32> ]

Mode

Diag Advanced Diagnostics Settings

Description

Enable (for diagnostic testing purposes) auto-restarting system every set amount of minutes.

Options

everySet number of minutes to auto-restart system.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

auto-restart every 60

Syntax

no auto-restart

Mode

Diag Advanced Diagnostics Settings

Description

Disable (for diagnostic testing purposes) auto-restarting system every set amount of minutes.

Example

no auto-restart

Syntax

secured-crash-analysis

Mode

Diag Advanced Diagnostics Settings

Description

Enable secured www.mysonicwall.com crash analysis.

Example

secured-crash-analysis

Syntax

no secured-crash-analysis

Mode

Diag Advanced Diagnostics Settings

Description

Disable secured www.mysonicwall.com crash analysis.

Example

no secured-crash-analysis

Syntax

show-user-diagnostics

Mode

Diag Advanced Diagnostics Settings

Description

Enable to show user diagnostics on web block by CFS.

Example

show-user-diagnostics

Syntax

no show-user-diagnostics

Mode

Diag Advanced Diagnostics Settings

Description

Disable to show user diagnostics on web block by CFS.

Example

no show-user-diagnostics

Syntax

wan-connectivity-test start

Mode

Diag Advanced Diagnostics Settings

Description

WAN connectivity test.

Example

wan-connectivity-test start

Syntax

wan-connectivity-test target-ip <IPV4_HOST>

Mode

Diag Advanced Diagnostics Settings

Description

Set WAN connectivity test target IP.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

wan-connectivity-test target-ip 10.10.10.10

Syntax

no wan-connectivity-test target-ip

Mode

Diag Advanced Diagnostics Settings

Description

Clear WAN connectivity test target IP.

Example

no wan-connectivity target-ip

Syntax

wan-connectivity-test stop

Mode

Diag Advanced Diagnostics Settings

Description

WAN connectivity test.

Example

wan-connectivity-test stop

Syntax

send wan-connectivity-test log

Mode

Diag Advanced Diagnostics Settings

Description

Send WAN connectivity state log.

Example

send wan-connectivity-test log

Syntax

dp-jobs-tracked <UINT8>

Mode

Diag Advanced Diagnostics Settings

Description

Set number of jobs executed by data plane task to be tracked.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

dp-jobs-tracked 10

Syntax

diag advanced watchdog

Mode

Config

Description

Configure advanced diag watchdog settings.

Example

diag advanced watchdog

Syntax

cpu-watchdog

Mode

Diag Advanced Watchdog Settings

Description

Enable CPU watchdog.

Example

cpu-watchdog

Syntax

no cpu-watchdog

Mode

Diag Advanced Watchdog Settings

Description

Disable CPU watchdog.

Example

no cpu-watchdog

Syntax

restart-for

Mode

Diag Advanced Watchdog Settings

Description

Enable restarting for watchdog task.

Example

restart-for

Syntax

no restart-for

Mode

Diag Advanced Watchdog Settings

Description

Disable restarting for watchdog task.

Example

no restart-for

Syntax

quick-restart

Mode

Diag Advanced Watchdog Settings

Description

Enable restarting quickly after an exception.

Example

quick-restart

Syntax

no quick-restart

Mode

Diag Advanced Watchdog Settings

Description

Disable restarting quickly after an exception.

Example

no quick-restart

Syntax

diag advanced wireless

Mode

Config

Description

Configure advanced diag wireless settings.

Example

diag advanced wireless

Syntax

regulatory-domain

Mode

Diag Advanced Wireless Settings

Description

Enable wireless regulatory domain.

Example

regulatory-domain

Syntax

no regulatory-domain

Mode

Diag Advanced Wireless Settings

Description

Disbale wireless regulatory domain.

Example

no regulatory-domain

Syntax

sonicpoint support-type { all | sonicpoint-only | sonicpointn-only }

Mode

Diag Advanced Wireless Settings

Description

Set supported sonicPoint type.

Options

 
allAll types.
 
sonicpoint-onlyOnly support sonicpoint.
 
sonicpointn-onlyOnly support sonicpointn.

Example

sonicpoint support-type all

Syntax

vap-bssid-local-bit

Mode

Diag Advanced Wireless Settings

Description

Set local bit for virtual access point BSSID MAC address.

Example

vap-bssid-local-bit

Syntax

no vap-bssid-local-bit

Mode

Diag Advanced Wireless Settings

Description

Disable to set local bit for virtual access point BSSID MAC address.

Example

no vap-bssid-local-bit

Syntax

sonicpoint legacy-management

Mode

Diag Advanced Wireless Settings

Description

Enforce legacy SonicPoint-A/B/G and SonicPoint-G Only to be managed.

Example

sonicpoint legacy-management

Syntax

no sonicpoint legacy-management

Mode

Diag Advanced Wireless Settings

Description

Disable enforce legacy SonicPoint-A/B/G and SonicPoint-G Only to be managed.

Example

no sonicpoint legacy-management

Syntax

sonicpoint update-firmare

Mode

Diag Advanced Wireless Settings

Description

Update all sonicPoint firmware.

Example

sonicpoint update-firmare

Syntax

sonicpoint keepalive-enforcement

Mode

Diag Advanced Wireless Settings

Description

Enable sonicPoint keepalive enforcement.

Example

sonicpoint keepalive-enforcement

Syntax

no sonicpoint keepalive-enforcement

Mode

Diag Advanced Wireless Settings

Description

Disable sonicPoint keepalive enforcement.

Example

no sonicpoint keepalive-enforcement

Syntax

sonicpoint profile-tcp-window-size <UINT16>

Mode

Diag Advanced Wireless Settings

Description

Set sonicPoint provisioning profile TCP window size.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

sonicpoint profile-tcp-window-size 1400

Syntax

no sonicpoint profile-tcp-window-size

Mode

Diag Advanced Wireless Settings

Description

Clear sonicPoint provisioning profile TCP window size.

Example

sonicpoint profile-tcp-window-size 1400

Syntax

sonicpoint default-window-size

Mode

Diag Advanced Wireless Settings

Description

Use default TCP window size for sonicpointn provisioning protocol.

Example

sonicpoint default-window-size

Syntax

no sonicpoint default-window-size

Mode

Diag Advanced Wireless Settings

Description

Disable to use default TCP window size for sonicpointn provisioning protocol.

Example

no sonicpoint default-window-size

Syntax

sonicpointn prefer-channel-1-6-11

Mode

Diag Advanced Wireless Settings

Description

Prefer sonicpointn 2.4GHz Auto channel selection to be 1, 6 and 11 only.

Example

sonicpointn prefer-channel-1-6-11

Syntax

no sonicpointn prefer-channel-1-6-11

Mode

Diag Advanced Wireless Settings

Description

Disable to prefer sonicpointn 2.4GHz Auto channel selection to be 1, 6 and 11 only.

Example

no sonicpointn prefer-channel-1-6-11

Syntax

sonicpointn ssh-management

Mode

Diag Advanced Wireless Settings

Description

Enable SonicPointN SSH management.

Example

sonicpointn ssh-management

Syntax

no sonicpointn ssh-management

Mode

Diag Advanced Wireless Settings

Description

Disable SonicPointN SSH management.

Example

no sonicpointn ssh-management

Syntax

sonicpointn logging

Mode

Diag Advanced Wireless Settings

Description

Enable SonicPointN logging.

Example

sonicpointn logging

Syntax

no sonicpointn logging

Mode

Diag Advanced Wireless Settings

Description

Disable SonicPointN logging.

Example

no sonicpointn logging

Syntax

sonicpoint erase-old-crash-log

Mode

Diag Advanced Wireless Settings

Description

Erase SonicPoint crash log generated by previous firmware image when SonicPoint image is updated.

Example

sonicpoint erase-old-crash-log

Syntax

no sonicpoint erase-old-crash-log

Mode

Diag Advanced Wireless Settings

Description

Disable to erase SonicPoint crash log generated by previous firmware image.

Example

no sonicpoint erase-old-crash-log

Syntax

sonicpointn noise-security-level { extremely-high | extremely-low | high | low | medium }

Mode

Diag Advanced Diagnostics Settings

Description

Set SonicPoint-Ni/Ne noise sensitivity level: <br> (The higher noise sensitivity level should be selected when RF environment is getting noiser).

Options

 
extremely-highExtremely high.
 
extremely-lowExtremely low.
 
highHigh.
 
lowLow.
 
mediumMedium.

Example

sonicpointn noise-security-level medium

Syntax

no sonicpointn noise-security-level

Mode

Diag Advanced Wireless Settings

Description

Disable SonicPoint-Ni/Ne noise sensitivity.

Example

no sonicpointn noise-security-level

Syntax

sonicpointn noise-safemode-reboot

Mode

Diag Advanced Wireless Settings

Description

Reboot SonicPointN when noise safe mode detected.

Example

sonicpointn noise-safemode-reboot

Syntax

no sonicpointn noise-safemode-reboot

Mode

Diag Advanced Wireless Settings

Description

Disable to reboot SonicPointN when noise safe mode detected.

Example

no sonicpoint noise-safemode-reboot

Syntax

sonicpoint retain-ip

Mode

Diag Advanced Wireless Settings

Description

Enable SonicPoint(N) IP address retaining.

Example

sonicpoint retain-ip

Syntax

no sonicpoint retain-ip

Mode

Diag Advanced Wireless Settings

Description

Disable SonicPoint(N) IP address retaining.

Example

no sonicpoint retain-ip

Syntax

sonicpoint snap-header

Mode

Diag Advanced Wireless Settings

Description

Use SNAP packet between SonicPoint / SonicPointN and gateway.

Example

sonicpoint snap-header

Syntax

no sonicpoint snap-header

Mode

Diag Advanced Wireless Settings

Description

Disable to use SNAP packet between SonicPoint / SonicPointN and gateway.

Example

no sonicpoint snap-header

Syntax

sonicpoint fragment-icmp

Mode

Diag Advanced Wireless Settings

Description

Send need fragment ICMP packet to SonicPoint / SonicPointN client.

Example

sonicpoint fragment-icmp

Syntax

no sonicpoint fragment-icmp

Mode

Diag Advanced Wireless Settings

Description

Disable to send need fragment ICMP packet to SonicPoint / SonicPointN client.

Example

no sonicpoint fragment-icmp

Syntax

bonjour-intra-wlan

Mode

Diag Advanced Wireless Settings

Description

Enable intra-WLAN zone communication for bonjour packet.

Example

bonjour-intra-wlan

Syntax

no bonjour-intra-wlan

Mode

Diag Advanced Wireless Settings

Description

Disable intra-WLAN zone communication for bonjour packet.

Example

no bonjour-intra-wlan

Syntax

dhcp-arp-enhancement

Mode

Diag Advanced Wireless Settings

Description

WLAN DHCP lease / ARP delivery success rate enhancement.

Example

dhcp-arp-enhancement

Syntax

no dhcp-arp-enhancement

Mode

Diag Advanced Wireless Settings

Description

Disable WLAN DHCP lease / ARP delivery success rate enhancement.

Example

no dhcp-arp-enhancement

Syntax

guest-services-redirect-interval <UINT8>

Mode

Diag Advanced Wireless Settings

Description

Set wireless guest services redirect interval in seconds.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

guest-services-redirect-interval 15

Syntax

wifisec-enforcement

Mode

Diag Advanced Wireless Settings

Description

Enable legacy WiFiSec enforcement support.

Example

wifisec-enforcement

Syntax

no wifisec-enforcement

Mode

Diag Advanced Wireless Settings

Description

Disable legacy WiFiSec enforcement support.

Example

no wifisec-enforcement

Syntax

wlan reply-wifisec-enforcement

Mode

Diag Advanced Wireless Settings

Description

Enable applying WiFi security enforcement on reply traffic from WLAN to any other zone.

Example

wlan reply-wifisec-enforcement

Syntax

no wlan reply-wifisec-enforcement

Mode

Diag Advanced Wireless Settings

Description

Disable applying WiFi security enforcement on reply traffic from WLAN to any other zone.

Example

no wlan reply-wifisec-enforcement

Syntax

wlan dp-core-processing

Mode

Diag Advanced Wireless Settings

Description

Enable WLAN traffic DP core processing capability.

Example

wlan dp-core-processing

Syntax

no wlan dp-core-processing

Mode

Diag Advanced Wireless Settings

Description

Disable WLAN traffic DP core processing capability.

Example

no wlan dp-core-processing

Syntax

wlan broadcast-communication

Mode

Diag Advanced Wireless Settings

Description

Enable intra-WLAN zone communication for broadcast packet.

Example

wlan broadcast-communication

Syntax

no wlan broadcast-communication

Mode

Diag Advanced Wireless Settings

Description

Disable intra-WLAN Zone communication for broadcast packet.

Example

no wlan broadcast-communication

Syntax

wlan bypass-gateway-firewalling

Mode

Diag Advanced Wireless Settings

Description

Enable local wireless zone traffic to bypass gateway firewalling.

Example

wlan bypass-gateway-firewalling

Syntax

no wlan bypass-gateway-firewalling

Mode

Diag Advanced Wireless Settings

Description

Disable local wireless zone traffic to bypass gateway firewalling.

Example

no wlan bypass-gateway-firewalling

Syntax

diag advanced tooltip-no-description

Mode

Config

Description

Enable tooltip with no descriptions.

Example

diag advanced tooltip-no-description

Syntax

diag no advanced tooltip-no-description

Mode

Config

Description

Disable tooltip with no descriptions.

Example

diag no advanced tooltip-no-description

Syntax

diag advanced preference

Mode

Config

Description

Configure advanced diag preference conversion.

Example

diag advanced preference

Syntax

launching-conversion-control

Mode

Diag Advanced Preference Conversion

Description

Enable showing control for launching preference conversion window.

Example

launching-conversion-control

Syntax

no launching-conversion-control

Mode

Diag Advanced Preference Conversion

Description

Disable showing control for launching preference conversion window.

Example

no launching-conversion-control

Syntax

processor-server <HOSTNAME>

Mode

Diag Advanced Preference Conversion

Description

Set preference processor server.

Options

<HOSTNAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com

Example

processor-server convert.global.sonicwall.com

Syntax

no processor-server

Mode

Diag Advanced Preference Conversion

Description

Clear preference processor server.

Example

no processor-server

Syntax

secure-http-to-processor

Mode

Diag Advanced Preference Conversion

Description

Enable using secure HTTP to connect to preference processor server.

Example

secure-http-to-processor

Syntax

no secure-http-to-processor

Mode

Diag Advanced Preference Conversion

Description

Disable using secure HTTP to connect to preference processor server.

Example

no secure-http-to-processor

Syntax

site-relative-directory <WORD>

Mode

Diag Advanced Preference Conversion

Description

Set site relative directory.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

site-relative-directory "/popup"

Syntax

no site-relative-directory

Mode

Diag Advanced Preference Conversion

Description

Clear site relative directory.

Example

no site-relative-directory

Syntax

check-when-importing

Mode

Diag Advanced Preference Conversion

Description

Enable checking when importing settings.

Example

check-when-importing

Syntax

no check-when-importing

Mode

Diag Advanced Preference Conversion

Description

Disable checking when importing settings.

Example

no check-when-importing

Syntax

diag advanced anti-spam

Mode

Config

Description

Configure advanced diag Anti-Spam.

Example

diag advanced anti-spam

Syntax

syn-flood-protection

Mode

Diag Advanced Anti-Spam

Description

Enable SYN flood protection for Anti-Spam-related connections.

Example

syn-flood-protection

Syntax

no syn-flood-protection

Mode

Diag Advanced Anti-Spam

Description

Disable SYN flood protection for Anti-Spam-related connections.

Example

no syn-flood-protection

Syntax

check-grid-ip-only

Mode

Diag Advanced Anti-Spam

Description

Use GRID IP reputation check only.

Example

check-grid-ip-only

Syntax

no check-grid-ip-only

Mode

Diag Advanced Anti-Spam

Description

Disable to use GRID IP reputation check only.

Example

no check-grid-ip-only

Syntax

outbound-smtp-grid-ip

Mode

Diag Advanced Anti-Spam

Description

Enable GRID IP reputation checking for outbound SMTP connections.

Example

outbound-smtp-grid-ip

Syntax

no outbound-smtp-grid-ip

Mode

Diag Advanced Anti-Spam

Description

Disable GRID IP reputation checking for outbound SMTP connections.

Example

no outbound-smtp-grid-ip

Syntax

disabling-custom-email

Mode

Diag Advanced Anti-Spam

Description

Enable disabling of custom user e-mail policies when Anti-spam is enabled.

Example

disabling-custom-email

Syntax

no disabling-custom-email

Mode

Diag Advanced Anti-Spam

Description

Disable disabling of custom user e-mail policies when Anti-Spam is enabled.

Example

no disabling-custom-email

Syntax

limited-admin-configuration

Mode

Diag Advanced Anti-Spam

Description

Enable allowing limited admin users to configure Anti-Spam service.

Example

limited-admin-configuration

Syntax

no limited-admin-configuration

Mode

Diag Advanced Anti-Spam

Description

Disable allowing limited admin users to configure Anti-Spam service.

Example

no limited-admin-configuration

Syntax

shlo-check

Mode

Diag Advanced Anti-Spam

Description

Enable SHLO check when Junk Store is unavailable (while E-mail Security is operational).

Example

shlo-check

Syntax

no shlo-check

Mode

Diag Advanced Anti-Spam

Description

Disable SHLO check when Junk Store is unavailable (while E-mail Security is operational).

Example

no shlo-check

Syntax

auto-generated-cass-acl

Mode

Diag Advanced Anti-Spam

Description

Enable editing of auto-generated CASS access rules.

Example

auto-generated-cass-acl

Syntax

no auto-generated-cass-acl

Mode

Diag Advanced Anti-Spam

Description

Disable editing of auto-generated CASS access rules.

Example

no auto-generated-cass-acl

Syntax

clear statistics

Mode

Diag Advanced Anti-Spam

Description

Clear statistics.

Example

clear statistics

Syntax

reset grid-name-cache

Mode

Diag Advanced Anti-Spam

Description

Reset GRID name cache.

Example

reset grid-name-cache

Syntax

no policies-and-objects

Mode

Diag Advanced Anti-Spam

Description

Deletes policies and objects.

Example

no policies-and-objects

Syntax

cass_cloud_service_addr { auto-resolve | static-ip <IPV4_HOST> }

Mode

Diag Advanced Anti-Spam

Description

Set CASS cloud service address.

Options

 
auto-resolveResolve automatically.
 
static-ipUse this static IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

cass_cloud_service_addr static-ip 204.212.170.13

Syntax

diag advanced email-detection

Mode

Config

Description

Enable e-mail system detection.

Example

diag advanced email-detection

Syntax

diag no advanced email-detection

Mode

Config

Description

Disable e-mail system detection.

Example

diag no advanced email-detection

Syntax

diag advanced remote-assistance

Mode

Config

Description

Enable remote assistance.

Example

diag advanced remote-assistance

Syntax

diag no advanced remote-assistance

Mode

Config

Description

Disable remote assistance.

Example

diag no advanced remote-assistance

Syntax

diag advanced sslvpn

Mode

Config

Description

Configure advanced diag SSL-VPN settings.

Example

diag advanced sslvpn

Syntax

netextender-version <WORD>

Mode

Diag Advanced SSL-VPN Settings

Description

Set NetExtender(for Windows) version.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

netextender-version TBD

Syntax

no netextender-version

Mode

Diag Advanced SSL-VPN Settings

Description

Clear NetExtender(for Windows) version.

Example

no netextender-version

Syntax

diag advanced backend-server

Mode

Config

Description

Configure advanced diag backend servers settings.

Example

diag advanced backend-server

Syntax

enable

Mode

Diag Advanced Backend Server Settings

Description

Enable communication with SonicWALL backend servers.

Example

enable

Syntax

no enable

Mode

Diag Advanced Backend Server Settings

Description

Disable communication with SonicWALL backend servers.

Example

no enable

Syntax

force-through { any | interface <ASSIGNED_INTERFACE> }

Mode

Diag Advanced Backend Server Settings

Description

Set interface to force communication with SonicWALL backend servers going through.

Options

 
anyAny interface.
 
interfaceSet interface.
<ASSIGNED_INTERFACE> Interface name.
Example: X0

Example

force-through interface X1

Syntax

diag advanced wan-acceleration

Mode

Config

Description

Configure advanced diag WAN acceleration.

Example

diag advanced wan-acceleration

Syntax

remote-checking

Mode

Diag Advanced Wan Acceleration

Description

Enable checking of connection responses by remote WAN acceleration device.

Example

remote-dev-connection-checking

Syntax

no remote-checking

Mode

Diag Advanced Wan Acceleration

Description

Disable checking of connection responses by remote WAN acceleration device.

Example

no remote-dev-connection-checking

Syntax

bypass-tcp-acceleration { failed-proxied-connection <UINT32> | short-lived-proxied-connection <UINT32> }

Mode

Diag Advanced Wan Acceleration

Description

Enable temporarily bypass TCP acceleration.

Options

 
failed-proxied-connectionSet temporarily bypass TCP acceleration for failed proxied connections (minutes).
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123
 
short-lived-proxied-connectionSet temporarily bypass TCP acceleration for short-lived proxied connections (minutes).
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

bypass-tcp-acceleration failed-proxied-connection 15

Syntax

no bypass-tcp-acceleration { failed-proxied-connection | short-lived-proxied-connection }

Mode

Diag Advanced Wan Acceleration

Description

Disable temporarily bypass TCP acceleration.

Options

 
failed-proxied-connectionSet temporarily bypass TCP acceleration for failed proxied connections (minutes).
 
short-lived-proxied-connectionSet temporarily bypass TCP acceleration for short-lived proxied connections (minutes).

Example

no bypass-tcp-acceleration failed-proxied-connection

Syntax

skip-tcp-acceleration

Mode

Diag Advanced Wan Acceleration

Description

Skip TCP acceleration for stateful control channels (but accelerate data channels).

Example

skip-tcp-acceleration

Syntax

no skip-tcp-acceleration

Mode

Diag Advanced Wan Acceleration

Description

Disable skip TCP acceleration for stateful control channels (but accelerate data channels).

Example

no skip-tcp-acceleration

Syntax

clear debug-status

Mode

Diag Advanced Wan Acceleration

Description

Clear debug status.

Example

clear debug-status

Syntax

clear tcp-acceleration-database

Mode

Diag Advanced Wan Acceleration

Description

Clear TCP acceleration database.

Example

clear tcp-acceleration-database

Syntax

diag advanced geoip-location-service

Mode

Config

Description

Configure advanced diag GeoIP/Location service.

Example

diag advanced geoip-location-service

Syntax

remote-geoip-server { always | failed-resolution } [ default | ip <IPV4_HOST> ]

Mode

Diag Advanced GeoIP/Location Service

Description

Set location of remote GeoIP server address.

Options

 
alwaysAlways use this IP for geoipdata.global.sonicwall.com.
 
failed-resolutionUse if geoipdata.global.sonicwall.com does not resolve.
 
defaultSet the IP address to the default setting.
 
ipSpecify the IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

remote-geoip-server failed-resolution 204.212.170.189

Syntax

clear location-cache

Mode

Diag Advanced GeoIP/Location Service

Description

Clear location cache.

Example

clear location-cache

Syntax

use-control-plane

Mode

Diag Advanced GeoIP/Location Service

Description

Use control plane for GeoIP database lookups.

Example

use-control-plane

Syntax

no use-control-plane

Mode

Diag Advanced GeoIP/Location Service

Description

Disable to use control plane for GeoIP database lookups.

Example

no use-control-plane

Syntax

bypass-geoip-blocking

Mode

Diag Advanced GeoIP/Location Service

Description

Bypass GeoIp blocking for stack initiated connections.

Example

bypass-geoip-blocking

Syntax

no bypass-geoip-blocking

Mode

Diag Advanced GeoIP/Location Service

Description

Disable to bypass GeoIp blocking for stack initiated connections.

Example

no bypass-geoip-blocking

Syntax

bypass-botnet-blocking

Mode

Diag Advanced GeoIP/Location Service

Description

Bypass BOTNET blocking for stack initiated connections.

Example

bypass-botnet-blocking

Syntax

no bypass-botnet-blocking

Mode

Diag Advanced GeoIP/Location Service

Description

Disable to bypass BOTNET blocking for stack initiated connections.

Example

no bypass-botnet-blocking

Syntax

geoip-botnet-map-file-upload

Mode

Diag Advanced GeoIP/Location Service

Description

Allow Geo-IP/Botnet filter map database file upload.

Example

geoip-botnet-map-file-upload

Syntax

no geoip-botnet-map-file-upload

Mode

Diag Advanced GeoIP/Location Service

Description

Disable to upload Geo-IP/Botnet filter map database file.

Example

no geoip-botnet-map-file-upload

Syntax

diag advanced flow-reporting

Mode

Config

Description

Configure advanced diag Flow Reporting.

Example

diag advanced flow-reporting

Syntax

clear location-map

Mode

Diag Advanced Flow Reporting

Description

Clear location map database.

Example

clear location-map

Syntax

flow-reporting-and-visualization

Mode

Diag Advanced Flow Reporting

Description

Enable flow reporting and visualization.

Example

flow-reporting-and-visualization

Syntax

no flow-reporting-and-visualization

Mode

Diag Advanced Flow Reporting

Description

Disable flow reporting and visualization.

Example

no flow-reporting-and-visualization

Syntax

report-to-external

Mode

Diag Advanced Flow Reporting

Description

Report to external flow collector.

Example

report-to-external

Syntax

no report-to-external

Mode

Diag Advanced Flow Reporting

Description

Disable to report to external flow collector.

Example

no report-to-external

Syntax

appflow-monitor-browser-frame-launch

Mode

Diag Advanced Flow Reporting

Description

Enable launching of AppFlow monitor in a stand-alone browser frame.

Example

appflow-monitor-browser-frame-launch

Syntax

no appflow-monitor-browser-frame-launch

Mode

Diag Advanced Flow Reporting

Description

Disable launching of AppFlow monitor in a stand-alone browser frame.

Example

no appflow-monitor-browser-frame-launch

Syntax

non-admin-visualization

Mode

Diag Advanced Flow Reporting

Description

Enable visualization UI for Non-Admin/Config users.

Example

non-admin-visualization

Syntax

no non-admin-visualization

Mode

Diag Advanced Flow Reporting

Description

Disable visualization UI for Non-Admin/Config users.

Example

no non-admin-visualization

Syntax

database-busy-timeout <UINT32>

Mode

Diag Advanced Flow Reporting

Description

Set database busy timeout in msec.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

database-busy-timeout 3000

Syntax

no database-busy-timeout

Mode

Diag Advanced Flow Reporting

Description

Clear database busy timeout in msec.

Example

no database-busy-timeout

Syntax

hide-appflow-server

Mode

Diag Advanced Flow Reporting

Description

Hide AppFlow server feature.

Example

hide-appflow-server

Syntax

no hide-appflow-server

Mode

Diag Advanced Flow Reporting

Description

Disable to hide AppFlow server feature.

Example

no hide-appflow-server

Syntax

hide-gmsflow-server

Mode

Diag Advanced Flow Reporting

Description

Hide GmsFlow server feature.

Example

hide-gmsflow-server

Syntax

no hide-gmsflow-server

Mode

Diag Advanced Flow Reporting

Description

Disable to hide GmsFlow server feature.

Example

no hide-appflow-server

Syntax

send-unified-data

Mode

Diag Advanced Flow Reporting

Description

Send unified AppFlow and RTM data to GMSFlow server.

Example

send-unified-data

Syntax

no send-unified-data

Mode

Diag Advanced Flow Reporting

Description

Disable to send unified AppFlow and RTM data to GMSFlow server.

Example

no send-unified-data

Syntax

gmsflow-server-per-node node <UINT8> ip-addr <IPV4_HOST>

Mode

Diag Advanced Flow Reporting

Description

Enable per node GMSFlow server.

Options

nodePer node GMSFlow server.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
ip-addrGMSFlow server address for each node.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

gmsflow-server-per-node

gmsflow-server-per-node node 4 ip-addr 10.10.10.10

Syntax

no gmsflow-server-per-node [ node <UINT8> ip-addr ]

Mode

Diag Advanced Flow Reporting

Description

Clear per node GMSFlow server ip address.

Options

nodePer node GMSFlow server.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
ip-addrGMSFlow server address for each node.

Example

no gmsflow-server-per-node node 4 ip-addr

Syntax

report-server-addr { ip <IPV4_HOST> | sonicwall }

Mode

Diag Advanced Flow Reporting

Description

Set appFlow reports server address.

Options

 
ipUse this IP address for App reports upload.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
 
sonicwallConnect to appreports.global.sonicwall.com.

Example

report-server-addr ip 173.240.209.223

Syntax

https-upload

Mode

Diag Advanced Flow Reporting

Description

Use secure HTTP for AppFlow report upload.

Example

https-upload

Syntax

no https-upload

Mode

Diag Advanced Flow Reporting

Description

Disable to use secure HTTP for AppFlow report upload.

Example

no https-upload

Syntax

clear database-tables

Mode

Diag Advanced Flow Reporting

Description

Clear appflow database tables.

Example

clear database-tables

Syntax

diag advanced log-reschedule [ interval <UINT16> ]

Mode

Config

Description

Enable main log process reschedule and set interval.

Options

intervalMain log process reschedule interval.
<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

diag advanced log-reschedule-interval 100

Syntax

diag no advanced log-reschedule

Mode

Config

Description

Disable main log process reschedule.

Example

diag no advanced log-reschedule

Syntax

diag advanced control-plane

Mode

Config

Description

Configure control plane (CP) Master/Slaves monitoring and diagnostics.

Example

diag advanced control-plane

Syntax

diag advanced ipv6-ready-enforce

Mode

Config

Description

Enable enforcement of IPv6 ready logo requirement.

Example

diag advanced ipv6-ready-enforce

Syntax

diag no advanced ipv6-ready-enforce

Mode

Config

Description

Disable enforcement of IPv6 ready logo requirement.

Example

diag no advanced ipv6-ready-enforce

Syntax

diag advanced icmp drop-unreachable-packet

Mode

Config

Description

Enable enforcement of dropping unreachable ICMP packet.

Example

diag advanced icmp drop-unreachable-packet

Syntax

diag no advanced icmp drop-unreachable-packet

Mode

Config

Description

Disable enforcement of dropping unreachable ICMP packet.

Example

diag no advanced icmp drop-unreachable-packet

Syntax

diag advanced icmp drop-exceeded-packet

Mode

Config

Description

Enable enforcement of dropping time exceed ICMP packet.

Example

diag advanced icmp drop-exceeded-packet

Syntax

diag no advanced icmp drop-exceeded-packet

Mode

Config

Description

Disable enforcement of dropping time exceed ICMP packet.

Example

diag no advanced icmp drop-exceeded-packet

Syntax

diag advanced debug suppress-task-lock

Mode

Config

Description

Suppress potential task lock warning message.

Example

diag advanced debug suppress-task-lock

Syntax

diag no advanced debug suppress-task-lock

Mode

Config

Description

Disable to suppress potential task lock message.

Example

diag no advanced debug suppress-task-lock

Syntax

diag advanced debug suppress-task-dead-warning

Mode

Config

Description

Suppress potential task dead loop warning message.

Example

diag advanced debug suppress-task-dead-warning

Syntax

diag no advanced debug suppress-task-dead-warning

Mode

Config

Description

Disable to suppress potential task dead loop warning message.

Example

diag no advanced debug suppress-task-dead-warning

Syntax

diag advanced debug suppress-performance-testing-warning

Mode

Config

Description

Suppress performance testing warning message.

Example

diag advanced debug suppress-performance-testing-warning

Syntax

diag no advanced debug suppress-performance-testing-warning

Mode

Config

Description

Disable to suppress performance testing warning message.

Example

diag no advanced debug suppress-performance-testing-warning

Syntax

packet-monitor

Mode

Config

Description

Configure packet monitor settings.

Example

packet-monitor

Syntax

start capture

Mode

Packet Monitor

Top Level

Description

Start packet capture.

Example

start capture

Syntax

stop capture

Mode

Packet Monitor

Top Level

Description

Stop packet capture.

Example

stop capture

Syntax

start mirror

Mode

Packet Monitor

Top Level

Description

Start mirror.

Example

start mirror

Syntax

stop mirror

Mode

Packet Monitor

Top Level

Description

Stop mirror.

Example

stop mirror

Syntax

log-to-ftp

Mode

Packet Monitor

Description

Log to FTP server.

Example

log-to-ftp

Syntax

export capture { app-data | html | libpcap | text } { ftp <FTP_URL> | scp <SCP_URL> }

Mode

Top Level

Packet Monitor

Description

Export capture from the device using ftp.

Options

 
app-dataApp data.
 
htmlHTML.
 
libpcapLibPcap.
 
textText.
 
ftpExport using the FTP protocol.
<FTP_URL> FTP URL in the form: ftp://username:password@hostname/\n Escape character: ':' -> '\\\\:', '@' -> '\\\\@', '/' -> '\\\\/', '\\' -> '\\\\\\\\'.
Example: ftp://username:password@hostname/\nftp://username@hostname/\nftp://hostname/
 
scpExport using the SCP protocol.
<SCP_URL> SCP URL in the form: scp://username@host/\n Escape character: ':' -> '\\\\:', '@' -> '\\\\@', '/' -> '\\\\/', '\\' -> '\\\\\\\\'.
Example: scp://username@host/\nscp://host/

Example

export capture libpcap ftp ftp://user:password@ftp.myserver.local/capture.cap

export capture libpcap scp scp://user@server/capture.cap

Syntax

monitor all

Mode

Packet Monitor

Top Level

Description

Monitor all packets.

Example

monitor all

Syntax

monitor default

Mode

Packet Monitor

Top Level

Description

Set packet monitor settings to default.

Example

monitor default

Syntax

clear capture

Mode

Packet Monitor

Top Level

Description

Clear the packet capture buffer.

Example

clear capture

Syntax

bytes-to-capture <UINT16>

Mode

Packet Monitor

Description

Specify number of bytes to capture (per packet).

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

bytes-to-capture 1520

Syntax

wrap-buffer

Mode

Packet Monitor

Description

Enable wrapping of capture buffer once full.

Example

wrap-buffer

Syntax

no wrap-buffer

Mode

Packet Monitor

Description

Disable wrapping of capture buffer once full.

Example

no wrap-buffer

Syntax

exclude encrypted-gms

Mode

Packet Monitor

Description

Enable exclusion of enrypted GMS traffic.

Example

exclude encrypted-gms

Syntax

no exclude encrypted-gms

Mode

Packet Monitor

Description

Disable exclusion of enrypted GMS traffic.

Example

no exclude encrypted-gms

Syntax

exclude management { http | snmp | ssh }

Mode

Packet Monitor

Description

Enable exclusion of specified management.

Options

 
httpHTTP/HTTPS.
 
snmpSNMP.
 
sshSSH.

Example

exclude management http ssh

Syntax

no exclude management { http | snmp | ssh }

Mode

Packet Monitor

Description

Disable exclusion of specified management.

Options

 
httpHTTP/HTTPS.
 
snmpSNMP.
 
sshSSH.

Example

no exclude management http ssh

Syntax

exclude syslog { gms-server | syslog-servers }

Mode

Packet Monitor

Description

Enable exclusion of syslog traffic to specified server(s).

Options

 
gms-serverGMS server.
 
syslog-serversSylog servers.

Example

exclude syslog syslog-servers

Syntax

no exclude syslog { gms-server | syslog-servers }

Mode

Packet Monitor

Description

Disable exclusion of syslog traffic to specified server(s).

Options

 
gms-serverGMS server.
 
syslog-serversSylog servers.

Example

no exclude syslog syslog-servers

Syntax

exclude internal-traffic { ha | sonicpoint }

Mode

Packet Monitor

Description

Enable exclusion of internal traffic.

Options

 
haHigh availability.
 
sonicpointSonicPoint.

Example

exclude internal-traffic ha

Syntax

no exclude internal-traffic { ha | sonicpoint }

Mode

Packet Monitor

Description

Disable exclusion of internal traffic.

Options

 
haHigh availability.
 
sonicpointSonicPoint.

Example

no exclude internal-traffic internal-servers

Syntax

monitor-filter based-on-firewall-rule

Mode

Packet Monitor

Description

Enable packet monitor filter based on the firewall access/app rules.

Example

monitor-filter based-on-firewall-rule

Syntax

no monitor-filter based-on-firewall-rule

Mode

Packet Monitor

Description

Disable packet monitor filter based on the firewall access/app rules.

Example

no monitor-filter based-on-firewall-rule

Syntax

monitor-filter interfaces <WORD>

Mode

Packet Monitor

Description

Specify name of interface(s) on which packet capture needs to be performed (maximum 10).

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

monitor-filter interfaces "X0,X1,X2:V100"

monitor-filter interfaces "!X0,!X1"

Syntax

no monitor-filter interfaces

Mode

Packet Monitor

Description

Clear name of interface(s) on which packet capture needs to be performed.

Example

no monitor-filter interfaces

Syntax

monitor-filter ether-types <WORD>

Mode

Packet Monitor

Description

Specify name of ether type(s) on which packet capture needs to be performed. Currently ARP(arp), IP(ip), PPPoE-SES, PPPoE-DIS or you can specify the value directly in hex format like 0x800.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

monitor-filter ether-types "ARP,ip,0x800"

monitor-filter ether-types "!ARP,!0x800"

Syntax

no monitor-filter ether-types

Mode

Packet Monitor

Description

Clear name of ether type(s) on which packet capture needs to be performed.

Example

no monitor-filter ether-types

Syntax

monitor-filter ip-types <WORD>

Mode

Packet Monitor

Description

Specify name of ip type(s) on which packet capture needs to be performed. Currently TCP, UDP, ICMP, GRE, IGMP, AH, ESP or you can specify the value directly in hex format like 0x6.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

monitor-filter ip-types "TCP,UDP,0x6"

monitor-filter ip-types "!TCP,!0x6"

Syntax

no monitor-filter ip-types

Mode

Packet Monitor

Description

Clear name of ip type(s) on which packet capture needs to be performed.

Example

no monitor-filter ip-types

Syntax

monitor-filter source-ips <WORD>

Mode

Packet Monitor

Description

Specify source IP addresses on which packet capture needs to be performed.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

monitor-filter source-ips "10.10.10.1,10.10.10.3,10.10.10.7"

monitor-filter source-ips "!10.10.10.1,!10.10.10.3"

Syntax

no monitor-filter source-ips

Mode

Packet Monitor

Description

Clear source IP addresses on which packet capture needs to be performed.

Example

no monitor-filter source-ips

Syntax

monitor-filter source-ports <WORD>

Mode

Packet Monitor

Description

Specify source TCP/UDP ports on which packet capture needs to be performed.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

monitor-filter source-ports "20,75,80"

Syntax

no monitor-filter source-ports

Mode

Packet Monitor

Description

Clear source TCP/UDP ports on which packet capture needs to be performed.

Example

no monitor-filter source-ports

Syntax

monitor-filter destination-ips <WORD>

Mode

Packet Monitor

Description

Specify destination IP addresses on which packet capture needs to be performed.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

monitor-filter destination-ips "10.10.10.1,10.10.10.7"

monitor-filter destination-ips "!10.10.10.1,!10.10.10.3"

Syntax

no monitor-filter destination-ips

Mode

Packet Monitor

Description

Clear destination IP addresses on which packet capture needs to be performed.

Example

no monitor-filter destination-ips

Syntax

monitor-filter destination-ports <WORD>

Mode

Packet Monitor

Description

Specify destination TCP/UDP ports on which packet capture needs to be performed.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

monitor-filter destination-ports "20,75,80"

monitor-filter destination-ports "!20,!80"

Syntax

no monitor-filter destination-ports

Mode

Packet Monitor

Description

Clear destination TCP/UDP ports on which packet capture needs to be performed.

Example

no monitor-filter destination-ports

Syntax

monitor-filter bidirectional

Mode

Packet Monitor

Description

Enable bidirectional address and port matching.

Example

monitor-filter bidirectional

Syntax

no monitor-filter bidirectional

Mode

Packet Monitor

Description

Disable bidirectional address and port matching.

Example

no monitor-filter bidirectional

Syntax

monitor-filter status { consumed | dropped | forwarded }

Mode

Packet Monitor

Description

Enable monitor filtering for the specified status.

Options

 
consumedConsumed.
 
droppedDropped.
 
forwardedForwarded.

Example

monitor-filter status forwarded

Syntax

no monitor-filter status { consumed | dropped | forwarded }

Mode

Packet Monitor

Description

Disable monitor filtering for the specified status.

Options

 
consumedConsumed.
 
droppedDropped.
 
forwardedForwarded.

Example

no monitor-filter status forwarded

Syntax

display-filter interfaces <WORD>

Mode

Packet Monitor

Description

Specify name of interface(s) on which packet filter needs to be performed (maximum 10).

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

display-filter interfaces "X0,X1,X2:V100"

display-filter interfaces "!X0,!X1"

Syntax

no display-filter interfaces

Mode

Packet Monitor

Description

Clear name of interface(s) on which packet filter needs to be performed.

Example

no display-filter interfaces

Syntax

display-filter ether-types <WORD>

Mode

Packet Monitor

Description

Specify name of ether type(s) on which packet filter needs to be performed. Currently ARP(arp), IP(ip), PPPoE-SES, PPPoE-DIS or you can specify the value directly in hex format like 0x800.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

display-filter ether-types "ARP,ip,0x800"

display-filter ether-types "!ARP,!0x800"

Syntax

no display-filter ether-types

Mode

Packet Monitor

Description

Clear name of ether type(s) on which packet filter needs to be performed.

Example

no display-filter ether-types

Syntax

display-filter ip-types <WORD>

Mode

Packet Monitor

Description

Specify name of ip type(s) on which packet filter needs to be performed. Currently TCP, UDP, ICMP, GRE, IGMP, AH, ESP or you can specify the value directly in hex format like 0x6.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

display-filter ip-types "TCP,UDP,0x6"

display-filter ip-types "!TCP,!0x6"

Syntax

no display-filter ip-types

Mode

Packet Monitor

Description

Clear name of ip type(s) on which packet filter needs to be performed.

Example

no display-filter ip-types

Syntax

display-filter source-ips <WORD>

Mode

Packet Monitor

Description

Specify source IP addresses on which packet filter needs to be performed.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

display-filter source-ips "10.10.10.1,10.10.10.7"

display-filter source-ips "!10.10.10.1,!10.10.10.3"

Syntax

no display-filter source-ips

Mode

Packet Monitor

Description

Clear source IP addresses on which packet filter needs to be performed.

Example

no display-filter source-ips

Syntax

display-filter source-ports <WORD>

Mode

Packet Monitor

Description

Specify source TCP/UDP ports on which packet filter needs to be performed.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

display-filter source-ports "20,75,80"

display-filter source-ports "!20,!80"

Syntax

no display-filter source-ports

Mode

Packet Monitor

Description

Clear source TCP/UDP ports on which packet filter needs to be performed.

Example

no display-filter source-ports

Syntax

display-filter destination-ips <WORD>

Mode

Packet Monitor

Description

Specify destination IP addresses on which packet filter needs to be performed.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

display-filter destination-ips "10.10.10.1,10.10.10.7"

display-filter destination-ips "!10.10.10.1,!10.10.10.3"

Syntax

no display-filter destination-ips

Mode

Packet Monitor

Description

Clear destination IP addresses on which packet filter needs to be performed.

Example

no display-filter destination-ips

Syntax

display-filter destination-ports <WORD>

Mode

Packet Monitor

Description

Specify destination TCP/UDP ports on which packet filter needs to be performed.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

display-filter destination-ports "20,75,80"

display-filter destination-ports "!20,!80"

Syntax

no display-filter destination-ports

Mode

Packet Monitor

Description

Clear destination TCP/UDP ports on which packet filter needs to be performed.

Example

no display-filter destination-ports

Syntax

display-filter bidirectional

Mode

Packet Monitor

Description

Enable bidirectional address and port matching.

Example

display-filter bidirectional

Syntax

no display-filter bidirectional

Mode

Packet Monitor

Description

Disable bidirectional address and port matching.

Example

no display-filter bidirectional

Syntax

display-filter status { consumed | dropped | forwarded | generated }

Mode

Packet Monitor

Description

Enable display filtering for the specified status.

Options

 
consumedConsumed.
 
droppedDropped.
 
forwardedForwarded.
 
generatedGenerated.

Example

display-filter status forwarded generated

Syntax

no display-filter status { consumed | dropped | forwarded | generated }

Mode

Packet Monitor

Description

Disable display filtering for the specified status.

Options

 
consumedConsumed.
 
droppedDropped.
 
forwardedForwarded.
 
generatedGenerated.

Example

no display-filter status forwarded generated

Syntax

ftp server <IPV4_HOST>

Mode

Packet Monitor

Description

Specify the FTP server's IP address to send the packet capture to.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

ftp server 192.168.168.75

Syntax

no ftp server

Mode

Packet Monitor

Description

Clear the FTP server's IP address.

Example

no ftp server

Syntax

ftp login <WORD>

Mode

Packet Monitor

Description

Specify the FTP server's login name to send the packet capture.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

ftp login admin@testing.local

Syntax

no ftp login

Mode

Packet Monitor

Description

Clear the FTP server's login name.

Example

no ftp login

Syntax

ftp password <WORD>

Mode

Packet Monitor

Description

Specify the FTP server's login password to send the packet capture.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

ftp password myftppassword

Syntax

no ftp password

Mode

Packet Monitor

Description

Clear the FTP server's login password.

Example

no ftp password

Syntax

ftp directory <WORD>

Mode

Packet Monitor

Description

Specify the FTP server's directory to place the packet capture in.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

ftp directory captures/firewall/

Syntax

no ftp directory

Mode

Packet Monitor

Description

Clear the FTP server's directory.

Example

no ftp directory

Syntax

ftp automatic

Mode

Packet Monitor

Description

Enable automatically log captures to the FTP server.

Example

ftp automatic

Syntax

no ftp automatic

Mode

Packet Monitor

Description

Disable automatically log captures to the FTP server.

Example

no ftp automatic

Syntax

ftp html

Mode

Packet Monitor

Description

Enable logging of HTML file along with .cap file.

Example

ftp html

Syntax

no ftp html

Mode

Packet Monitor

Description

Disable logging of HTML file along with .cap file.

Example

no ftp html

Syntax

monitor-filter firewall-generated

Mode

Packet Monitor

Description

Enable monitoring of firewall generated packets. (This will bypass interface filter).

Example

monitor-filter firewall-generated

Syntax

no monitor-filter firewall-generated

Mode

Packet Monitor

Description

Disable monitoring of firewall generated packets. (This will bypass interface filter).

Example

no monitor-filter firewall-generated

Syntax

monitor-filter intermediate [ fragmented | iphelper | ipsec | ldap-over-tls | multicast | reassembled | remote-mirrored | ssl | sso-agent ]

Mode

Packet Monitor

Description

Enable monitoring of intermediate packet.

Options

 
fragmentedEnable monitoring of intermediate fragmented traffic.
 
iphelperEnable monitoring of intermediate IP helper traffic.
 
ipsecEnable monitoring of intermediate IPSEC traffic.
 
ldap-over-tlsEnable monitoring of intermediate decrypted LDAP over TLS traffic.
 
multicastEnable monitoring of intermediate multicast traffic.
 
reassembledEnable monitoring of intermediate reassembled traffic.
 
remote-mirroredEnable monitoring of intermediate remote mirrored traffic.
 
sslEnable monitoring of intermediate SSL decrypted traffic.
 
sso-agentEnable monitoring of intermediate decrypted Single Sign On agent messages.

Example

monitor-filter intermediate ipsec ssl

Syntax

no monitor-filter intermediate [ fragmented | iphelper | ipsec | ldap-over-tls | multicast | reassembled | remote-mirrored | ssl | sso-agent ]

Mode

Packet Monitor

Description

Disable monitoring of intermediate packet.

Options

 
fragmentedDisable monitoring of intermediate fragmented traffic.
 
iphelperDisable monitoring of intermediate IP helper traffic.
 
ipsecDisable monitoring of intermediate IPSEC traffic.
 
ldap-over-tlsDisable monitoring of intermediate decrypted LDAP over TLS traffic.
 
multicastDisable monitoring of intermediate multicast traffic.
 
reassembledDisable monitoring of intermediate reassembled traffic.
 
remote-mirroredDisable monitoring of intermediate remote mirrored traffic.
 
sslDisable monitoring of intermediate SSL decrypted traffic.
 
sso-agentDisable monitoring of intermediate decrypted Single Sign On agent messages.

Example

no monitor-filter intermediate ipsec ssl

Syntax

mirror max-rate <UINT32>

Mode

Packet Monitor

Description

Set maximum mirror rate (in kilobits per second).

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

mirror max-rate 100

Syntax

mirror only-ip-packets

Mode

Packet Monitor

Description

Enable mirror only IP packets.

Example

mirror only-ip-packets

Syntax

no mirror only-ip-packets

Mode

Packet Monitor

Description

Disable mirror only IP packets.

Example

no mirror only-ip-packets

Syntax

mirror interface <CONFIGURABLE_INTERFACE>

Mode

Packet Monitor

Description

Mirror filtered packets to interface (NSA platforms only).

Options

<CONFIGURABLE_INTERFACE> Interface name.
Example: X0

Example

mirror interface X3

Syntax

no mirror interface

Mode

Packet Monitor

Description

Disable mirror filtered packets to interface (NSA platforms only).

Example

no mirror interface

Syntax

mirror ip <IPV4_HOST>

Mode

Packet Monitor

Description

Mirror filtered packets to remote SonicWALL firewall (IP address).

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

mirror ip 10.11.10.10

Syntax

no mirror ip

Mode

Packet Monitor

Description

Disable mirror filtered packets to remote SonicWALL firewall (IP address).

Example

no mirror ip

Syntax

mirror receive-from-ip <IPV4_HOST>

Mode

Packet Monitor

Description

Receive mirrored packets from remote SonicWALL firewall (IP address).

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

mirror receive-from-ip 10.11.10.10

Syntax

no mirror receive-from-ip

Mode

Packet Monitor

Description

Disable receive mirrored packets from remote SonicWALL firewall (IP address).

Example

no mirror receive-from-ip

Syntax

mirror forward-interface <CONFIGURABLE_INTERFACE>

Mode

Packet Monitor

Description

Send received remote mirrored packets to interface (NSA platforms only).

Options

<CONFIGURABLE_INTERFACE> Interface name.
Example: X0

Example

mirror forward-interface X2

Syntax

no mirror forward-interface

Mode

Packet Monitor

Description

Mirror filtered packets to interface (NSA platforms only).

Example

no mirror forward-interface

Syntax

mirror to-capture-buffer

Mode

Packet Monitor

Description

Enable sending received remote mirrored packets to capture buffer.

Example

mirror to-capture-buffer

Syntax

no mirror to-capture-buffer

Mode

Packet Monitor

Description

Disable sending received remote mirrored packets to capture buffer.

Example

no mirror to-capture-buffer

Syntax

mirror encrypt-key <WORD>

Mode

Packet Monitor

Description

Encrypt remote mirrored packets via IPSec (preshared key-IKE).

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

mirror encrypt-key

Syntax

mirror decrypt-key <WORD>

Mode

Packet Monitor

Description

Decrypt remote mirrored packets via IPSec (preshared key-IKE).

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

mirror encrypt-key

Syntax

tsr vpn-keys

Mode

Config

Description

Enable display of VPN keys in tech support report.

Example

tsr vpn-keys

Syntax

no tsr vpn-keys

Mode

Config

Description

Disable display of VPN keys in tech support report.

Example

no tsr vpn-keys

Syntax

tsr arp-cache

Mode

Config

Description

Enable display of ARP cache in tech support report.

Example

tsr arp-cache

Syntax

no tsr arp-cache

Mode

Config

Description

Disable display of ARP cache in tech support report.

Example

no tsr arp-cache

Syntax

tsr dhcp-bindings

Mode

Config

Description

Enable display of DHCP bindings in tech support report.

Example

tsr dhcp-bindings

Syntax

no tsr dhcp-bindings

Mode

Config

Description

Disable display of DHCP bindings in tech support report.

Example

no tsr dhcp-bindings

Syntax

tsr ike-info

Mode

Config

Description

Enable display of IKE information in tech support report.

Example

tsr ike-info

Syntax

no tsr ike-info

Mode

Config

Description

Disable display of IKE information in tech support report.

Example

no tsr ike-info

Syntax

tsr sonicpointn diagnostics

Mode

Config

Description

Enable display of SonicPointN diagnostics in tech support report.

Example

tsr sonicpointn diagnostics

Syntax

no tsr sonicpointn diagnostics

Mode

Config

Description

Disable display of SonicPointN diagnostics in tech support report.

Example

no tsr sonicpointn diagnostics

Syntax

tsr users { current | detail | inactive }

Mode

Config

Description

Enable display of users in tech support report.

Options

 
currentCurrent users.
 
detailDetail of users.
 
inactiveInclude inactive of users.

Example

tsr users current

Syntax

no tsr users { current | detail | inactive }

Mode

Config

Description

Disable display of users in tech support report.

Options

 
currentCurrent users.
 
detailDetail of users.
 
inactiveInclude inactive of users.

Example

no tsr users current

Syntax

tsr ip-stack-info

Mode

Config

Description

Enable display of IP stack info in tech support report.

Example

tsr ip-stack-info

Syntax

no tsr ip-stack-info

Mode

Config

Description

Disable display of IP stack info in tech support report.

Example

no tsr ip-stack-info

Syntax

tsr debug-info

Mode

Config

Description

Enable display of debug info in tech support report.

Example

tsr debug-info

Syntax

no tsr debug-info

Mode

Config

Description

Disable display of debug info in tech support report.

Example

no tsr debug-info

Syntax

tsr ipv6 ndp

Mode

Config

Description

Enable display of IPv6 NDP in tech support report.

Example

tsr ipv6 ndp

Syntax

no tsr ipv6 ndp

Mode

Config

Description

Disable display of IPv6 NDP in tech support report.

Example

no tsr ipv6 ndp

Syntax

tsr ipv6 dhcp

Mode

Config

Description

Enable display of IPv6 DHCP in tech support report.

Example

tsr ipv6 dhcp

Syntax

no tsr ipv6 dhcp

Mode

Config

Description

Disable display of IPv6 DHCP in tech support report.

Example

no tsr ipv6 dhcp

Syntax

tsr geo-ip-cache

Mode

Config

Description

Enable display of geo-ip/botnet cache in report in tech support report.

Example

tsr geo-ip-cache

Syntax

no tsr geo-ip-cache

Mode

Config

Description

Disable display of geo-ip/botnet cache in report in tech support report.

Example

no tsr geo-ip-cache

Syntax

tsr secure-backup [ interval <UINT32> ]

Mode

Config

Description

Enable periodic secure backup of diagnostics report to MySonicwall.

Options

intervalSpecify backup interval.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

tsr secure-backup

Syntax

no tsr secure-backup

Mode

Config

Description

Disable periodic secure backup of diagnostics report to MySonicwall.

Example

no tsr secure-backup

Syntax

tsr send-raw-flow-data

Mode

Config

Description

Enable include raw flow table data entries when sending diagnostic report.

Example

tsr send-raw-flow-data

Syntax

no tsr send-raw-flow-data

Mode

Config

Description

Disable include raw flow table data entries when sending diagnostic report.

Example

no tsr send-raw-flow-data

Syntax

send tsr

Mode

Config

Description

Send secure backup of diagnostics report to MySonicwall.

Example

send tsr

Syntax

diag show limit-topx-connections

Mode

All Modes

Description

Show limit topx conncetions.

Example

diag show limit-topx-connections

Syntax

show limit-topx-connections

Mode

All Modes

Description

Show limit topx conncetions.

Example

show limit-topx-connections

Syntax

diag show limit-topx-connection [ ipv6 ] from <ACCESS_RULE_ZONE_NAME> to <ACCESS_RULE_ZONE_NAME> [ source { address { { any | fqdn <ADDR_FQDN> | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | mac <ADDR_MAC> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } } ] [ destination { address { { any | fqdn <ADDR_FQDN> | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | mac <ADDR_MAC> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } } ] [ service { { any | group <SVC_GROUP_NAME> | name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ]

Mode

Top Level

Config

Description

Show specified limit topx connection.

Options

ipv6IPv6
fromSource zone.
<ACCESS_RULE_ZONE_NAME> Zone object name.
Example: DMZ
toDestination zone.
<ACCESS_RULE_ZONE_NAME> Zone object name.
Example: DMZ
sourceSource.
addressSource address.
 
anyAny address.
 
fqdnAddress object full qualified domain name.
<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
macAddress object mac.
<ADDR_MAC> Address object MAC address in the form: HH:HH:HH:HH:HH:HH or HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
destinationDestination.
addressDestination address.
 
anyAny address.
 
fqdnAddress object full qualified domain name.
<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
macAddress object mac.
<ADDR_MAC> Address object MAC address in the form: HH:HH:HH:HH:HH:HH or HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
serviceService.
 
anyAny destination service.
 
groupService group name.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolService object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80

Example

diag show limit-topx-connection from LAN to WAN source Any destination Any service Any

Syntax

show limit-topx-connection [ ipv6 ] from <ACCESS_RULE_ZONE_NAME> to <ACCESS_RULE_ZONE_NAME> [ source { address { { any | fqdn <ADDR_FQDN> | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | mac <ADDR_MAC> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } } ] [ destination { address { { any | fqdn <ADDR_FQDN> | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | mac <ADDR_MAC> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } } ] [ service { { any | group <SVC_GROUP_NAME> | name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ]

Mode

Top Level

Config

Description

Show specified limit topx connection.

Options

ipv6IPv6
fromSource zone.
<ACCESS_RULE_ZONE_NAME> Zone object name.
Example: DMZ
toDestination zone.
<ACCESS_RULE_ZONE_NAME> Zone object name.
Example: DMZ
sourceSource.
addressSource address.
 
anyAny address.
 
fqdnAddress object full qualified domain name.
<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
macAddress object mac.
<ADDR_MAC> Address object MAC address in the form: HH:HH:HH:HH:HH:HH or HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
destinationDestination.
addressDestination address.
 
anyAny address.
 
fqdnAddress object full qualified domain name.
<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
macAddress object mac.
<ADDR_MAC> Address object MAC address in the form: HH:HH:HH:HH:HH:HH or HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
serviceService.
 
anyAny destination service.
 
groupService group name.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolService object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80

Example

show limit-topx-connection from LAN to WAN source Any destination Any service Any

Syntax

diag show advanced [ anti-spam | arp | backend | control-plane | dhcp | diagnostics | dial-up | dpi-ssl | encryption | firewall | flow-reporting | geoip-location-service | high-availability | management | network | pppoe | preference | security-service | ssl-vpn | user-authentication | voip | vpn | watchdog | wireless ] [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show advanced diag configuration.

Options

 
anti-spamAnti-Spam settings.
 
arpARP settings.
 
backendBackend Server settings.
 
control-planeControl Plane Master/Slaves Monitoring and Diagnostics settings.
 
dhcpDHCP settings.
 
diagnosticsDiagnostics settings.
 
dial-upDial-up settings.
 
dpi-sslDPI-SSL settings.
 
encryptionEncryption settings
 
firewallFirewall settings.
 
flow-reportingFlow Reporting settings.
 
geoip-location-serviceGeoIP/Location Service settings.
 
high-availabilityHigh Availability settings.
 
managementManagement settings.
 
networkNetwork settings.
 
pppoePPPoE settings.
 
preferencePreference Conversion settings.
 
security-serviceSecurity Services settings.
 
ssl-vpnSSL-VPN settings.
 
user-authenticationUser Authentication settings.
 
voipVoIP settings.
 
vpnVPN settings.
 
watchdogWatchdog settings.
 
wirelessWireless settings.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

diag show advanced arp

Syntax

show packet-monitor [ packet <UINT32> | packets | statistics ]

Mode

All Modes

Description

Show packet monitor configuration.

Options

 
packetShow one captured packet with detail.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123
 
packetsShow all captured packets in list.
 
statisticsShow packet monitor statistics.

Example

show packet-monitor

Syntax

show tech-support-report [ access-rules | active-utm | address-objects | anti-spam | anti-virus | arp-cache | cache-check | content-filtering | data-plane-task-jobs | db-trace | dhcp-client | dhcp-network-disc | dhcp-persistence | dhcp-relay | dhcp-server | dhcp-serverstat | diag | dpi-ssl { { client | server } } | dynamic-dns | ethernet | flight-data-recorder | gateway-anti-virus | guest-profile-objects | h323 | high-availability | hypervisor | interfaces | intrusion-detection-prevention | ip-helper | ip-reassembly | ipsec | l2tp-client | l2tp-server | ldap | license | management | mirror-state | msn | multicast | nat-policies | network | objects | options | pki | pppoe-client | pptp-client | pref-stats | product | qos | radius | route-policies | routes | rtsp | schedule-objects | service-objects | single-sign-on | sip | snmp | sonicpoint | ssl-control | stateful-stats | stateful-sync | status | svrrp | time | timers | update | user-objects | users | vx-net-stats | wan-load-balancing | wire-mode | wlan-zone | zone-objects ]

Mode

All Modes

Description

Display basic system status and information.

Options

 
access-rulesAccess rules technical support report.
 
active-utmActive-active UTM technical support report.
 
address-objectsAddress object table technical support report.
 
anti-spamAnti-spam technical support report.
 
anti-virusAV technical support report.
 
arp-cacheARP cache technical support report.
 
cache-checkCache check technical support report.
 
content-filteringCFL technical support report.
 
data-plane-task-jobsData plane task jobs technical support report.
 
db-traceDB trace dump technical support report.
 
dhcp-clientDHCP client technical support report.
 
dhcp-network-discDHCP network discovery technical support report.
 
dhcp-persistenceDHCP persistence technical support report.
 
dhcp-relayDHCP relay technical support report.
 
dhcp-serverDHCP server technical support report.
 
dhcp-serverstatDHCP server stats technical support report.
 
diagDiagnostics technical support report.
 
dpi-sslDPI SSL technical support report.
 
clientDPI SSL client technical support report.
 
serverDPI SSL server technical support report.
 
dynamic-dnsDynamic dns technical support report.
 
ethernetEthernet technical support report.
 
flight-data-recorderFlight data recorder technical support report.
 
gateway-anti-virusGlobal anti-virus technical support report.
 
guest-profile-objectsGuest profile objects technical support report.
 
h323H.323 technical support report.
 
high-availabilityHA technical support report.
 
hypervisorHypervisor technical support report.
 
interfacesInterfaces technical support report.
 
intrusion-detection-preventionIDP technical support report.
 
ip-helperIP helper technical support report.
 
ip-reassemblyIP fragment reassembly technical support report.
 
ipsecIPSec technical support report.
 
l2tp-clientL2tp client technical support report.
 
l2tp-serverL2tp server technical support report.
 
ldapLDAP technical support report.
 
licenseLicense technical support report.
 
managementManagement technical support report.
 
mirror-stateFlash prefs mirror state technical support report.
 
msnMSN technical support report.
 
multicastMcast igmp config technical support report.
 
nat-policiesNAT policies technical support report.
 
networkNetwork technical support report.
 
objectsNetwork objects technical support report.
 
optionsOptions of technical support report.
 
pkiPKI technical support report.
 
pppoe-clientPPPoE client technical support report.
 
pptp-clientPPTP client technical support report.
 
pref-statsFlash prefs load/save technical support report.
 
productProduct technical support report.
 
qosQOS technical support report.
 
radiusRadius technical support report.
 
route-policiesDetailed route policy table technical support report.
 
routesRouting table.
 
rtspRTSP technical support report.
 
schedule-objectsService object table technical support report.
 
service-objectsService object table technical support report.
 
single-sign-onSingle sign on technical support report.
 
sipSIP technical support report.
 
snmpSnmp technical support report.
 
sonicpointSonicpoint technical support report.
 
ssl-controlSSL control technical support report.
 
stateful-statsStateful stats technical support report.
 
stateful-syncStateful sync technical support report.
 
statusStatus technical support report.
 
svrrpSVRRP technical support report.
 
timeTime technical support report.
 
timersTimers technical support report.
 
updateUpdate technical support report.
 
user-objectsUser object table technical support report.
 
usersUsers technical support report.
 
vx-net-statsVxworks network status technical support report.
 
wan-load-balancingWLB technical support report.
 
wire-modeWire mode technical support report.
 
wlan-zoneWlan zone technical support report.
 
zone-objectsZone object table technical support report.

Example

show tech-support-report

Syntax

no address-object ipv4 <ADDR_HOST_NETWORK_RANGE_NAME>

Mode

Config

Description

Delete an address object.

Options

<ADDR_HOST_NETWORK_RANGE_NAME> Host/network/range address object name.
Example: Web Server

Example

no address-object ipv4 "Web Server"

Syntax

no address-object ipv6 <ADDR_HOST_NETWORK_RANGE_NAME>

Mode

Config

Description

Delete an address object.

Options

<ADDR_HOST_NETWORK_RANGE_NAME> Host/network/range address object name.
Example: Web Server

Example

no address-object ipv6 "Web Server"

Syntax

no address-object mac <ADDR_MAC_NAME>

Mode

Config

Description

Delete an address object.

Options

<ADDR_MAC_NAME> MAC address object name.
Example: Sales Network Access Point

Example

no address-object mac "Sales Network Access Point"

Syntax

no address-object fqdn <ADDR_FQDN_NAME>

Mode

Config

Description

Delete an address object.

Options

<ADDR_FQDN_NAME> FQDN address object name.
Example: www.example.com

Example

no address-object fqdn "*.example.com"

Syntax

no address-objects [ fqdn | host | mac | network | range ]

Mode

Config

Description

Delete all custom address objects.

Options

 
fqdnDelete all custom FQDN address objects.
 
hostDelete all custom host address objects.
 
macDelete all custom MAC address objects.
 
networkDelete all custom network address objects.
 
rangeDelete all custom range address objects.

Example

no address-objects

Syntax

address-object purge [ fqdn <ADDR_FQDN_NAME> | mac <ADDR_MAC_NAME> ]

Mode

Config

Description

Purge a specified MAC/FQDN address object or all address objects.

Options

 
fqdnPurge a FQDN address object.
<ADDR_FQDN_NAME> FQDN address object name.
Example: www.example.com
 
macPurge a MAC address object.
<ADDR_MAC_NAME> MAC address object name.
Example: Sales Network Access Point

Example

address-object purge mac "WAP MAC"

address-object purge fqdn "*.example.com"
address-object purge

Syntax

address-object ipv4 <ADDR_HOST_NETWORK_RANGE_NAME> [ host <ADDR_HOST> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> ] [ zone <ZONE_NAME> ]

Mode

Config

Description

Add/edit IPV4 address object.

Options

<ADDR_HOST_NETWORK_RANGE_NAME> Host/network/range address object name.
Example: Web Server
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
zoneAddress object zone.
<ZONE_NAME> Zone object name.
Example: DMZ

Example

address-object ipv4 "Mail Server" host 192.168.168.33 zone DMZ

address-object ipv4 "Web Servers" range 192.168.100.50 192.168.100.60
address-object ipv4 "HR Network" network 192.168.100.0 /24
address-object ipv4 "HR Network" network 192.168.100.0 255.255.255.0

Syntax

address-object ipv6 <ADDR_HOST_NETWORK_RANGE_NAME> [ host <ADDR_HOST> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> ] [ zone <ZONE_NAME> ]

Mode

Config

Description

Add/edit IPV6 address object.

Options

<ADDR_HOST_NETWORK_RANGE_NAME> Host/network/range address object name.
Example: Web Server
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
zoneAddress object zone.
<ZONE_NAME> Zone object name.
Example: DMZ

Example

address-object ipv6 "Mail Server" host fe80::217:c5ff:fec1 zone DMZ

address-object ipv6 "Web Servers" range fe80::217:c5ff:fec1 fe80::217:c5ff:ffff
address-object ipv6 "HR Network" network fe80::217:c5ff:fec1 /64

Syntax

address-object mac <ADDR_MAC_NAME> [ address <ADDR_MAC> ] [ zone <ZONE_NAME> ]

Mode

Config

Description

Add/edit MAC address object.

Options

<ADDR_MAC_NAME> MAC address object name.
Example: Sales Network Access Point
addressMAC address.
<ADDR_MAC> Address object MAC address in the form: HH:HH:HH:HH:HH:HH or HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD
zoneAddress object zone.
<ZONE_NAME> Zone object name.
Example: DMZ

Example

address-object mac "WAP MAC" address 00:09:5B:BD:93:DB

Syntax

address-object fqdn <ADDR_FQDN_NAME> [ domain <ADDR_FQDN> ] [ zone <ZONE_NAME> ]

Mode

Config

Description

Add/edit FQDN address object.

Options

<ADDR_FQDN_NAME> FQDN address object name.
Example: www.example.com
domainAddress object full qualified domain name.
<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
zoneAddress object zone.
<ZONE_NAME> Zone object name.
Example: DMZ

Example

address-object fqdn Whitelist domain *.google.com

Syntax

no address-group ipv4 <ADDR_GROUP_NAME>

Mode

Config

Description

Delete an IPV4 address group.

Options

<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group

Example

no address-group ipv4 "Corp Web Servers"

Syntax

no address-group ipv6 <ADDR_GROUP_NAME>

Mode

Config

Description

Delete an IPV4 address group.

Options

<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group

Example

no address-group ipv6 "Corp Web Servers"

Syntax

no address-groups [ ipv4 | ipv6 ]

Mode

Config

Description

Delete all custom address groups.

Options

 
ipv4Delete all IPV4 address groups.
 
ipv6Delete all IPV6 address groups.

Example

no address-groups

Syntax

address-group ipv4 <ADDR_GROUP_NAME>

Mode

Config

Description

Add/edit IPV4 address group.

Options

<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group

Example

address-group ipv4 "Corp Web Servers"

Syntax

address-group ipv6 <ADDR_GROUP_NAME>

Mode

Config

Description

Add/edit IPV6 address group.

Options

<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group

Example

address-group ipv6 "Corp Web Servers"

Syntax

name <WORD>

Mode

Address Object

Description

Set address object name.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

name "Corp E-mail Server "

Syntax

host <ADDR_HOST>

Mode

Address Object

Description

Set address object host.

Options

<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n

Example

host 10.10.10.10

Syntax

range <ADDR_BEGIN> <ADDR_END>

Mode

Address Object

Description

Set address object range.

Options

<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

range 10.10.10.1 10.10.10.10

Syntax

network <ADDR_NETWORK> <ADDR_MASK>

Mode

Address Object

Description

Set address object network.

Options

<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n

Example

network 10.10.10.0 255.255.255.0

Syntax

zone <ZONE_NAME>

Mode

Address Object

Description

Set address object zone.

Options

<ZONE_NAME> Zone object name.
Example: DMZ

Example

zone WAN

Syntax

name <WORD>

Mode

MAC Address Object

Description

Set address object name.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

name "Corp E-mail Server "

Syntax

address <ADDR_MAC>

Mode

MAC Address Object

Description

Set address object MAC.

Options

<ADDR_MAC> Address object MAC address in the form: HH:HH:HH:HH:HH:HH or HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD

Example

address 00:D0:68:09:4B:2A

Syntax

zone <ZONE_NAME>

Mode

MAC Address Object

Description

Set address object zone.

Options

<ZONE_NAME> Zone object name.
Example: DMZ

Example

zone WAN

Syntax

multi-homed

Mode

MAC Address Object

Description

Enable multi-homed host.

Example

multi-homed

Syntax

no multi-homed

Mode

MAC Address Object

Description

Disable multi-homed host.

Example

no multi-homed

Syntax

name <WORD>

Mode

FQDN Address Object

Description

Set address object name.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

name "Corp E-mail Server"

Syntax

domain <ADDR_FQDN>

Mode

FQDN Address Object

Description

Set address object fully qualified domain name (FQDN).

Options

<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com

Example

domain www.sonicwall.com

Syntax

zone <ZONE_NAME>

Mode

FQDN Address Object

Description

Set address object zone.

Options

<ZONE_NAME> Zone object name.
Example: DMZ

Example

zone WAN

Syntax

name <WORD>

Mode

IPV6 Address Object

Description

Set address object name.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

name "Corp E-mail Server "

Syntax

host <ADDR_HOST>

Mode

IPV6 Address Object

Description

Set address object host IP.

Options

<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n

Example

host fe80::217:c5ff:fec2

Syntax

range <ADDR_BEGIN> <ADDR_END>

Mode

IPV6 Address Object

Description

Set address object range.

Options

<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

range fe80::217:c5ff:fec1 fe80::217:c5ff:ffff

Syntax

network <ADDR_NETWORK> <ADDR_PREFIX_LEN>

Mode

IPV6 Address Object

Description

Set address object network.

Options

<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_PREFIX_LEN> Network prefix length in decimal or CIDR form: D OR /D.
Max: 128
Example: 128

Example

network fe80::217:c5ff:fec1 /64

Syntax

zone <ZONE_NAME>

Mode

IPV6 Address Object

Description

Set address object zone.

Options

<ZONE_NAME> Zone object name.
Example: DMZ

Example

zone WAN

Syntax

name <WORD>

Mode

IPV4 Address Group

Description

Set address group name.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

name "Corporate Servers "

Syntax

no address-object ipv4 <ADDR_HOST_NETWORK_RANGE_NAME>

Mode

IPV4 Address Group

IPV6 Address Group

Description

Remove an IPV4 address object from group.

Options

<ADDR_HOST_NETWORK_RANGE_NAME> Host/network/range address object name.
Example: Web Server

Example

no address-object ipv4 "Corp E-mail Server"

Syntax

address-object ipv4 <ADDR_HOST_NETWORK_RANGE_NAME>

Mode

IPV4 Address Group

IPV6 Address Group

Description

Assign an IPV4 address object to group.

Options

<ADDR_HOST_NETWORK_RANGE_NAME> Host/network/range address object name.
Example: Web Server

Example

address-object ipv4 "Corp E-mail Server"

Syntax

no address-object mac <ADDR_MAC_NAME>

Mode

IPV4 Address Group

IPV6 Address Group

Description

Remove a MAC address object from group.

Options

<ADDR_MAC_NAME> MAC address object name.
Example: Sales Network Access Point

Example

no address-object mac "Corp E-mail Server"

Syntax

address-object mac <ADDR_MAC_NAME>

Mode

IPV4 Address Group

IPV6 Address Group

Description

Assign an MAC address object to group.

Options

<ADDR_MAC_NAME> MAC address object name.
Example: Sales Network Access Point

Example

address-object mac "Corp E-mail Server"

Syntax

no address-object fqdn <ADDR_FQDN_NAME>

Mode

IPV4 Address Group

IPV6 Address Group

Description

Remove a FQDN address object from group.

Options

<ADDR_FQDN_NAME> FQDN address object name.
Example: www.example.com

Example

no address-object fqdn "Corp E-mail Server"

Syntax

address-object fqdn <ADDR_FQDN_NAME>

Mode

IPV4 Address Group

IPV6 Address Group

Description

Assign an FQDN address object to group.

Options

<ADDR_FQDN_NAME> FQDN address object name.
Example: www.example.com

Example

address-object fqdn "Corp E-mail Server"

Syntax

no address-group ipv4 <ADDR_GROUP_NAME>

Mode

IPV4 Address Group

IPV6 Address Group

Description

Remove an IPV4 address group from group.

Options

<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group

Example

no address-group ipv4 "Corp Web Servers"

Syntax

address-group ipv4 <ADDR_GROUP_NAME>

Mode

IPV4 Address Group

IPV6 Address Group

Description

Assign an IPV4 address group to group.

Options

<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group

Example

address-group ipv4 "Corp Web Servers"

Syntax

name <WORD>

Mode

IPV6 Address Group

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

name "Corporate Servers "

Syntax

no address-object ipv6 <ADDR_NAME>

Mode

IPV6 Address Group

Description

Remove an IPV6 address object from group.

Options

<ADDR_NAME> Address object name.
Example: Web Server

Example

no address-object ipv6 "Corp E-mail Server"

Syntax

address-object ipv6 <ADDR_NAME>

Mode

IPV6 Address Group

Description

Assign an IPV6 address object to group.

Options

<ADDR_NAME> Address object name.
Example: Web Server

Example

address-object ipv6 "Corp E-mail Server"

Syntax

no address-group ipv6 <ADDR_GROUP_NAME>

Mode

IPV6 Address Group

Description

Remove an IPV6 address group from group.

Options

<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group

Example

no address-group ipv6 "Corp Web Servers"

Syntax

address-group ipv6 <ADDR_GROUP_NAME>

Mode

IPV6 Address Group

Description

Assign an IPV6 address group to group.

Options

<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group

Example

address-group ipv6 "Corp Web Servers"

Syntax

schedule <SCHED_NAME>

Mode

Config

Description

Add/Edit a Schedule.

Options

<SCHED_NAME> Schedule object name.
Example: Work Hours

Example

schedule "Contract Schedule"

Syntax

no schedule <SCHED_NAME>

Mode

Config

Description

Delete a schedule.

Options

<SCHED_NAME> Schedule object name.
Example: Work Hours

Example

no schedule "Maintenance Schedule"

Syntax

no schedules

Mode

Config

Description

Delete all custom schedules.

Example

no schedules

Syntax

name <WORD>

Mode

Schedule

Description

Schedule object name.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

name "Contract Schedule"

Syntax

occurs { mixed | once | recurring }

Mode

Schedule

Description

Set schedule occurrence.

Options

 
mixedSet for both recurring schedule and single occurrence.
 
onceSet for single occurrence.
 
recurringSet for recurring schedule.

Example

occurs recurring

Syntax

event <TIME_YYYYMMDDHHMMSS> <TIME_YYYYMMDDHHMMSS>

Mode

One Time Schedule

Mixed Schedule

Description

Enter the start and end date and time of a one time event.

Options

<TIME_YYYYMMDDHHMMSS> Timestamp in the form: YYYY:MM:DD:HH:MM:SS.
Example: 2010:06:30:23:30:59
<TIME_YYYYMMDDHHMMSS> Timestamp in the form: YYYY:MM:DD:HH:MM:SS.
Example: 2010:06:30:23:30:59

Example

event 2010:06:01:00:00:00 2010:06:02:00:00:00

Syntax

recurring <TIME_HHMM> <TIME_HHMM> { { [ sun ] [ mon ] [ tue ] [ wed ] [ thu ] [ fri ] [ sat ] } | all }

Mode

Mixed Schedule

Recurring Schedule

Description

Add to the list of applicable days and start and stop time of the schedule.

Options

<TIME_HHMM> Time in the form: DD:DD.
Example: 12:00
<TIME_HHMM> Time in the form: DD:DD.
Example: 12:00
 
sunDay of the week.
monDay of the week.
tueDay of the week.
wedDay of the week.
thuDay of the week.
friDay of the week.
satDay of the week.
 
allEveryday.

Example

recurring 12:00 18:00 mon tue wed thu fri

Syntax

no recurring <TIME_HHMM> <TIME_HHMM> { { [ sun ] [ mon ] [ tue ] [ wed ] [ thu ] [ fri ] [ sat ] } | all }

Mode

Mixed Schedule

Recurring Schedule

Description

Remove from the schedule an entry by specifying applicable days and start and stop time.

Options

<TIME_HHMM> Time in the form: DD:DD.
Example: 12:00
<TIME_HHMM> Time in the form: DD:DD.
Example: 12:00
 
sunDay of the week.
monDay of the week.
tueDay of the week.
wedDay of the week.
thuDay of the week.
friDay of the week.
satDay of the week.
 
allEveryday.

Example

no recurring 12:00 18:00 mon tue wed thu fri

Syntax

no service-object <SVC_NAME>

Mode

Config

Description

Delete a service object.

Options

<SVC_NAME> Service object name.
Example: HTTPS

Example

no service-object "Corp E-mail Server"

Syntax

no service-objects

Mode

Config

Description

Delete all custom service objects.

Example

no service-objects

Syntax

service-object <SVC_NAME> [ 6over4 | ah | custom <UINT8> | eigrp | esp | gre | icmp { { { address-mask-reply | address-mask-request | datagram-error | destination-unreachable | domain-name | domain-name-reply | echo-reply | echo-request | info-reply | info-request | none | parameter-problem | redirect | router-advertise | router-solicit | source-quench | time-exceeded | timestamp | timestamp-reply | traceroute } } } | icmpv6 { { { destination-unreachable | echo-reply | echo-request | neighbour-advertisement | neighbour-solicitation | none | packet-too-big | parameter-problem | redirect | router-advertisement | router-solicitation | time-exceeded } } } | igmp { { { leave-group | member-query | none | v1-member-report | v2-member-report | v3-member-report } } } | ipcomp | l2tp | ospf { { { database-description | hello | link-state-acknowledge | link-state-request | link-state-update | none } } } | pim { { { assert | bootstrap | candidate-rp | graft | graft-acknowledge | hello | join-prune | none | register | register-stop | state-refresh } } } | tcp <SVC_PORT_BEGIN> <SVC_PORT_END> | udp <SVC_PORT_BEGIN> <SVC_PORT_END> ]

Mode

Config

Description

Add/edit firewall and service object and enter configuration mode.

Options

<SVC_NAME> Service object name.
Example: HTTPS
 
6over4Service object 6over4.
 
ahService object AH.
 
customCustom service object.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
 
eigrpService object EIGRP.
 
espService object ESP.
 
greService object GRE.
 
icmpService object ICMP.
 
address-mask-replyICMP with sub-type of address mask reply.
 
address-mask-requestICMP with sub-type of address mask request.
 
datagram-errorICMP with sub-type of datagram error.
 
destination-unreachableICMP with sub-type of destination unreachable.
 
domain-nameICMP with sub-type of domain name.
 
domain-name-replyICMP with sub-type of domain name reply.
 
echo-replyICMP with sub-type of echo reply.
 
echo-requestICMP with sub-type of echo request.
 
info-replyICMP with sub-type of info reply.
 
info-requestICMP with sub-type of info request.
 
noneICMP with sub-type of none.
 
parameter-problemICMP with sub-type of parameter problem.
 
redirectICMP with sub-type of redirect.
 
router-advertiseICMP with sub-type of router advertise.
 
router-solicitICMP with sub-type of router solicit.
 
source-quenchICMP with sub-type of source quench.
 
time-exceededICMP with sub-type of time exceeded.
 
timestampICMP with sub-type of timestamp.
 
timestamp-replyICMP with sub-type of timestamp reply.
 
tracerouteICMP with sub-type of traceroute.
 
icmpv6Service object ICMPV6/ND.
 
destination-unreachableICMPV6 with sub-type of destination unreachable.
 
echo-replyICMPV6 with sub-type of echo reply.
 
echo-requestICMPV6 with sub-type of echo request.
 
neighbour-advertisementICMPV6 with sub-type of neighbour advertisement.
 
neighbour-solicitationND with sub-type of neighbour solicitation.
 
noneICMPV6 with sub-type of none.
 
packet-too-bigICMPV6 with sub-type of packet too big.
 
parameter-problemICMPV6 with sub-type of parameter problem.
 
redirectND with sub-type of redirect.
 
router-advertisementND with sub-type of router advertisement.
 
router-solicitationND with sub-type of router solicitation.
 
time-exceededICMPV6 with sub-type of time exceeded.
 
igmpService object IGMP.
 
leave-groupIGMP with sub-type of leave group.
 
member-queryIGMP with sub-type of member query.
 
noneIGMP with sub-type of none.
 
v1-member-reportIGMP with sub-type of v1 member report.
 
v2-member-reportIGMP with sub-type of v2 member report.
 
v3-member-reportIGMP with sub-type of v3 member report.
 
ipcompService object IPCOMP.
 
l2tpService object l2tp.
 
ospfService object OSPF.
 
database-descriptionOSPF with sub-type of database description.
 
helloOSPF with sub-type of hello.
 
link-state-acknowledgeOSPF with sub-type of link state acknowledge.
 
link-state-requestOSPF with sub-type of link state request.
 
link-state-updateOSPF with sub-type of link state update.
 
noneOSPF with sub-type of none.
 
pimService object PIM.
 
assertPIM with sub-type of assert.
 
bootstrapPIM with sub-type of bootstrap.
 
candidate-rpPIM with sub-type of candidate rp.
 
graftPIM with sub-type of graft.
 
graft-acknowledgePIM with sub-type of graft acknowledge.
 
helloPIM with sub-type of hello.
 
join-prunePIM with sub-type of join/prune.
 
nonePIM with sub-type of none.
 
registerPIM with sub-type of register.
 
register-stopPIM with sub-type of register stop.
 
state-refreshPIM with sub-type of state refresh.
 
tcpService object TCP.
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80
 
udpService object UDP.
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80

Example

service-object "Web Server" TCP 80 80

Syntax

no service-group <SVC_GROUP_NAME>

Mode

Config

Description

Delete a service group.

Options

<SVC_GROUP_NAME> Service object group name.
Example: VOIP

Example

no service-group "Corporate Servers"

Syntax

no service-groups

Mode

Config

Description

Delete all custom service groups.

Example

no service-groups

Syntax

service-group <SVC_GROUP_NAME>

Mode

Config

Description

Add/edit service group and enter configuration mode.

Options

<SVC_GROUP_NAME> Service object group name.
Example: VOIP

Example

service-group "Corporate Servers"

Syntax

name <SVC_NAME>

Mode

Service Object

Description

Set service object name.

Options

<SVC_NAME> Service object name.
Example: HTTPS

Example

name "Corp E-mail Server "

Syntax

custom <UINT8>

Mode

Service Object

Description

Set service object as custom and specify.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

custom 123

Syntax

icmp { { { address-mask-reply | address-mask-request | datagram-error | destination-unreachable | domain-name | domain-name-reply | echo-reply | echo-request | info-reply | info-request | none | parameter-problem | redirect | router-advertise | router-solicit | source-quench | time-exceeded | timestamp | timestamp-reply | traceroute } } }

Mode

Service Object

Description

Set service object as ICMP and specify sub type.

Options

 
address-mask-replyICMP with sub-type of address mask reply.
 
address-mask-requestICMP with sub-type of address mask request.
 
datagram-errorICMP with sub-type of datagram error.
 
destination-unreachableICMP with sub-type of destination unreachable.
 
domain-nameICMP with sub-type of domain name.
 
domain-name-replyICMP with sub-type of domain name reply.
 
echo-replyICMP with sub-type of echo reply.
 
echo-requestICMP with sub-type of echo request.
 
info-replyICMP with sub-type of info reply.
 
info-requestICMP with sub-type of info request.
 
noneICMP with sub-type of none.
 
parameter-problemICMP with sub-type of parameter problem.
 
redirectICMP with sub-type of redirect.
 
router-advertiseICMP with sub-type of router advertise.
 
router-solicitICMP with sub-type of router solicit.
 
source-quenchICMP with sub-type of source quench.
 
time-exceededICMP with sub-type of time exceeded.
 
timestampICMP with sub-type of timestamp.
 
timestamp-replyICMP with sub-type of timestamp reply.
 
tracerouteICMP with sub-type of traceroute.

Example

icmp echo-reply

Syntax

igmp { { { leave-group | member-query | none | v1-member-report | v2-member-report | v3-member-report } } }

Mode

Service Object

Description

Set service object as IGMP and specify sub type.

Options

 
leave-groupIGMP with sub-type of leave group.
 
member-queryIGMP with sub-type of member query.
 
noneIGMP with sub-type of none.
 
v1-member-reportIGMP with sub-type of v1 member report.
 
v2-member-reportIGMP with sub-type of v2 member report.
 
v3-member-reportIGMP with sub-type of v3 member report.

Example

igmp member-query

Syntax

tcp <SVC_PORT_BEGIN> <SVC_PORT_END>

Mode

Service Object

Description

Set service object as TCP.

Options

<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80

Example

tcp 1 80

Syntax

udp <SVC_PORT_BEGIN> <SVC_PORT_END>

Mode

Service Object

Description

Set service object as UDP.

Options

<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80

Example

udp 1 80

Syntax

6over4

Mode

Service Object

Description

Set service object as 6over4.

Example

6over4

Syntax

gre

Mode

Service Object

Description

Set service object as GRE.

Example

gre

Syntax

esp

Mode

Service Object

Description

Set service object as ESP.

Example

esp

Syntax

ah

Mode

Service Object

Description

Set service object as AH.

Example

ah

Syntax

icmpv6 { { { destination-unreachable | echo-reply | echo-request | neighbour-advertisement | neighbour-solicitation | none | packet-too-big | parameter-problem | redirect | router-advertisement | router-solicitation | time-exceeded } } }

Mode

Service Object

Description

Set service object as ICMPV6.

Options

 
destination-unreachableICMPV6 with sub-type of destination unreachable.
 
echo-replyICMPV6 with sub-type of echo reply.
 
echo-requestICMPV6 with sub-type of echo request.
 
neighbour-advertisementICMPV6 with sub-type of neighbour advertisement.
 
neighbour-solicitationND with sub-type of neighbour solicitation.
 
noneICMPV6 with sub-type of none.
 
packet-too-bigICMPV6 with sub-type of packet too big.
 
parameter-problemICMPV6 with sub-type of parameter problem.
 
redirectND with sub-type of redirect.
 
router-advertisementND with sub-type of router advertisement.
 
router-solicitationND with sub-type of router solicitation.
 
time-exceededICMPV6 with sub-type of time exceeded.

Example

icmpv6 echo-reply

Syntax

eigrp

Mode

Service Object

Description

Set service object as EIGRP.

Example

eigrp

Syntax

ospf { { { database-description | hello | link-state-acknowledge | link-state-request | link-state-update | none } } }

Mode

Service Object

Description

Set service object as OSPF and specify sub type.

Options

 
database-descriptionOSPF with sub-type of database description.
 
helloOSPF with sub-type of hello.
 
link-state-acknowledgeOSPF with sub-type of link state acknowledge.
 
link-state-requestOSPF with sub-type of link state request.
 
link-state-updateOSPF with sub-type of link state update.
 
noneOSPF with sub-type of none.

Example

ospf hello

Syntax

pim { { { assert | bootstrap | candidate-rp | graft | graft-acknowledge | hello | join-prune | none | register | register-stop | state-refresh } } }

Mode

Service Object

Description

Set service object as PIM and specify sub type.

Options

 
assertPIM with sub-type of assert.
 
bootstrapPIM with sub-type of bootstrap.
 
candidate-rpPIM with sub-type of candidate rp.
 
graftPIM with sub-type of graft.
 
graft-acknowledgePIM with sub-type of graft acknowledge.
 
helloPIM with sub-type of hello.
 
join-prunePIM with sub-type of join/prune.
 
nonePIM with sub-type of none.
 
registerPIM with sub-type of register.
 
register-stopPIM with sub-type of register stop.
 
state-refreshPIM with sub-type of state refresh.

Example

pim none

Syntax

l2tp

Mode

Service Object

Description

Set service object as l2tp.

Example

l2tp

Syntax

name <SVC_GROUP_NAME>

Mode

Service Group

Description

Set service group name.

Options

<SVC_GROUP_NAME> Service object group name.
Example: VOIP

Example

name "Corporate Servers "

Syntax

no service-object <SVC_NAME>

Mode

Service Group

Description

Remove service object from group.

Options

<SVC_NAME> Service object name.
Example: HTTPS

Example

no service-object "Corp E-mail Server"

Syntax

service-object <SVC_NAME>

Mode

Service Group

Description

Assign service object to group.

Options

<SVC_NAME> Service object name.
Example: HTTPS

Example

service-object "Corp E-mail Server"

Syntax

no service-group <SVC_GROUP_NAME>

Mode

Service Group

Description

Remove service group from group.

Options

<SVC_GROUP_NAME> Service object group name.
Example: VOIP

Example

no service-group "Corp Web Servers"

Syntax

service-group <SVC_GROUP_NAME>

Mode

Service Group

Description

Assign service group to group.

Options

<SVC_GROUP_NAME> Service object group name.
Example: VOIP

Example

service-group "Corp Web Servers"

Syntax

zone <ZONE_NAME>

Mode

Config

Description

Add/Edit a Zone.

Options

<ZONE_NAME> Zone object name.
Example: DMZ

Example

zone "Office Servers"

Syntax

no zone <ZONE_NAME>

Mode

Config

Description

Delete a custom zone.

Options

<ZONE_NAME> Zone object name.
Example: DMZ

Example

no zone "Office Servers"

Syntax

no zones

Mode

Config

Description

Delete all custom zones.

Example

no zones

Syntax

guest-services

Mode

Zone

Description

Enable zone guest services and enter configuration mode.

Example

guest-services

Syntax

no guest-services

Mode

Zone

Description

Disable zone guest services.

Example

no guest-services

Syntax

wireless

Mode

Zone

Description

Enter wireless zone configuration mode.

Example

wireless

Syntax

name <ZONE_NAME>

Mode

Zone

Description

Set Zone Name.

Options

<ZONE_NAME> Zone object name.
Example: DMZ

Example

name guest

Syntax

security-type { encrypted | management | public | sslvpn | trusted | untrusted | wireless }

Mode

Zone

Description

Set zone security type.

Options

 
encryptedVPN zone.
 
managementManagement zone.
 
publicPublic zone.
 
sslvpnSSLVPN zone.
 
trustedTrusted zone.
 
untrustedWAN/MULTICAST zone.
 
wirelessWireless zone.

Example

security-type public

Syntax

no security-type

Mode

Zone

Description

Disable zone security type.

Example

no security-type

Syntax

interface-trust

Mode

Zone

Description

Enable allow interface trust.

Example

interface-trust

Syntax

no interface-trust

Mode

Zone

Description

Disable allow interface trust.

Example

no interface-trust

Syntax

auto-generate-access-rules { allow-from-higher | allow-from-to-equal | allow-to-lower | deny-from-lower }

Mode

Zone

Description

Enable auto generate access rules.

Options

 
allow-from-higherAllow traffic from zones with higher trust level.
 
allow-from-to-equalAllow traffic between zones with the same trust level.
 
allow-to-lowerAllow traffic to zones with lower trust level.
 
deny-from-lowerDeny traffic from zones with lower trust level.

Example

auto-generate-access-rules allow-from-to-equal

Syntax

no auto-generate-access-rules { allow-from-higher | allow-from-to-equal | allow-to-lower | deny-from-lower }

Mode

Zone

Description

Disable auto generate access rules.

Options

 
allow-from-higherAllow traffic from zones with higher trust level.
 
allow-from-to-equalAllow traffic between zones with the same trust level.
 
allow-to-lowerAllow traffic to zones with lower trust level.
 
deny-from-lowerDeny traffic from zones with lower trust level.

Example

no auto-generate-access-rules allow-from-to-equal

Syntax

content-filtering [ policy <CFS_POLICY_NAME> ]

Mode

Zone

Description

Enable enforce content filtering services and set the policy.

Options

policySpecify a content filtering services policy.
<CFS_POLICY_NAME> CFS policy name.

Example

content-filtering policy "Restricted Access"

Syntax

no content-filtering

Mode

Zone

Description

Disable enforce content filtering services.

Example

no content-filtering

Syntax

client { anti-virus | content-filtering }

Mode

Zone

Description

Enable client services.

Options

 
anti-virusEnable client anti-virus enforcement service.
 
content-filteringEnable client content filtering services enforcement service.

Example

client anti-virus

Syntax

no client { anti-virus | content-filtering }

Mode

Zone

Description

Disable client services.

Options

 
anti-virusDisable client anti-virus enforcement service.
 
content-filteringDisable client content filtering services enforcement service.

Example

no client anti-virus

Syntax

gateway-anti-virus

Mode

Zone

Description

Enable gateway anti-virus service.

Example

gateway-anti-virus

Syntax

no gateway-anti-virus

Mode

Zone

Description

Disable gateway anti-virus service.

Example

no gateway-anti-virus

Syntax

intrusion-prevention

Mode

Zone

Description

Enable intrusion prevention service.

Example

intrusion-prevention

Syntax

no intrusion-prevention

Mode

Zone

Description

Disable intrusion prevention service.

Example

no intrusion-prevention

Syntax

app-control

Mode

Zone

Description

Enable app control service.

Example

app-control

Syntax

no app-control

Mode

Zone

Description

Disable app control service.

Example

no app-control

Syntax

anti-spyware

Mode

Zone

Description

Enable Anti-Spyware Service.

Example

anti-spyware

Syntax

no anti-spyware

Mode

Zone

Description

Disable anti-spyware service.

Example

no anti-spyware

Syntax

create-group-vpn

Mode

Zone

Description

Enable automatic creation of group VPN for this zone.

Example

create-group-vpn

Syntax

no create-group-vpn

Mode

Zone

Description

Disable automatic creation of group VPN for this zone.

Example

no create-group-vpn

Syntax

ssl-control

Mode

Zone

Description

Enable SSL-Control on this zone.

Example

ssl-control

Syntax

no ssl-control

Mode

Zone

Description

Disable SSL-Control on this zone.

Example

no ssl-control

Syntax

sslvpn-access

Mode

Zone

Description

Enable SSL-VPN access for this zone.

Example

sslvpn-access

Syntax

no sslvpn-access

Mode

Zone

Description

Disable SSL-VPN access for this zone.

Example

no sslvpn-access

Syntax

inter-guest

Mode

Guest Services

Description

Enable inter-guest communication.

Example

inter-guest

Syntax

no inter-guest

Mode

Guest Services

Description

Disable inter-guest communication.

Example

no inter-guest

Syntax

bypass client { anti-virus | content-filtering }

Mode

Guest Services

Description

Enable bypass anti-virus check or client content filtering for guests.

Options

 
anti-virusEnable bypass anti-virus check for guests.
 
content-filteringEnable bypass client content filtering check for guests.

Example

bypass anti-virus

Syntax

no bypass client { anti-virus | content-filtering }

Mode

Guest Services

Description

Disable bypass nti-virus check or client content filtering for guests.

Options

 
anti-virusDisable bypass anti-virus check for guests.
 
content-filteringDisable bypass client content filtering check for guests.

Example

no bypass anti-virus

Syntax

external-auth

Mode

Guest Services

Description

Enable external guest authentication and enter its configuration mode.

Example

external-auth

Syntax

no external-auth

Mode

Guest Services

Description

Disable external guest authentication.

Example

no external-auth

Syntax

policy-page-non-authentication

Mode

Guest Services

Description

Enable policy page without authentication and enter its configuration mode.

Example

policy-page-non-authentication

Syntax

no policy-page-non-authentication

Mode

Guest Services

Description

Disable policy page without authentication.

Example

no policy-page-non-authentication

Syntax

client-redirect { http | https }

Mode

External Guest Authentication

Description

Set local web server settings for client redirect.

Options

 
httpSet protocol HTTP.
 
httpsSet protocol HTTPS.

Example

client-redirect https

Syntax

web-server protocol { http | https } { fqdn <ADDR_FQDN> | host <ADDR_FQDNHOST_ADDR> | name <ADDR_FQDNHOST_ADDR> } [ port <IPV4_PORT> ]

Mode

External Guest Authentication

Description

Set the external web server protocol.

Options

 
httpSet protocol HTTP.
 
httpsSet protocol HTTPS.
 
fqdnAddress object full qualified domain name.
<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
hostConfigure the external web server IP addresses or hostname.
<ADDR_FQDNHOST_ADDR> FQDN/host address object name.
Example: Web Server
 
nameConfigure webserver to named address object.
<ADDR_FQDNHOST_ADDR> FQDN/host address object name.
Example: Web Server
portConfigure the external web server port.
<IPV4_PORT> Integer in the form: D OR 0xHHHH.
Example: 80

Example

web-server protocol https host 192.168.168.152 port 443

Syntax

web-server timeout <UINT8>

Mode

External Guest Authentication

Description

Set the external web server connection timeout.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

web-server timeout 10

Syntax

message-auth [ method { md5 | sha1 } ] [ shared-secret <WORD> confirm-secret <WORD> ]

Mode

External Guest Authentication

Description

Enable external message authentication.

Options

methodSet external message authentication method.
 
md5Use HMAC - MD5 authentication.
 
sha1Use HMAC - SHA1 authentication.
shared-secretSet external message authentication shared secret.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
confirm-secretConfirm external message authentication shared secret.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

message-auth method md5 shared-secret donttell confirm-secret donttell

Syntax

no message-auth

Mode

External Guest Authentication

Description

Disable bypass anti-virus check for guests.

Example

no message-auth

Syntax

auth-pages login <WORD>

Mode

External Guest Authentication

Description

Set the external authentication login page.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

auth-pages login login.html

Syntax

no auth-pages login

Mode

External Guest Authentication

Description

Disable the external authentication login page.

Example

no auth-pages login

Syntax

auth-pages expiration <WORD>

Mode

External Guest Authentication

Description

Set the external authentication session expiration page.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

auth-pages expiration exp.html

Syntax

no auth-pages expiration

Mode

External Guest Authentication

Description

Disable the external authentication session expiration page.

Example

no auth-pages expiration

Syntax

auth-pages timeout <WORD>

Mode

External Guest Authentication

Description

Set the external authentication idle timeout page.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

auth-pages timeout idle.html

Syntax

no auth-pages timeout

Mode

External Guest Authentication

Description

Disable the external authentication idle timeout page.

Example

no auth-pages timeout

Syntax

auth-pages max-sessions <WORD>

Mode

External Guest Authentication

Description

Set the external authentication max sessions page.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

auth-pages max-sessions max.html

Syntax

no auth-pages max-sessions

Mode

External Guest Authentication

Description

Disable the external authentication max sessions page.

Example

no auth-pages max-sessions

Syntax

web-content redirect { custom <WORD> | use-default }

Mode

External Guest Authentication

Description

Configure the Web content redirect message.

Options

 
customSet a custom Web content redirect message.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
use-defaultUse the default Web content redirect message.

Example

web-content redirect custom "My custom redirect message"

Syntax

web-content server-down { custom <WORD> | use-default }

Mode

External Guest Authentication

Description

Configure the Web content redirect message.

Options

 
customSet a custom Web content server down message.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
use-defaultUse the default Web content server down message.

Example

web-content server-down custom "My custom server down message"

Syntax

logout-expired every <UINT8> cgi <WORD>

Mode

External Guest Authentication

Description

Enable auto-session logout.

Options

everySet auto-logout expired session every (minutes).
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
cgiSet logout CGI.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

logout-expired every 20 cgi expired.cgi

Syntax

no logout-expired

Mode

External Guest Authentication

Description

Disable auto-session logout.

Example

no logout-expired

Syntax

status-check every <UINT8> cgi <WORD>

Mode

External Guest Authentication

Description

Enable server status check.

Options

everySet check server status every (minutes).
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
cgiSet server status CGI.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

status-check every 20 cgi status.cgi

Syntax

no status-check

Mode

External Guest Authentication

Description

Disable server status check.

Example

no status-check

Syntax

session-sync every <UINT8> cgi <WORD>

Mode

External Guest Authentication

Description

Enable session synchronization.

Options

everySet synchronize every (minutes).
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
cgiSet session sync CGI.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

session-sync every 20 cgi sync.cgi

Syntax

no session-sync

Mode

External Guest Authentication

Description

Disable session synchronization.

Example

no session-sync

Syntax

guest-usage-policy <WORD>

Mode

Policy Page Without Authentication

Description

Set custom login page which may inculde HTML formatting.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

guest-usage-policy "Welcome to DELL Sonicwall."

Syntax

no guest-usage-policy

Mode

Policy Page Without Authentication

Description

Clear custom login page.

Example

no guest-usage-policy

Syntax

custom-auth-page

Mode

Guest Services

Description

Enable custom authentication page and enter its configuration mode.

Example

custom-auth-page

Syntax

no custom-auth-page

Mode

Guest Services

Description

Disable custom authentication page.

Example

no auth-page

Syntax

post-auth <WEB_URL>

Mode

Guest Services

Description

Enable page to direct users to after successful authentication.

Options

<WEB_URL> URL in the form: http://host/file.
Example: http://www.example.com/products/

Example

post-auth http://192.168.168.1/postauth.html

Syntax

no post-auth

Mode

Guest Services

Description

Disable page to direct users to after successful authentication.

Example

no post-auth

Syntax

bypass-guest-auth { all | group <ADDR_MAC_GROUP> | mac <ADDR_MAC> | name <ADDR_MAC_NAME> }

Mode

Guest Services

Description

Enable bypass guest authentication.

Options

 
allAll MAC addresses.
 
groupAddress group name.
<ADDR_MAC_GROUP> MAC group address object name.
Example: Sales & Marketing Network Access Points
 
macMAC address.
<ADDR_MAC> Address object MAC address in the form: HH:HH:HH:HH:HH:HH or HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD
 
nameMAC address object name.
<ADDR_MAC_NAME> MAC address object name.
Example: Sales Network Access Point

Example

bypass-guest-auth mac 020102030405

Syntax

no bypass-guest-auth

Mode

Guest Services

Description

Disable bypass guest authentication.

Example

no bypass-guest-auth

Syntax

smtp-redirect { host <ADDR_HOST> | name <ADDR_HOST_NAME> }

Mode

Guest Services

Description

Enable redirect SMTP traffic to specified server.

Options

 
hostSet the SMTP server to host address.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameSet the SMTP server as named address object.
<ADDR_HOST_NAME> Host address object name.
Example: Web Server

Example

smtp-redirect host 192.168.168.152

Syntax

no smtp-redirect

Mode

Guest Services

Description

Disable redirect SMTP traffic.

Example

no smtp-redirect

Syntax

deny-networks { fqdn <ADDR_FQDN> | group <ADDR_FHNR_GROUP> | host <ADDR_HOST> | name <ADDR_FHNR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> }

Mode

Guest Services

Description

Enable blocking of traffic to the named network.

Options

 
fqdnAddress object full qualified domain name.
<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
groupSet the denied networks as named address group.
<ADDR_FHNR_GROUP> FQDN/host/network/range group address object name.
Example: Web Server Group
 
hostSet the denied networks to host address.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameSet the denied networks as named address object.
<ADDR_FHNR_NAME> FQDN/host/network/range address object name.
Example: Web Server
 
networkSet the denied networks to network address.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeSet the denied networks to range of addresses.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

deny-networks network 192.168.168.0 255.255.255.0

Syntax

no deny-networks

Mode

Guest Services

Description

Disable blocking of traffic to the named network.

Example

no deny-networks

Syntax

pass-networks { fqdn <ADDR_FQDN> | group <ADDR_FHNR_GROUP> | host <ADDR_HOST> | name <ADDR_FHNR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> }

Mode

Guest Services

Description

Enable allowing of traffic to the named network.

Options

 
fqdnAddress object full qualified domain name.
<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
groupSet the pass networks as named address group.
<ADDR_FHNR_GROUP> FQDN/host/network/range group address object name.
Example: Web Server Group
 
hostSet the pass networks to host address.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameSet the pass networks as named address object.
<ADDR_FHNR_NAME> FQDN/host/network/range address object name.
Example: Web Server
 
networkSet the pass networks to network address.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeSet the pass networks to range of addresses.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

pass-networks network 192.168.168.0 255.255.255.0

Syntax

no pass-networks

Mode

Guest Services

Description

Disable allowing of traffic to the named network.

Example

no pass-networks

Syntax

max-guests <UINT16>

Mode

Guest Services

Description

Specify the maximum number of guest users allowed to connect to the WLAN zone.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

max-guests 10

Syntax

dynamic-address-translation

Mode

Guest Services

Description

Enable dynamic address translation.

Example

dynamic-address-translation

Syntax

no dynamic-address-translation

Mode

Guest Services

Description

Disable dynamic address translation.

Example

no dynamic-address-translation

Syntax

footer { text <WORD> | url <WEB_URL> }

Mode

Custom Authentication Page

Description

Configure custom login page footer.

Options

 
textUse configured text for custom login page footer.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
urlUse configured url location for custom page footer.
<WEB_URL> URL in the form: http://host/file.
Example: http://www.example.com/products/

Example

footer url http://192.168.168.1/footer.html

Syntax

header { text <WORD> | url <WEB_URL> }

Mode

Custom Authentication Page

Description

Configure custom login page header.

Options

 
textUse configured text for custom login page header.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
urlUse configured url location for custom login page header.
<WEB_URL> URL in the form: http://host/file.
Example: http://www.example.com/products/

Example

header url http://192.168.168.1/header.html

Syntax

sslvpn-enforcement server { host <ADDR_HOST> | name <ADDR_HOST_NAME> } service { name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> }

Mode

Wireless

Description

Enable SSLVPN enforcement.

Options

serverSet the SSLVPN server as a named address object.
 
hostSet the SSLVPN server to host address.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameSet the SSLVPN server as named address object.
<ADDR_HOST_NAME> Host address object name.
Example: Web Server
serviceSet the SSLVPN service as a named service object.
 
nameSet the SSLVPN service as named service object.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolSet the SSLVPN service as a protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80

Example

sslvpn-enforcement server name "SSLVPN Server" service name "SSLVPN Service"

Syntax

no sslvpn-enforcement

Mode

Wireless

Description

Disable SSLVPN enforcement.

Example

no sslvpn-enforcement

Syntax

wifi-sec-enforcement [ exception-service { name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } ]

Mode

Wireless

Description

Enable WiFiSec enforcement.

Options

exception-serviceSpecify services that are allowed to bypass wifisec enforcement.
 
nameName of service object for the exception service.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolSet the WiFiSec exception service as a protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80

Example

wifi-sec-enforcement

wifi-sec-enforcement service name "SSLVPN Service"

Syntax

no wifi-sec-enforcement [ exception-service ]

Mode

Wireless

Description

Disable WiFiSec enforcement.

Options

exception-serviceDisable WiFiSec enforcement exception service.

Example

no wifi-sec-enforcement

Syntax

wifi-sec-for-site-to-site-vpn

Mode

Wireless

Description

Enable WiFiSec for site-to-site VPN tunnel traversal.

Example

wifi-sec-for-site-to-site-vpn

Syntax

no wifi-sec-for-site-to-site-vpn

Mode

Wireless

Description

Disable WiFiSec for site-to-site VPN tunnel traversal.

Example

no wifi-sec-for-site-to-site-vpn

Syntax

trust-wpa-traffic-as-wifi-sec

Mode

Wireless

Description

Trust WPA / WPA2 traffic as WiFiSec.

Example

trust-wpa-traffic-as-wifi-sec

Syntax

no trust-wpa-traffic-as-wifi-sec

Mode

Wireless

Description

Disable trust WPA / WPA2 traffic as WiFiSec.

Example

no trust-wpa-traffic-as-wifi-sec

Syntax

only-sonicpoint-traffic

Mode

Wireless

Description

Enable only allow traffic generated by a SonicPoint/SonicPointN.

Example

only-sonicpoint-traffic

Syntax

no only-sonicpoint-traffic

Mode

Wireless

Description

Disable only allow traffic generated by a SonicPoint/SonicPointN.

Example

no only-sonicpoint-traffic

Syntax

show address-objects [ fqdn | ipv4 [ { host | network | range } ] | ipv6 [ { host | network | range } ] | mac ] [ { custom | default } ] [ { pending-config | with-pending-config } ] [ json | validate | xml ]

Mode

All Modes

Description

Show all address objects.

Options

 
fqdnShow FQDN address objects.
 
ipv4Show only IPV4 address objects.
 
hostShow host address objects.
 
networkShow network address objects.
 
rangeShow range address objects.
 
ipv6Show only IPV6 address objects.
 
hostShow host address objects.
 
networkShow network address objects.
 
rangeShow range address objects.
 
macShow MAC address objects.
 
customShow custom configuration.
 
defaultShow system/factory default configuration.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show address-objects

Syntax

show address-object ipv4 <ADDR_HOST_NETWORK_RANGE_NAME> [ { pending-config | with-pending-config } ] [ json | validate | xml ]

Mode

All Modes

Description

Show an IPV4 address object.

Options

<ADDR_HOST_NETWORK_RANGE_NAME> Host/network/range address object name.
Example: Web Server
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show address-object ipv4 "X0 IP"

Syntax

show address-object ipv6 <ADDR_HOST_NETWORK_RANGE_NAME> [ { pending-config | with-pending-config } ] [ json | validate | xml ]

Mode

All Modes

Description

Show an IPV6 address object.

Options

<ADDR_HOST_NETWORK_RANGE_NAME> Host/network/range address object name.
Example: Web Server
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show address-object ipv6 "X0 IPv6 Link-Local Address"

Syntax

show address-object mac <ADDR_MAC_NAME> [ { pending-config | with-pending-config } ] [ json | validate | xml ]

Mode

All Modes

Description

Show a MAC address object.

Options

<ADDR_MAC_NAME> MAC address object name.
Example: Sales Network Access Point
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show address-object mac "Web Server MAC"

Syntax

show address-object fqdn <ADDR_FQDN_NAME> [ { pending-config | with-pending-config } ] [ json | validate | xml ]

Mode

All Modes

Description

Show a FQDN address object.

Options

<ADDR_FQDN_NAME> FQDN address object name.
Example: www.example.com
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show address-object fqdn "Web Server FQDN"

Syntax

show address-groups [ ipv4 | ipv6 ] [ { custom | default } ] [ { pending-config | with-pending-config } ] [ json | validate | xml ]

Mode

All Modes

Description

Show all address groups.

Options

 
ipv4Show only IPV4 address groups.
 
ipv6Show only IPV6 address groups.
 
customShow custom configuration.
 
defaultShow system/factory default configuration.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show address-groups

Syntax

show address-group ipv4 <ADDR_GROUP_NAME> [ { pending-config | with-pending-config } ] [ json | validate | xml ]

Mode

All Modes

Description

Show an address group.

Options

<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show address-group ipv4 "LAN Subnets"

Syntax

show address-group ipv6 <ADDR_GROUP_NAME> [ { pending-config | with-pending-config } ] [ json | validate | xml ]

Mode

All Modes

Description

Show an address group.

Options

<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show address-group ipv6 "DMZ IPv6 Subnets"

Syntax

show schedules [ all | mixed | once | recurring ] [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show all Schedule Objects.

Options

 
allShow all Schedule Objects.
 
mixedShow all Schedule Objects set for both recurring schedule and single occurrence.
 
onceShow all Schedule Objects set for single occurrence.
 
recurringShow all Schedule Objects set for recurring.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show schedules

Syntax

show schedule <SCHED_NAME> [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show a Schedule Object.

Options

<SCHED_NAME> Schedule object name.
Example: Work Hours
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show schedule "Work Hours"

Syntax

show service-objects [ 6over4 | ah | eigrp | esp | gre | icmp | icmpv6 | igmp | l2tp | ospf | pim | tcp | udp ] [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show all service objects.

Options

 
6over4Show 6over4 service objects.
 
ahShow AH service objects.
 
eigrpShow EIGRP service objects.
 
espShow ESP service objects.
 
greShow GRE service objects.
 
icmpShow ICMP service objects.
 
icmpv6Show ICMPV6 service objects.
 
igmpShow IGMP service objects.
 
l2tpShow l2tp service objects.
 
ospfShow OSPF service objects.
 
pimShow PIM service objects.
 
tcpShow TCP service objects.
 
udpShow UDP service objects.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show service-objects

Syntax

show service-object <SVC_NAME> [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show service object.

Options

<SVC_NAME> Service object name.
Example: HTTPS
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show service-object "Corp Servers"

Syntax

show service-groups [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show all service groups.

Options

 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show service-groups

Syntax

show service-group <SVC_GROUP_NAME> [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show service group.

Options

<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show service-group "Citrix"

Syntax

show zones [ status ] [ { pending-config | with-pending-config } ] [ json | validate | xml ]

Mode

All Modes

Description

Show all Zone Objects.

Options

statusShow zones status.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show zones

Syntax

show zone <ZONE_NAME> [ status ] [ { pending-config | with-pending-config } ] [ json | validate | xml ]

Mode

All Modes

Description

Show a Zone Object.

Options

<ZONE_NAME> Zone object name.
Example: DMZ
statusShow a zone status.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show zone "LAN"

Syntax

clear interface [ ipv4 | ipv6 ] statistics

Mode

All Modes (
excluding Top Level)

Description

Reset interface statistics.

Options

 
ipv4Reset interface IPv4 statistics.
 
ipv6Reset interface IPv6 statistics.
statisticsReset interface statistics.

Example

clear interface statistics

Syntax

interfaces display-all-traffic

Mode

Config

Description

Enable display all traffic.

Example

interfaces display-all-traffic

Syntax

no interfaces display-all-traffic

Mode

Config

Description

Disable display all traffic.

Example

no interfaces display-all-traffic

Syntax

interface [ ipv6 ] <CONFIGURABLE_INTERFACE> [ vlan <VLAN_TAG> ]

Mode

Config

Description

Configure interface or add/edit sub-interface.

Options

ipv6Configure interface IPv6 parameters.
<CONFIGURABLE_INTERFACE> Interface name.
Example: X0
vlanConfigure VLAN sub-interface.
<VLAN_TAG> VLAN tag.
Example: 23

Example

interface X1

interface X1 vlan 100

Syntax

no interface <CONFIGURABLE_INTERFACE> vlan <VLAN_TAG>

Mode

Config

Description

Delete sub-interface.

Options

<CONFIGURABLE_INTERFACE> Interface name.
Example: X0
vlanConfigure VLAN sub-interface.
<VLAN_TAG> VLAN tag.
Example: 23

Example

no interface X1 vlan 101

Syntax

renew [ ipv6 ] <DHCP_INTERFACE>

Mode

Config

Description

Renew interface DHCP lease.

Options

ipv6Renew interface DHCPv6 lease.
<DHCP_INTERFACE> Interface name.
Example: X0

Example

renew X5

Syntax

release [ ipv6 ] <DHCP_INTERFACE>

Mode

Config

Description

Release designated interface DHCP lease.

Options

ipv6Release interface DHCPv6 lease.
<DHCP_INTERFACE> Interface name.
Example: X0

Example

release X5

Syntax

connect <CONNECT_INTERFACE>

Mode

Config

Description

Connect designated interface to PPTP/L2TP/PPPoE server.

Options

<CONNECT_INTERFACE> Interface name.
Example: X0

Example

connect X5

Syntax

disconnect <CONNECT_INTERFACE>

Mode

Config

Description

Disconnect designated interface from PPTP/L2TP/PPPoE server.

Options

<CONNECT_INTERFACE> Interface name.
Example: X0

Example

disconnect X5

Syntax

link-speed { auto-negotiate | full { { 10 | 100 | 1000 | 10000 } } | half { { 10 | 100 } } }

Mode

Interface

Description

Set interface link speed.

Options

 
auto-negotiateSet interface link speed to auto-negotiate.
 
fullFull duplex.
 
10Set interface link speed to 10 Mbps-full duplex.
 
100Set interface link speed to 100 Mbps-full duplex.
 
1000Set interface link speed to 1000 Mbps-full duplex.
 
10000Set interface link speed to 10 Gbps(10000 Mbps)-full duplex.
 
halfHalf duplex.
 
10Set interface link speed to 10 Mbps-half duplex.
 
100Set interface link speed to 100 Mbps-half duplex.

Example

link-speed half 100

Syntax

comment <WORD>

Mode

Interface

Description

Set interface comment.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

comment "Interface X0"

Syntax

no comment

Mode

Interface

Description

Clear interface comment.

Example

no comment

Syntax

egress-bandwidth-management <DECIMAL>

Mode

Interface

Description

Enable and set egress bandwidth management in Kbps.

Options

<DECIMAL> Decimal in the form: n+.n+.
Example: 0.999

Example

egress-bandwidth-management 1000

Syntax

no egress-bandwidth-management

Mode

Interface

Description

Disable egress bandwidth management.

Example

no egress-bandwidth-management

Syntax

ingress-bandwidth-management <DECIMAL>

Mode

Interface

Description

Enable and set ingress bandwidth management in Kbps.

Options

<DECIMAL> Decimal in the form: n+.n+.
Example: 0.999

Example

ingress-bandwidth-management 1000

Syntax

no ingress-bandwidth-management

Mode

Interface

Description

Disable ingress bandwidth management.

Example

no ingress-bandwidth-management

Syntax

send-icmp-fragmentation

Mode

Interface

Description

Enable ICMP fragmentation needed message generation.

Example

send-icmp-fragmentation

Syntax

no send-icmp-fragmentation

Mode

Interface

Description

Suppress ICMP fragmentation needed message generation.

Example

no send-icmp-fragmentation

Syntax

fragment-packets

Mode

Interface

Description

Enable fragment non-VPN outbound packets larger than this interface's MTU.

Example

fragment-packets

Syntax

no fragment-packets

Mode

Interface

Description

Disable fragment non-VPN outbound packets larger than this interface's MTU.

Example

no fragment-packets

Syntax

ignore-df-bit

Mode

Interface

Description

Enable ignore don't fragment (DF) bit.

Example

ignore-df-bit

Syntax

no ignore-df-bit

Mode

Interface

Description

Disable ignore don't fragment (DF) bit.

Example

no ignore-df-bit

Syntax

mtu <UINT16>

Mode

Interface

Description

Set interface MTU.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

mtu 1500

Syntax

https-redirect

Mode

Interface

Description

Enable redirection from HTTP to HTTPS.

Example

https-redirect

Syntax

no https-redirect

Mode

Interface

Description

Disable redirection from HTTP to HTTPS.

Example

no https-redirect

Syntax

management { http | https | ping | snmp | ssh }

Mode

Interface

Description

Enable management for the specified protocols.

Options

 
httpHTTP.
 
httpsHTTPS.
 
pingPing.
 
snmpSNMP.
 
sshSSH.

Example

management https

Syntax

no management { http | https | ping | snmp | ssh }

Mode

Interface

Description

Disable management for the specified protocols.

Options

 
httpHTTP.
 
httpsHTTPS.
 
pingPing.
 
snmpSNMP.
 
sshSSH.

Example

no management https

Syntax

mac { default | override <MAC> }

Mode

Interface

Description

Set MAC address used for this interface.

Options

 
defaultFactory configured MAC.
 
overrideOverride factory configured MAC.
<MAC> MAC address in the form: HH:HH:HH:HH:HH:HH OR HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD

Example

mac override 00:17:C5:0F:73:F4

Syntax

flow-reporting

Mode

Interface

Description

Enable flow reporting on the interface.

Example

flow-reporting

Syntax

no flow-reporting

Mode

Interface

Description

Disable flow reporting on the interface.

Example

no flow-reporting

Syntax

multicast

Mode

Interface

Description

Enable multicast support.

Example

multicast

Syntax

no multicast

Mode

Interface

Description

Disable multicast support.

Example

no multicast

Syntax

cos-8021p

Mode

Interface

Description

Enable 802.1p support.

Example

cos-8021p

Syntax

no cos-8021p

Mode

Interface

Description

Disable 802.1p support.

Example

no cos-8021p

Syntax

exclude-route

Mode

Interface

Description

Enable exclude from route advertisement (NSM, OSPF, BGP, RIP).

Example

exclude-route

Syntax

no exclude-route

Mode

Interface

Description

Disable exclude from route advertisement (NSM, OSPF, BGP, RIP).

Example

no exclude-route

Syntax

default-8021p-cos { background | best-effort | controlled-load | excellent-effort | network-control | spare | video | voice }

Mode

Interface

Description

Enable default 802.1p CoS.

Options

 
background1-Background.
 
best-effort0-Best effort.
 
controlled-load4-Controlled load.
 
excellent-effort3-Excellent effort.
 
network-control7-Network control.
 
spare2-Spare.
 
video5-Video(<100ms latency).
 
voice6-Voice(<10ms latency).

Example

default-8021p-cos best-effort

Syntax

no default-8021p-cos

Mode

Interface

Description

Disable default 802.1p CoS.

Example

no default-8021p-cos

Syntax

shutdown-port

Mode

Interface

Description

Enable shutdown port.

Example

shutdown-port

Syntax

no shutdown-port

Mode

Interface

Description

Disable shutdown port.

Example

no shutdown-port

Syntax

port aggregation aggregate <UINT8> <PORT_GROUP_INTERFACE>

Mode

Interface

Description

Set link aggregation.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123
<PORT_GROUP_INTERFACE> Interface name.
Example: X0

Example

port aggregation aggregate 1 X3

port aggregation aggregate 2 X4
port aggregation aggregate 3 X5

Syntax

no port aggregation aggregate <UINT8>

Mode

Interface

Description

Disable link aggregate port.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

no port aggregation aggregate 1

Syntax

port aggregation paired-aggregate <UINT8> <PORT_GROUP_INTERFACE>

Mode

Interface

Description

Set paired interface link aggregation.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123
<PORT_GROUP_INTERFACE> Interface name.
Example: X0

Example

port aggregation paired-aggregate 1 X6

port aggregation paired-aggregate 2 X7
port aggregation paired-aggregate 3 X8

Syntax

no port aggregation paired-aggregate <UINT8>

Mode

Interface

Description

Disable paired interface link aggregate port.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

no port aggregation paired-aggregate 1

Syntax

port redundancy <PORT_GROUP_INTERFACE>

Mode

Interface

Description

Set port redundancy.

Options

<PORT_GROUP_INTERFACE> Interface name.
Example: X0

Example

port redundancy X3

Syntax

no port redundancy-aggregation

Mode

Interface

Description

Disable port redundancy and link aggregation.

Example

no port redundancy-aggregation

Syntax

load-balancing-vip <IPV4_HOST>

Mode

Interface

Description

Set the LAN load balancing virtual IP address for active-active cluster.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

load-balancing-vip 10.10.10.15

Syntax

no load-balancing-vip

Mode

Interface

Description

Remove the LAN load balancing virtual IP address for active-active cluster.

Example

no load-balancing-vip

Syntax

routed-mode { any | interface <PHYS_WAN_INTERFACE> }

Mode

Interface

Description

Enable routed mode and set the associated interface - Add NAT policy to prevent inbound / outbound translation.

Options

 
anyUse any interface.
 
interfaceSpecify interface.
<PHYS_WAN_INTERFACE> WAN interface name.
Example: X1

Example

routed-mode interface X1

Syntax

no routed-mode

Mode

Interface

Description

Disable routed mode.

Example

no routed-mode

Syntax

sonicpoint limit <SONICPOINT_LIMIT>

Mode

Interface

Description

Set SonicPoint limit.

Options

<SONICPOINT_LIMIT> SonicPoint limit per interface.
Example: 8

Example

sonicpoint limit 8

Syntax

sonicpoint reserve-address { dynamic | manual <IPV4_HOST> }

Mode

Interface

Description

Set dynamically or manually reserve SonicPoint address.

Options

 
dynamicDynamically reserve SonicPoint address.
 
manualManually reserve SonicPoint address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

sonicpoint reserve-address dynamic

Syntax

user-login [ http ] [ https ]

Mode

Interface

Description

Enable user login for the specified protocols.

Options

httpHTTP.
httpsHTTPS.

Example

user-login http

Syntax

no user-login [ http ] [ https ]

Mode

Interface

Description

Disable user login for the specified protocols.

Options

httpHTTP.
httpsHTTPS.

Example

no user-login http

Syntax

ip-assignment <INTERFACE_ZONE_NAME> { dhcp | l2bridge | l2tp | portshield <PORTSHIELD_INTERFACE> | pppoe | pptp | static | tap-mode | transparent | wire-mode }

Mode

Interface

Description

Set interface zone and IP assignment.

Options

<INTERFACE_ZONE_NAME> Zone object name.
Example: DMZ
 
dhcpIP address obtained by DHCP.
 
l2bridgeInterface uses layer two bridging (IP route option).
 
l2tpInterface uses layer2 tunneling protocol.
 
portshieldInterface is portshielded.
<PORTSHIELD_INTERFACE> Interface name.
Example: X0
 
pppoeInterface uses point to point protocol over ethernet.
 
pptpInterface uses point to point tunneling protocol.
 
staticStatic IP address assignment.
 
tap-modeInterface in tap mode.
 
transparentInterface uses transparent bridging (splice L3 subnet).
 
wire-modeInterfaces paired in wire mode.

Example

ip-assignment WAN dhcp

ip-assignment WLAN static
ip-assignment LAN l2bridge
ip-assignment MGMT static
ip-assignment LAN wire-mode

Syntax

no ip-assignment

Mode

Interface

Description

Clear interface zone and IP assignment.

Example

no ip-assignment

Syntax

type { bypass | inspect | secure }

Mode

Wire Mode

Description

Set the type for wiremode.

Options

 
bypassBypass (via internal switch / relay).
 
inspectInspect (passive deep packet inspection of mirrored traffic).
 
secureSecure (active deep packet inspection of inline traffic).

Example

type secure

Syntax

paired-interface <PORT_GROUP_INTERFACE>

Mode

Wire Mode

Description

Set the paired interface for wiremode.

Options

<PORT_GROUP_INTERFACE> Interface name.
Example: X0

Example

paired-interface X3

Syntax

no paired-interface

Mode

Wire Mode

Description

Clear the paired interface for wiremode.

Example

no paired-interface

Syntax

paired-interface-zone <WIRE_INTERFACE_ZONE_NAME>

Mode

Wire Mode

Description

Set the paired interface zone for wiremode.

Options

<WIRE_INTERFACE_ZONE_NAME> Zone object name.
Example: DMZ

Example

paired-interface-zone LAN

Syntax

stateful-inspection

Mode

Wire Mode

Tap Mode

Description

Enable stateful inspection.

Example

stateful-inspection

Syntax

no stateful-inspection

Mode

Wire Mode

Tap Mode

Description

Disable stateful inspection.

Example

no stateful-inspection

Syntax

linkstate-propagation

Mode

Wire Mode

Description

Enable link state propagation.

Example

linkstate-propagation

Syntax

no linkstate-propagation

Mode

Wire Mode

Description

Disable link state propagation.

Example

no linkstate-propagation

Syntax

restrict-analysis

Mode

Wire Mode

Description

Enable restrict analysis at resource limit.

Example

restrict-analysis

Syntax

no restrict-analysis

Mode

Wire Mode

Description

Disable restrict analysis at resource limit.

Example

no restrict-analysis

Syntax

ip <IPV4_HOST> [ netmask <IPV4_MASK> ]

Mode

Static IP Assignment

Description

Set interface IP address.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
netmaskSet interface netmask.
<IPV4_MASK> IPV4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D.
Example: 255.255.255.0

Example

ip 10.10.10.10 netmask 255.255.255.0

Syntax

no ip

Mode

Static IP Assignment

Description

Clear interface IP address.

Example

no ip

Syntax

virtual-group <VIRTUAL_GROUP_ID> { backup-ip | ip } <IPV4_HOST>

Mode

Static IP Assignment

Description

Set interface virtual group IP address.

Options

<VIRTUAL_GROUP_ID> Integer in the form: D OR 0xHH.
Example: 1
 
backup-ipSecondary IP address.
 
ipIP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

virtual-group 2 ip 10.10.10.12

Syntax

no virtual-group <VIRTUAL_GROUP_ID> { backup-ip | ip }

Mode

Static IP Assignment

Description

Clear interface virtual group IP address.

Options

<VIRTUAL_GROUP_ID> Integer in the form: D OR 0xHH.
Example: 1
 
backup-ipSecondary IP address.
 
ipIP address.

Example

no virtual-group 2 ip

Syntax

netmask <IPV4_MASK>

Mode

Static IP Assignment

Description

Set interface subnet mask.

Options

<IPV4_MASK> IPV4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D.
Example: 255.255.255.0

Example

netmask 255.255.255.0

Syntax

backup-ip <IPV4_HOST>

Mode

Static IP Assignment

Description

Set MGMT interface IP address (Secondary).

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

backup-ip 10.10.10.10

Syntax

no backup-ip

Mode

Static IP Assignment

Description

Clear MGMT interface IP address (Secondary).

Example

no backup-ip

Syntax

dns primary <IPV4_HOST>

Mode

Static IP Assignment

Description

Set the primary DNS server IP address.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

dns primary 192.168.168.169

Syntax

dns secondary <IPV4_HOST>

Mode

Static IP Assignment

Description

Set the secondary DNS server IP address.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

dns secondary 192.168.168.170

Syntax

dns tertiary <IPV4_HOST>

Mode

Static IP Assignment

Description

Set the tertiary DNS server IP address.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

dns tertiary 192.168.168.171

Syntax

no dns primary

Mode

Static IP Assignment

Description

Clear the primary DNS server IP address.

Example

no dns primary

Syntax

no dns secondary

Mode

Static IP Assignment

Description

Clear the secondary DNS server IP address.

Example

no dns secondary

Syntax

no dns tertiary

Mode

Static IP Assignment

Description

Clear the tertiary DNS server IP address.

Example

no dns tertiary

Syntax

gateway <IPV4_HOST>

Mode

Static IP Assignment

Description

Set interface gateway.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

gateway 10.10.10.1

Syntax

no gateway

Mode

Static IP Assignment

Description

Clear interface gateway.

Example

no gateway

Syntax

hostname <WORD>

Mode

DHCP IP Assignment

Description

Set DHCP hostname.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

hostname mydhcpclient

Syntax

no hostname

Mode

DHCP IP Assignment

Description

Clear DHCP hostname.

Example

no hostname

Syntax

release

Mode

DHCP IP Assignment

Description

Release designated interface DHCP lease.

Example

release

Syntax

renew

Mode

DHCP IP Assignment

Description

Renew interface DHCP lease.

Example

renew

Syntax

renew-on-startup

Mode

DHCP IP Assignment

Description

Enable request renew of previous IP on startup.

Example

renew-on-startup

Syntax

no renew-on-startup

Mode

DHCP IP Assignment

Description

Disable request renew of previous IP on startup.

Example

no renew-on-startup

Syntax

renew-on-link-up

Mode

DHCP IP Assignment

Description

Enable renew DHCP lease on any link up occurrence.

Example

renew-on-link-up

Syntax

no renew-on-link-up

Mode

DHCP IP Assignment

Description

Disable renew DHCP lease on any link up occurrence.

Example

no renew-on-link-up

Syntax

initiate-renewals-with-discover

Mode

DHCP IP Assignment

Description

Enable initiate renewals with a discover when using DHCP.

Example

initiate-renewals-with-discover

Syntax

no initiate-renewals-with-discover

Mode

DHCP IP Assignment

Description

Disable initiate renewals with a discover when using DHCP.

Example

no initiate-renewals-with-discover

Syntax

force-discover-interval <UINT32>

Mode

DHCP IP Assignment

Description

Enable and set the DHCP discovers interval during lease acquisition.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

force-discover-interval 8

Syntax

no force-discover-interval

Mode

DHCP IP Assignment

Description

Disable force DHCP discovers interval during lease acquisition.

Example

no force-discover-interval

Syntax

schedule { always-on | days <SCHED_DAYS> time <SCHED_TIME_BEGIN> <SCHED_TIME_END> | name <SCHED_NAME> }

Mode

PPTP IP Assignment

Description

Set the wan pptp reconnect schedule.

Options

 
always-onAlways on.
 
daysSchedule object days.
<SCHED_DAYS> Days of the week in the form: SU-M-T-W-TH-F-SA.
Example: SU-M-TH-SA
timeSchedule object beginning/ending time.
<SCHED_TIME_BEGIN> Time in the form: DD:DD.
Example: 12:00
<SCHED_TIME_END> Time in the form: DD:DD.
Example: 12:00
 
nameSchedule object name.
<SCHED_NAME> Schedule object name.
Example: Work Hours

Example

schedule name "Work Hours"

Syntax

dynamic

Mode

PPTP IP Assignment

Description

Enable dynamic acquisition of IP configuration data.

Example

dynamic

Syntax

no dynamic

Mode

PPTP IP Assignment

Description

Disable dynamic acquisition of IP configuration data.

Example

no dynamic

Syntax

gateway <IPV4_HOST>

Mode

PPTP IP Assignment

Description

Set interface gateway.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

gateway 10.10.10.1

Syntax

no gateway

Mode

PPTP IP Assignment

Description

Clear interface gateway.

Example

no gateway

Syntax

hostname <WORD>

Mode

PPTP IP Assignment

Description

Set PPTP hostname.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

hostname mypptpclient

Syntax

no hostname

Mode

PPTP IP Assignment

Description

Clear PPTP hostname.

Example

no hostname

Syntax

inactivity <UINT16>

Mode

PPTP IP Assignment

Description

Enable the PPTP inactivity timer.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

inactivity 10

Syntax

no inactivity

Mode

PPTP IP Assignment

Description

Disable the PPTP inactivity timer.

Example

no inactivity

Syntax

ip <IPV4_HOST> [ netmask <IPV4_MASK> ]

Mode

PPTP IP Assignment

Description

Set PPTP IP address.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
netmaskSet interface netmask.
<IPV4_MASK> IPV4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D.
Example: 255.255.255.0

Example

ip 10.10.10.10 netmask 255.255.255.0

Syntax

no ip

Mode

PPTP IP Assignment

Description

Clear PPTP IP address.

Example

no ip

Syntax

password <ENC_PASSWORD>

Mode

PPTP IP Assignment

Description

Set PPTP user password.

Options

<ENC_PASSWORD> Password.
Example: secret

Example

password mysecret

Syntax

no password

Mode

PPTP IP Assignment

Description

Clear PPTP user password.

Example

no password

Syntax

release

Mode

PPTP IP Assignment

Description

Release designated interface DHCP lease.

Example

release

Syntax

renew

Mode

PPTP IP Assignment

Description

Renew interface DHCP lease.

Example

renew

Syntax

server <IPV4_HOST>

Mode

PPTP IP Assignment

Description

Set PPTP server IP address.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

server 10.10.10.10

Syntax

no server

Mode

PPTP IP Assignment

Description

Clear PPTP server IP address.

Example

no server

Syntax

user-name <WORD>

Mode

PPTP IP Assignment

Description

Set PPTP user name.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

user-name pptpuser

Syntax

no user-name

Mode

PPTP IP Assignment

Description

Clear PPTP user name.

Example

no user-name

Syntax

schedule { always-on | days <SCHED_DAYS> time <SCHED_TIME_BEGIN> <SCHED_TIME_END> | name <SCHED_NAME> }

Mode

L2TP IP Assignment

Description

Set the wan l2tp reconnect schedule.

Options

 
always-onAlways on.
 
daysSchedule object days.
<SCHED_DAYS> Days of the week in the form: SU-M-T-W-TH-F-SA.
Example: SU-M-TH-SA
timeSchedule object beginning/ending time.
<SCHED_TIME_BEGIN> Time in the form: DD:DD.
Example: 12:00
<SCHED_TIME_END> Time in the form: DD:DD.
Example: 12:00
 
nameSchedule object name.
<SCHED_NAME> Schedule object name.
Example: Work Hours

Example

schedule name "Work Hours"

Syntax

dynamic

Mode

L2TP IP Assignment

Description

Enable dynamic acquisition of IP configuration data.

Example

dynamic

Syntax

no dynamic

Mode

L2TP IP Assignment

Description

Disable dynamic acquisition of IP configuration data.

Example

no dynamic

Syntax

gateway <IPV4_HOST>

Mode

L2TP IP Assignment

Description

Set interface gateway.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

gateway 10.10.10.1

Syntax

no gateway

Mode

L2TP IP Assignment

Description

Clear interface gateway.

Example

no gateway

Syntax

hostname <WORD>

Mode

L2TP IP Assignment

Description

Set L2TP hostname.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

hostname myl2tpclient

Syntax

no hostname

Mode

L2TP IP Assignment

Description

Clear L2TP hostname.

Example

no hostname

Syntax

inactivity <UINT16>

Mode

L2TP IP Assignment

Description

Enable the L2TP inactivity timer.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

inactivity 10

Syntax

no inactivity

Mode

L2TP IP Assignment

Description

Disable the L2TP inactivity timer.

Example

no inactivity

Syntax

ip <IPV4_HOST> [ netmask <IPV4_MASK> ]

Mode

L2TP IP Assignment

Description

Set L2TP IP address.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
netmaskSet interface netmask.
<IPV4_MASK> IPV4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D.
Example: 255.255.255.0

Example

ip 10.10.10.10 netmask 255.255.255.0

Syntax

no ip

Mode

L2TP IP Assignment

Description

Clear L2TP IP address.

Example

no ip

Syntax

password <ENC_PASSWORD>

Mode

L2TP IP Assignment

Description

Set L2TP user password.

Options

<ENC_PASSWORD> Password.
Example: secret

Example

password mysecret

Syntax

no password

Mode

L2TP IP Assignment

Description

Clear L2TP password.

Example

no password

Syntax

release

Mode

L2TP IP Assignment

Description

Release designated interface DHCP lease.

Example

release

Syntax

renew

Mode

L2TP IP Assignment

Description

Renew interface DHCP lease.

Example

renew

Syntax

server <IPV4_HOST>

Mode

L2TP IP Assignment

Description

Set L2TP server IP address.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

server 10.10.10.10

Syntax

no server

Mode

L2TP IP Assignment

Description

Clear L2TP server IP address.

Example

no server

Syntax

shared-secret <ENC_PASSWORD>

Mode

L2TP IP Assignment

Description

Set L2TP password.

Options

<ENC_PASSWORD> Password.
Example: secret

Example

shared-secret myl2tpsecret

Syntax

no shared-secret

Mode

L2TP IP Assignment

Description

Clear L2TP shared secret.

Example

no shared-secret

Syntax

user-name <WORD>

Mode

L2TP IP Assignment

Description

Set L2TP user name.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

user-name l2tpuser

Syntax

no user-name

Mode

L2TP IP Assignment

Description

Clear L2TP user name.

Example

no user-name

Syntax

dynamic

Mode

PPPoE IP Assignment

Description

Enable dynamic acquisition of IP configuration data.

Example

dynamic

Syntax

no dynamic

Mode

PPPoE IP Assignment

Description

Disable dynamic acquisition of IP configuration data.

Example

no dynamic

Syntax

inactivity <UINT16>

Mode

PPPoE IP Assignment

Description

Enable the PPPoE inactivity timer.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

inactivity 10

Syntax

no inactivity

Mode

PPPoE IP Assignment

Description

Disable the PPPoE inactivity timer.

Example

no inactivity

Syntax

ip <IPV4_HOST>

Mode

PPPoE IP Assignment

Description

Set PPPoE IP address.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

ip 10.10.10.10

Syntax

no ip

Mode

PPPoE IP Assignment

Description

Clear PPPoE IP address.

Example

no ip

Syntax

lcp-echo-packets

Mode

PPPoE IP Assignment

Description

Enable strictly use LCP echo packets for server keep-alive.

Example

lcp-echo-packets

Syntax

no lcp-echo-packets

Mode

PPPoE IP Assignment

Description

Disable strictly use LCP echo packets for server keep-alive.

Example

no lcp-echo-packets

Syntax

password <ENC_PASSWORD>

Mode

PPPoE IP Assignment

Description

Set PPPoE user password.

Options

<ENC_PASSWORD> Password.
Example: secret

Example

password mysecret

Syntax

no password

Mode

PPPoE IP Assignment

Description

Clear PPPoE password.

Example

no password

Syntax

service-name <WORD>

Mode

PPPoE IP Assignment

Description

Set PPPoE service Name.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

service-name mypppoeservice

Syntax

no service-name

Mode

PPPoE IP Assignment

Description

Clear PPPoE service Name.

Example

no service-name

Syntax

reconnect <UINT16>

Mode

PPPoE IP Assignment

Description

Enable and set reconnect the PPPoE client if the server does not send traffic for specified minutes.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

reconnect 5

Syntax

no reconnect

Mode

PPPoE IP Assignment

Description

Disable reconnect the PPPoE client if the server does not send traffic.

Example

no reconnect

Syntax

user-name <WORD>

Mode

PPPoE IP Assignment

Description

Set PPPoE user name.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

user-name pppoeuser

Syntax

no user-name

Mode

PPPoE IP Assignment

Description

Clear PPPoE user name.

Example

no user-name

Syntax

schedule { always-on | days <SCHED_DAYS> time <SCHED_TIME_BEGIN> <SCHED_TIME_END> | name <SCHED_NAME> }

Mode

PPPoE IP Assignment

Description

Set the wan pppoe reconnect schedule.

Options

 
always-onAlways on.
 
daysSchedule object days.
<SCHED_DAYS> Days of the week in the form: SU-M-T-W-TH-F-SA.
Example: SU-M-TH-SA
timeSchedule object beginning/ending time.
<SCHED_TIME_BEGIN> Time in the form: DD:DD.
Example: 12:00
<SCHED_TIME_END> Time in the form: DD:DD.
Example: 12:00
 
nameSchedule object name.
<SCHED_NAME> Schedule object name.
Example: Work Hours

Example

schedule name "Work Hours"

Syntax

bridge-to <L2BRIDGE_INTERFACE>

Mode

L2 Bridge

Description

Configure interface to which this interface is bridged to.

Options

<L2BRIDGE_INTERFACE> Interface name.
Example: X0

Example

bridge-to X1

Syntax

block-non-ip

Mode

L2 Bridge

Description

Enable block all non-IP traffic.

Example

block-non-ip

Syntax

no block-non-ip

Mode

L2 Bridge

Description

Disable block all non-IP traffic.

Example

no block-non-ip

Syntax

route-on-bridge-pair

Mode

L2 Bridge

Description

Route traffic on this bridge-pair.

Example

route-on-bridge-pair

Syntax

no route-on-bridge-pair

Mode

L2 Bridge

Description

Never route traffic on this bridge-pair.

Example

no route-on-bridge-pair

Syntax

only-sniff

Mode

L2 Bridge

Description

Enable only sniff traffic on this bridge-pair.

Example

only-sniff

Syntax

no only-sniff

Mode

L2 Bridge

Description

Disable only sniff traffic on this bridge-pair.

Example

no only-sniff

Syntax

stateful-inspection

Mode

L2 Bridge

Description

Enable stateful-inspection on this bridge-pair.

Example

stateful-inspection

Syntax

no stateful-inspection

Mode

L2 Bridge

Description

Disable stateful-inspection on this bridge-pair.

Example

no stateful-inspection

Syntax

bypass-on-malfunction

Mode

L2 Bridge

Description

Set engage physical bypass on malfunction.

Example

bypass-on-malfunction

Syntax

no bypass-on-malfunction

Mode

L2 Bridge

Description

Clear engage physical bypass on malfunction.

Example

no bypass-on-malfunction

Syntax

vlan-filtering-mode { allow | block }

Mode

L2 Bridge

Description

Set VLAN filtering Mode.

Options

 
allowAllow.
 
blockBlock.

Example

vlan-filtering-mode block

Syntax

filtered-vlan <VLAN_FILTER_TAG>

Mode

L2 Bridge

Description

Add specified VLAN to filter.

Options

<VLAN_FILTER_TAG> Filtered VLAN ID list.
Example: 23

Example

filtered-vlan 100

Syntax

no filtered-vlan <VLAN_FILTER_TAG>

Mode

L2 Bridge

Description

Remove specified VLAN from filter.

Options

<VLAN_FILTER_TAG> Filtered VLAN ID list.
Example: 23

Example

no filtered-vlan 100

Syntax

no filtered-vlans

Mode

L2 Bridge

Description

Remove all filtered VLANs.

Example

no filtered-vlans

Syntax

no transparent-range

Mode

Transparent

Description

Clear the WAN addresses that are connected to this interface.

Example

no transparent-range

Syntax

transparent-range { group <WAN_ADDR_GROUP_NAME> | host <WAN_ADDR_HOST> | name <WAN_ADDR_HOST_NETWORK_RANGE_NAME> | network <WAN_ADDR_NETWORK> <ADDR_MASK> | range <WAN_ADDR_BEGIN> <ADDR_END> }

Mode

Transparent

Description

Set the WAN addresses that are connected to this interface.

Options

 
groupSet transparent addresses to named address group.
<WAN_ADDR_GROUP_NAME> WAN group address object name.
Example: Sales Group
 
hostSet transparent address as host address.
<WAN_ADDR_HOST> WAN address object IPv4 host address in the form: D.D.D.D.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameSet transparent addresses to named address object.
<WAN_ADDR_HOST_NETWORK_RANGE_NAME> WAN address object name.
Example: X1 IP
 
networkSet transparent addresses to network address.
<WAN_ADDR_NETWORK> WAN address object IPv4 network in the form: D.D.D.D.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeSet transparent addresses to range of addresses.
<WAN_ADDR_BEGIN> WAN address object IPv4 starting range in the form: D.D.D.D.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

transparent-range name "WAN Transparent Range"

Syntax

gratuitous-arp-wan-forwarding

Mode

Transparent

Description

Enable gratuitous ARP forwarding towards WAN.

Example

gratuitous-arp-wan-forwarding

Syntax

no gratuitous-arp-wan-forwarding

Mode

Transparent

Description

Disable gratuitous ARP forwarding towards WAN.

Example

no gratuitous-arp-wan-forwarding

Syntax

gratuitous-arp-wan-generation

Mode

Transparent

Description

Enable automatic gratuitous ARP generation towards WAN.

Example

gratuitous-arp-wan-generation

Syntax

no gratuitous-arp-wan-generation

Mode

Transparent

Description

Disable automatic gratuitous ARP generation towards WAN.

Example

no gratuitous-arp-wan-generation

Syntax

type { auto-detect | modem | wwan }

Mode

Dialup

WWAN
Modem

Description

Set dialup type and enter configuration mode.

Options

 
auto-detectAuto-detect.
 
modemAnalog Modem.
 
wwanWWAN/Mobile.

Example

type wwan

Syntax

clear dialup data-usage { all | billing-cycle | month | week | year }

Mode

All Modes

Description

Clear dialup information.

Options

data-usageData usage.
 
allSpecify period to clear.
 
billing-cycleSpecify period to clear.
 
monthSpecify period to clear.
 
weekSpecify period to clear.
 
yearSpecify period to clear.

Example

clear dialup data-usage all

Syntax

clear dialup session-history

Mode

All Modes

Description

Clear dialup session history.

Options

session-historyWWAN Session history.

Example

clear dialup session-history

Syntax

connect

Mode

WWAN

Modem

Description

Connect WWAN interface.

Example

connect

Syntax

disconnect

Mode

WWAN

Modem

Description

Disconnect WWAN interface.

Example

disconnect

Syntax

speaker-volume

Mode

Modem

Description

Turn on speaker volume.

Example

speaker-volume

Syntax

no speaker-volume

Mode

Modem

Description

Turn off speaker volume.

Example

no speaker-volume

Syntax

initialize { at-commands <WORD> | use-in <WORD> }

Mode

Modem

Description

Set modem initialization for connection.

Options

 
at-commandsInitialize modem connection using AT commands.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
use-inInitialize mode connections for use in specified country.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

initialize use-in USA

Syntax

connect-on-data [ ntp-packets ] [ gms-heartbeats ] [ system-log-emails ] [ av-profile-updates ] [ snmp-traps ] [ licensed-updates ] [ firmware-update-requests ] [ syslog-traffic ]

Mode

WWAN

Modem

Description

Enable Connect on Data categories.

Options

ntp-packetsNTP packets.
gms-heartbeatsGMS heartbeats.
system-log-emailsSystem log emails.
av-profile-updatesAV profile updates.
snmp-trapsSNMP traps.
licensed-updatesLicensed updates.
firmware-update-requestsFirmware update requests.
syslog-trafficSyslog traffic.

Example

connect-on-data ntp-packets gms-heartbeats

Syntax

no connect-on-data [ ntp-packets ] [ gms-heartbeats ] [ system-log-emails ] [ av-profile-updates ] [ snmp-traps ] [ licensed-updates ] [ firmware-update-requests ] [ syslog-traffic ]

Mode

WWAN

Modem

Description

Disable connect on data categories.

Options

ntp-packetsNTP packets.
gms-heartbeatsGMS heartbeats.
system-log-emailsSystem log emails.
av-profile-updatesAV profile updates.
snmp-trapsSNMP traps.
licensed-updatesLicensed updates.
firmware-update-requestsFirmware update requests.
syslog-trafficSyslog traffic.

Example

no connect-on-data ntp-packets gms-heartbeats

Syntax

management [ http ] [ https ] [ ping ] [ ssh ] [ snmp ]

Mode

WWAN

Modem

Description

Enable management for the specified protocols.

Options

httpHTTP.
httpsHTTPS.
pingPing.
sshSSH.
snmpSNMP.

Example

management https ssh

Syntax

no management [ http ] [ https ] [ ping ] [ ssh ] [ snmp ]

Mode

WWAN

Modem

Description

Disable management for the specified protocols.

Options

httpHTTP.
httpsHTTPS.
pingPing.
sshSSH.
snmpSNMP.

Example

no management https

Syntax

user-login [ http ] [ https ]

Mode

WWAN

Modem

Description

Enable user login for the specified protocols.

Options

httpHTTP.
httpsHTTPS.

Example

user-login http https

Syntax

no user-login [ http ] [ https ]

Mode

WWAN

Modem

Description

Disable user login for the specified protocols.

Options

httpHTTP.
httpsHTTPS.

Example

no user-login http enable

Syntax

https-redirect

Mode

WWAN

Modem

Description

Enable redirection from HTTP to HTTPS.

Example

https-redirect

Syntax

no https-redirect

Mode

WWAN

Modem

Description

Disable redirection from HTTP to HTTPS.

Example

no https-redirect

Syntax

remote-trigger-dialout [ authentication <WORD> | no-authentication ]

Mode

WWAN

Modem

Description

Enable remotely triggered dial-out.

Options

 
authenticationAuthentication required.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
no-authenticationNo authentication required.

Example

remote-trigger-dialout

Syntax

no remote-trigger-dialout

Mode

WWAN

Modem

Description

Disable remotely triggered dial-out.

Example

no remote-trigger-dialout

Syntax

max-hosts <UINT16>

Mode

WWAN

Modem

Description

Set maximum number of host connections.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

max-hosts 100

Syntax

egress-bandwidth-management

Mode

WWAN

Modem

Description

Enable egress gandwidth management.

Example

egress-bandwidth-management

Syntax

no egress-bandwidth-management

Mode

WWAN

Modem

Description

Disable egress bandwidth management.

Example

no egress-bandwidth-management

Syntax

ingress-bandwidth-management

Mode

WWAN

Modem

Description

Enable ingress bandwidth management.

Example

ingress-bandwidth-management

Syntax

no ingress-bandwidth-management

Mode

WWAN

Modem

Description

Disable ingress bandwidth management.

Example

no ingress-bandwidth-management

Syntax

compression-multiplier { 1_0x | 1_5x | 2_0x | 2_5x | 3_0x | 3_5x | 4_0x }

Mode

WWAN

Modem

Description

Set the bandwidth management compression multiplier.

Options

 
1_0xSpecify multiple.
 
1_5xSpecify multiple.
 
2_0xSpecify multiple.
 
2_5xSpecify multiple.
 
3_0xSpecify multiple.
 
3_5xSpecify multiple.
 
4_0xSpecify multiple.

Example

compression-multiplier 3.0x

Syntax

flow-reporting

Mode

WWAN

Modem

Description

Enable flow reporting on the interface.

Example

flow-reporting

Syntax

no flow-reporting

Mode

WWAN

Modem

Description

Disable flow reporting on the interface.

Example

no flow-reporting

Syntax

preferred-profile { [ primary <WORD> ] [ secondary <WORD> ] [ tertiary <WORD> ] }

Mode

WWAN

Modem

Description

Set preferred connection profiles.

Options

primaryPrimary connection profile.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
secondaryAlternate 1 connection profile.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
tertiaryAlternate 2 connection profile.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

preferred-profile primary "Corp Primary Dialup" tertiary "Corp Alternate Dialup"

Syntax

no preferred-profile { [ primary ] [ secondary ] [ tertiary ] }

Mode

WWAN

Modem

Description

Set preferred connection profiles to none.

Options

primaryPrimary connection profile.
secondaryAlternate 1 connection profile.
tertiaryAlternate 2 connection profile.

Example

preferred-profile primary alternate3

Syntax

connection-profile <WORD>

Mode

Modem

Description

Add/Edit connection profile and enter its configuration mode.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

connection-profile "Corp Primary Dialup"

Syntax

connection-profile <WORD>

Mode

WWAN

Description

Add/Edit connection profile and enter its configuration mode.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

connection-profile "Corp Primary Dialup"

Syntax

no connection-profile <WORD>

Mode

WWAN

Modem

Description

Delete connection profile.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

no connection-profile "Corp Primary Dialup"

Syntax

country <WORD>

Mode

WWAN Profile

Description

Set connection profile country.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

country USA

Syntax

provider <WORD>

Mode

WWAN Profile

Description

Set connection profile provider.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

provider AT&T

Syntax

plan-type <WORD>

Mode

WWAN Profile

Description

Set connection profile plan type.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

plan-type standard

Syntax

name <WORD>

Mode

WWAN Profile

Modem Profile

Description

Set connection profile name.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

name "Corp Connection Profile"

Syntax

service-type { cdma-edvo | gprs-edge-hspa }

Mode

WWAN Profile

Description

Set connection profile service type.

Options

 
cdma-edvoCDMA/EDVO.
 
gprs-edge-hspaGPRS/EDGE/HSPA.

Example

service-type cdma-edvo

Syntax

dialed-number <WORD>

Mode

WWAN Profile

Description

Set connection profile dialed number.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

dialed-number *99#

Syntax

primary-dialed-number <WORD>

Mode

Modem Profile

Description

Set connection profile primary dialed number.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

primary-dialed-number 555-555-5555

Syntax

secondary-dialed-number <WORD>

Mode

Modem Profile

Description

Set connection profile secondary dialed number.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

secondary-dialed-number 777-777-7777

Syntax

user-name <WORD>

Mode

WWAN Profile

Modem Profile

Description

Set connection profile user name.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

user-name ISPDA@CINGULARGPRS.COM

Syntax

user-password <WORD>

Mode

WWAN Profile

Modem Profile

Description

Set connection profile user password.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

user-password thisismypassword

Syntax

access-point-name <WORD>

Mode

WWAN Profile

Description

Set connection profile access point name.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

access-point-name ISP.CINGULAR

Syntax

connect-type { connect-on-data | manual | persistent }

Mode

WWAN Profile

Modem Profile

Description

Set connection profile connect type.

Options

 
connect-on-dataConnect on data.
 
manualManual connection.
 
persistentPersistent connection.

Example

connect-type persistent

Syntax

inactivity-disconnect <UINT16>

Mode

WWAN Profile

Modem Profile

Description

Enable and set connection profile inactivity disconnect time in minutes.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

inactivity-disconnect 10

Syntax

no inactivity-disconnect

Mode

WWAN Profile

Modem Profile

Description

Disable connection profile inactivity disconnect time.

Example

no inactivity-disconnect

Syntax

baud-rate { 14400 | 19200 | 2400 | 38400 | 4800 | 57600 | 9600 | auto }

Mode

Modem Profile

Description

Set connection baud rate.

Options

 
14400Baud rate.
 
19200Baud rate.
 
2400Baud rate.
 
38400Baud rate.
 
4800Baud rate.
 
57600Baud rate.
 
9600Baud rate.
 
autoBaud rate.

Example

baud-rate 3600

Syntax

max-connection-time <UINT16>

Mode

WWAN Profile

Modem Profile

Description

Enable and set connection profile maximum connection time in minutes.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

max-connection-time 30

Syntax

no max-connection-time

Mode

WWAN Profile

Modem Profile

Description

Disable connection profile maximum connection time.

Example

no max-connection-time

Syntax

delay-before-reconnect <UINT16>

Mode

WWAN Profile

Modem Profile

Description

Enable and set connection profile delay before reconnect in minutes.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

delay-before-reconnect 2

Syntax

call-waiting

Mode

Modem Profile

Description

Enable call waiting.

Example

call-waiting

Syntax

no call-waiting

Mode

Modem Profile

Description

Disable call waiting.

Example

no call-waiting

Syntax

call-wait-string { *70 | 1170 | 70 | other <WORD> }

Mode

Modem Profile

Description

Set call waiting string.

Options

 
*70Call wait string.
 
1170Call wait string.
 
70Call wait string.
 
otherCustom call waiting string.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

call-wait-string "*70"

Syntax

dial-retries <UINT16>

Mode

WWAN Profile

Modem Profile

Description

Enable and set connection profile dial retries per phone number.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

dial-retries 3

Syntax

no dial-retries

Mode

WWAN Profile

Modem Profile

Description

Disable connection profile dial retries per phone number.

Example

no dial-retries

Syntax

delay-between-retries <UINT32>

Mode

WWAN Profile

Modem Profile

Description

Enable and set connection profile delay between retries in minutes.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

delay-between-retries 5

Syntax

no delay-between-retries

Mode

WWAN Profile

Modem Profile

Description

Disable connection profile delay-between-retries.

Example

no delay-between-retries

Syntax

vpn-when-dialed

Mode

WWAN Profile

Modem Profile

Description

VPN remains enabled when dialed.

Example

vpn-when-dialed

Syntax

no vpn-when-dialed

Mode

WWAN Profile

Modem Profile

Description

Disable VPN when dialed.

Example

no vpn-when-dialed

Syntax

force-pap

Mode

WWAN Profile

Description

Enable force PAP authentication.

Example

force-pap

Syntax

no force-pap

Mode

WWAN Profile

Description

Disable force PAP authentication.

Example

no force-pap

Syntax

ip-assignment { automatic | static <IPV4_HOST> }

Mode

WWAN Profile

Modem Profile

Description

Set IP address manually or if obtained automatically.

Options

 
automaticObtain an IP address automatically.
 
staticSpecify IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

ip-assignment static 204.16.16.1

Syntax

dns-assignment { { [ primary <IPV4_HOST> ] [ secondary <IPV4_HOST> ] } | automatic }

Mode

WWAN Profile

Modem Profile

Description

Set whether DNS obtained automatically or set manually with the associated DNS server IP addresses.

Options

 
primarySpecify primary DNS server IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
secondarySpecify secondary DNS server IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
 
automaticObtain an IP address of DNS servers automatically.

Example

dns-assignment primary 4.2.2.1 secondary 4.2.2.2

Syntax

schedule [ sun <TIME_HHMM> <TIME_HHMM> ] [ mon <TIME_HHMM> <TIME_HHMM> ] [ tue <TIME_HHMM> <TIME_HHMM> ] [ wed <TIME_HHMM> <TIME_HHMM> ] [ thu <TIME_HHMM> <TIME_HHMM> ] [ fri <TIME_HHMM> <TIME_HHMM> ] [ sat <TIME_HHMM> <TIME_HHMM> ]

Mode

WWAN Profile

Modem Profile

Description

Enable and set the schedule when the modem can connect during.

Options

sunDay of the week.
<TIME_HHMM> Time in the form: DD:DD.
Example: 12:00
<TIME_HHMM> Time in the form: DD:DD.
Example: 12:00
monDay of the week.
<TIME_HHMM> Time in the form: DD:DD.
Example: 12:00
<TIME_HHMM> Time in the form: DD:DD.
Example: 12:00
tueDay of the week.
<TIME_HHMM> Time in the form: DD:DD.
Example: 12:00
<TIME_HHMM> Time in the form: DD:DD.
Example: 12:00
wedDay of the week.
<TIME_HHMM> Time in the form: DD:DD.
Example: 12:00
<TIME_HHMM> Time in the form: DD:DD.
Example: 12:00
thuDay of the week.
<TIME_HHMM> Time in the form: DD:DD.
Example: 12:00
<TIME_HHMM> Time in the form: DD:DD.
Example: 12:00
friDay of the week.
<TIME_HHMM> Time in the form: DD:DD.
Example: 12:00
<TIME_HHMM> Time in the form: DD:DD.
Example: 12:00
satDay of the week.
<TIME_HHMM> Time in the form: DD:DD.
Example: 12:00
<TIME_HHMM> Time in the form: DD:DD.
Example: 12:00

Example

schedule mon 8:00 18:00 wed 9:00 17:00

Syntax

no schedule

Mode

WWAN Profile

Description

Disable the schedule when the modem can connect during.

Example

no schedule

Syntax

data-usage-limiting [ billing-start <UINT8> ] [ limit <UINT32> ] [ units { gb | kb | mb | minutes } ]

Mode

WWAN Profile

Description

Enable and set data usage limiting.

Options

billing-startSet billing start date.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
limitSet data usage limit.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123
unitsSet units for data usage limit.
 
gbGigabytes.
 
kbKilobytes.
 
mbMegabytes.
 
minutesMinutes.

Example

data-usage-limiting

Syntax

no data-usage-limiting

Mode

WWAN Profile

Description

Disable data usage limiting.

Example

no data-usage-limiting

Syntax

chat-script <WORD>

Mode

WWAN Profile

Modem Profile

Description

Set chat script.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

chat-script ???

Syntax

no chat-script

Mode

WWAN Profile

Modem Profile

Description

Clear chat script.

Example

no chat-script

Syntax

no arp entry <ARP_IPV4_HOST> <ARP_MAC> <ARP_INTERFACE>

Mode

Config

Description

Deletes an ARP entry.

Options

<ARP_IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
<ARP_MAC> MAC address in the form: HH:HH:HH:HH:HH:HH OR HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD
<ARP_INTERFACE> Interface name.
Example: X0

Example

no arp entry 10.10.10.10 00:01:02:03:04:05 X0

Syntax

no arp entries

Mode

Config

Description

Deletes all ARP entries.

Example

no arp entries

Syntax

arp entry <ARP_IPV4_HOST> <ARP_MAC> <ARP_INTERFACE>

Mode

Config

Description

Add/edit an ARP entry.

Options

<ARP_IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
<ARP_MAC> MAC address in the form: HH:HH:HH:HH:HH:HH OR HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD
<ARP_INTERFACE> Interface name.
Example: X0

Example

arp entry 10.10.10.10 00:01:02:03:04:05 X0

Syntax

ip <ARP_IPV4_HOST>

Mode

Static ARP

Description

Configure static ARP IP.

Options

<ARP_IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

ip 10.10.10.10

Syntax

mac <ARP_MAC>

Mode

Static ARP

Description

Configure static ARP MAC address.

Options

<ARP_MAC> MAC address in the form: HH:HH:HH:HH:HH:HH OR HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD

Example

mac 00:01:02:03:04:05

Syntax

interface <ARP_INTERFACE>

Mode

Static ARP

Description

Configure static ARP interface.

Options

<ARP_INTERFACE> Interface name.
Example: X0

Example

interface X0

Syntax

publish

Mode

Static ARP

Description

Publish ARP entry.

Example

publish

Syntax

no publish

Mode

Static ARP

Description

Disable publishing of ARP entry.

Example

no publish

Syntax

bind-mac [ dynamic ]

Mode

Static ARP

Description

Enable MAC binding.

Options

dynamicEnable automatic update of IP address.

Example

bind-mac

Syntax

no bind-mac [ dynamic ]

Mode

Static ARP

Description

Disable MAC binding.

Options

dynamicDisable automatic update of IP address.

Example

no bind-mac

Syntax

clear arp cache entries

Mode

Config

Description

Clear all non-permanent entries.

Example

clear arp cache entries

Syntax

clear arp cache entry <ARP_FLUSH_IPV4_HOST> <ARP_FLUSH_INTERFACE>

Mode

Config

Description

Clear an ARP entry.

Options

<ARP_FLUSH_IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
<ARP_FLUSH_INTERFACE> Interface name.
Example: X0

Example

clear arp cache entry 10.10.10.10 X0

Syntax

arp timeout <UINT16>

Mode

Config

Description

Set the ARP cache entry timeout in minutes.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

arp timeout 10

Syntax

arp glean

Mode

Config

Description

Enable glean source data from ARP requests.

Example

arp glean

Syntax

no arp glean

Mode

Config

Description

Disable glean source data from ARP requests.

Example

no arp glean

Syntax

dns server [ ipv6 ] { inherit | primary <HOST_IP> | secondary <HOST_IP> | tertiary <HOST_IP> }

Mode

Config

Description

Set DNS server.

Options

ipv6Set IPv6 DNS server
 
inheritInherit DNS servers.
 
primarySpecify primary DNS server IP address.
<HOST_IP> IPV4: IPv4 host address in the form: D.D.D.D\nIPV6: IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
secondarySpecify secondary DNS server IP address.
<HOST_IP> IPV4: IPv4 host address in the form: D.D.D.D\nIPV6: IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
tertiarySpecify tertiary DNS server IP address.
<HOST_IP> IPV4: IPv4 host address in the form: D.D.D.D\nIPV6: IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n

Example

dns server primary 192.168.168.165

dns server secondary 192.168.168.165
dns server tertiary 192.168.168.165
dns server inherit
dns server ipv6 primary fe80::0001
dns server ipv6 secondary fe80::0001
dns server ipv6 tertiary fe80::0001
dns server ipv6 inherit

Syntax

no dns server [ ipv6 ] { primary | secondary | tertiary }

Mode

Config

Description

Clear the DNS server IP address.

Options

ipv6Clear IPv6 DNS server
 
primaryClear the primary DNS server IP address.
 
secondaryClear the secondary DNS server IP address.
 
tertiaryClear the tertiary DNS server IP address.

Example

no dns server primary

no dns server secondary
no dns server tertiary
no dns server ipv6 primary
no dns server ipv6 secondary
no dns server ipv6 tertiary

Syntax

dns rebinding [ action { drop-dns-reply | log-attack-only | return-query-refused } ] [ allowed-domains { fqdn <ADDR_FQDN> | group <ADDR_CUSTOM_FQDN_GROUP> | name <ADDR_FQDN_NAME> } ]

Mode

Config

Description

Enable and configure DNS rebinding attack prevention.

Options

actionSet action when experiencing attack.
 
drop-dns-replyLog the attack and drop the DNS reply.
 
log-attack-onlyLog the attack only.
 
return-query-refusedLog the attack and return a query refused reply.
allowed-domainsSpecify the domains for which checking is not done.
 
fqdnCreate FQDN address object with same name as defined.
<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
groupSpecify FQDN group name.
<ADDR_CUSTOM_FQDN_GROUP> Custom FQDN group address object name.
Example: Forbidden Domains
 
nameSpecify FQDN address object name.
<ADDR_FQDN_NAME> FQDN address object name.
Example: www.example.com

Example

dns rebinding action drop-dns-reply allowed-domains name "DNS RAP WHITELIST"

Syntax

no dns rebinding [ allowed-domains ]

Mode

Config

Description

Disable DNS rebinding attack prevention.

Options

allowed-domainsClear DNS rebinding allowed domains.

Example

no dns rebinding

Syntax

dns fqdn-binding

Mode

Config

Description

Enable FQDN object only cache DNS reply from sanctioned server.

Example

dns fqdn-binding

Syntax

no dns fqdn-binding

Mode

Config

Description

Disable FQDN object only cache DNS reply from sanctioned server.

Example

no dns fqdn-binding

Syntax

clear dns cache [ interface-reverse ]

Mode

Config

Description

Clear DNS cache.

Options

interface-reverseClear interface names reverse DNS cache.

Example

clear dns cache

Syntax

no dynamic-dns profile <DDNS_PROFILE_NAME>

Mode

Config

Description

Deletes a dynamic DNS profile.

Options

<DDNS_PROFILE_NAME> Dynamic DNS profile name.
Example: mydns

Example

no dynamic-dns profile "abc"

Syntax

no dynamic-dns profiles

Mode

Config

Description

Deletes all dynamic DNS profiles.

Example

no dynamic-dns profiles

Syntax

dynamic-dns profile <DDNS_PROFILE_NAME>

Mode

Config

Description

Add/edit a dynamic DNS profile.

Options

<DDNS_PROFILE_NAME> Dynamic DNS profile name.
Example: mydns

Example

dynamic-dns profile CorpNoIP

Syntax

profile-name <DDNS_PROFILE_NAME>

Mode

Dynamic DNS

Description

Edit a dynamic DNS profile name.

Options

<DDNS_PROFILE_NAME> Dynamic DNS profile name.
Example: mydns

Example

profile-name CorpNoIP

Syntax

enable

Mode

Dynamic DNS

Description

Enable dynamic DNS profile.

Example

enable

Syntax

no enable

Mode

Dynamic DNS

Description

Disable dynamic DNS profile.

Example

no enable

Syntax

use-online

Mode

Dynamic DNS

Description

Enable use online settings.

Example

use-online

Syntax

no use-online

Mode

Dynamic DNS

Description

Disable use online settings.

Example

no use-online

Syntax

provider { changeip | dyndns | noip | yi }

Mode

Dynamic DNS

Description

Select dynamic DNS provider.

Options

 
changeipchangeip.com.
 
dyndnsDynDNS.org.
 
noipNo-IP.com.
 
yiyi.org.

Example

provider noip

Syntax

user-name <WORD>

Mode

Dynamic DNS

Description

Set dynamic DNS user name.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

user-name ddnsadmin

Syntax

no user-name

Mode

Dynamic DNS

Description

Clear dynamic DNS user name.

Example

no user-name

Syntax

password <ENC_PASSWORD>

Mode

Dynamic DNS

Description

Set dynamic DNS password.

Options

<ENC_PASSWORD> Password.
Example: secret

Example

password thisisasecret

Syntax

no password

Mode

Dynamic DNS

Description

Clear dynamic DNS password.

Example

no password

Syntax

domain <HOSTNAME>

Mode

Dynamic DNS

Description

Set dynamic DNS domain.

Options

<HOSTNAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com

Example

domain testsite.hopto.org

Syntax

no domain

Mode

Dynamic DNS

Description

Clear dynamic DNS domain.

Example

no domain

Syntax

bound-to { any | interface <WAN_INTERFACE> }

Mode

Dynamic DNS

Description

Set dynamic DNS WAN interface to bind to.

Options

 
anyAny interface.
 
interfaceSpecify interface.
<WAN_INTERFACE> WAN interface name.
Example: X1

Example

bound-to interface X1

Syntax

online-settings { detect | manual <IPV4_HOST> | set-to-wan }

Mode

Dynamic DNS

Description

Configure dynamic DNS online settings.

Options

 
detectLet the dynamic DNS provider detect the IP address.
 
manualSpecify the IP address manually.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
 
set-to-wanAutomatically set the IP address to the primary WAN IP address.

Example

online-settings manual 10.10.10.10

Syntax

offline-settings { do-nothing | make-host-unknown | manual <IPV4_HOST> | use-previous }

Mode

Dynamic DNS

Description

Configure dynamic DNS offline settings.

Options

 
do-nothingAllows the previously registered IP address to remain current with the Provider.
 
make-host-unknownLet the dynamic DNS provider detect the IP address.
 
manualSpecify the IP address manually.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
 
use-previousUse the off-line IP address previously configured at the provider's site.

Example

offline-settings manual 10.10.10.10

Syntax

service-type { custom | dynamic | static }

Mode

Dynamic DNS

Description

Configure dynamic DNS service type.

Options

 
customCustom.
 
dynamicDynamic.
 
staticStatic.

Example

service-type static

Syntax

wildcard

Mode

Dynamic DNS

Description

Enable Wildcard.

Example

wildcard

Syntax

no wildcard

Mode

Dynamic DNS

Description

Disable wildcard.

Example

no wildcard

Syntax

mail-exchanger <HOSTNAME>

Mode

Dynamic DNS

Description

Enter address of mail exchanger.

Options

<HOSTNAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com

Example

mail-exchanger example.com

Syntax

no mail-exchanger

Mode

Dynamic DNS

Description

Clear address of mail exchanger.

Example

no mail-exchanger

Syntax

backup-mx

Mode

Dynamic DNS

Description

Enable backup MX.

Example

backup-mx

Syntax

no backup-mx

Mode

Dynamic DNS

Description

Disable backup MX.

Example

no backup-mx

Syntax

dhcp-server [ ipv6 ]

Mode

Config

Description

Enter DHCP server configuration mode.

Options

ipv6Enter IPv6 DHCP server configuration mode.

Example

dhcp-server

Syntax

enable

Mode

DHCP Server

Description

Enable DHCP server.

Example

enable

Syntax

no enable

Mode

DHCP Server

Description

Disable DHCP server.

Example

no enable

Syntax

conflict-detection

Mode

DHCP Server

Description

Enable DHCP server conflict detection.

Example

conflict-detection

Syntax

no conflict-detection

Mode

DHCP Server

Description

Disable DHCP server conflict detection.

Example

no conflict-detection

Syntax

persistence [ monitoring-interval <UINT16> ]

Mode

DHCP Server

Description

Enable/configure DHCP server persistence.

Options

monitoring-intervalSet DHCP server persistence monitoring interval in minutes.
<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

persistence

Syntax

no persistence

Mode

DHCP Server

Description

Disable DHCP server persistence.

Example

no persistence

Syntax

scope dynamic <SCOPE_START_IPV4_HOST> <SCOPE_END_IPV4_HOST>

Mode

DHCP Server

Description

Add/edit dynamic DHCP scope and enter its configuration mode.

Options

<SCOPE_START_IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
<SCOPE_END_IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

scope dynamic 192.168.168.100 192.168.168.200

Syntax

no scope dynamic <SCOPE_START_IPV4_HOST> <SCOPE_END_IPV4_HOST>

Mode

DHCP Server

Description

Delete dynamic DHCP scope.

Options

<SCOPE_START_IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
<SCOPE_END_IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

no scope dynamic 192.168.168.100 192.168.168.200

Syntax

scope static <STATIC_SCOPE_IPV4_HOST> <STATIC_SCOPE_MAC>

Mode

DHCP Server

Description

Add/edit static DHCP scope and enter its configuration mode.

Options

<STATIC_SCOPE_IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
<STATIC_SCOPE_MAC> MAC address in the form: HH:HH:HH:HH:HH:HH OR HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD

Example

scope static 192.168.168.101 00:01:02:03:04:05

Syntax

no scope static <STATIC_SCOPE_IPV4_HOST> <STATIC_SCOPE_MAC>

Mode

DHCP Server

Description

Delete static DHCP scope.

Options

<STATIC_SCOPE_IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
<STATIC_SCOPE_MAC> MAC address in the form: HH:HH:HH:HH:HH:HH OR HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD

Example

no scope static 192.168.168.101 00:01:02:03:04:05

Syntax

no scopes dynamic

Mode

DHCP Server

Description

Delete all dynamic DHCP scopes.

Example

no scopes dynamic

Syntax

no scopes static

Mode

DHCP Server

Description

Delete all static DHCP entries.

Example

no scopes static

Syntax

no scopes

Mode

DHCP Server

Description

Delete all DHCP server lease scopes.

Example

no scopes

Syntax

no lease <DHCP_LEASE_IPV4_HOST>

Mode

DHCP Server

Description

Delete DHCP server lease.

Options

<DHCP_LEASE_IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

no lease 1.1.1.1

Syntax

no leases

Mode

DHCP Server

Description

Delete all DHCP server leases.

Example

no leases

Syntax

option object <DHCP_OPTION_OBJECT>

Mode

DHCP Server

Description

Add/edit DHCP server option object and enter its configuration mode.

Options

<DHCP_OPTION_OBJECT> DHCP server option object name.
Example: Corp Network DHCP Options

Example

option object "LAN Specific DHCP Option"

Syntax

no option object <DHCP_OPTION_OBJECT>

Mode

DHCP Server

Description

Delete DHCP server option object.

Options

<DHCP_OPTION_OBJECT> DHCP server option object name.
Example: Corp Network DHCP Options

Example

no option object "LAN Specific DHCP Option"

Syntax

no option objects

Mode

DHCP Server

Description

Delete all DHCP server option objects.

Example

no option objects

Syntax

option group <DHCP_OPTION_GROUP>

Mode

DHCP Server

Description

Add/edit DHCP server option group and enter its configuration mode.

Options

<DHCP_OPTION_GROUP> DHCP server option group name.
Example: Corp Network DHCP Group

Example

option group "LAN Specific DHCP Options"

Syntax

no option group <DHCP_OPTION_GROUP>

Mode

DHCP Server

Description

Delete DHCP server option group.

Options

<DHCP_OPTION_GROUP> DHCP server option group name.
Example: Corp Network DHCP Group

Example

no option group "LAN Specific DHCP Options"

Syntax

no option groups

Mode

DHCP Server

Description

Delete all DHCP server option groups.

Example

no option groups

Syntax

trusted-relay-agents <ADDR_DHCP_TRUSTED_RELAY_AGENT_GROUP>

Mode

DHCP Server

Description

Enable and set trusted DHCP relay agent list.

Options

<ADDR_DHCP_TRUSTED_RELAY_AGENT_GROUP> Group address object name.
Example: Default Trusted Relay Agent List

Example

trusted-relay-agents "Trusted Relay Agents"

Syntax

no trusted-relay-agents

Mode

DHCP Server

Description

Disable trusted DHCP relay agent list.

Example

no trusted-relay-agents

Syntax

enable

Mode

Dynamic Scope

Description

Enable dynamic DHCP scope.

Example

enable

Syntax

no enable

Mode

Dynamic Scope

Description

Disable dynamic DHCP scope.

Example

no enable

Syntax

range <IPV4_HOST> <IPV4_HOST>

Mode

Dynamic Scope

Description

Set DHCP dynamic scope range.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

range 192.168.168.100 192.168.168.200

Syntax

lease-time <UINT16>

Mode

Dynamic Scope

Description

Set dynamic DHCP scope lease time.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

lease-time 1440

Syntax

default-gateway <IPV4_HOST>

Mode

Dynamic Scope

Description

Set dynamic DHCP scope default gateway.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

default-gateway 192.168.168.254

Syntax

netmask <IPV4_MASK>

Mode

Dynamic Scope

Description

Set dynamic DHCP scope subnet mask.

Options

<IPV4_MASK> IPV4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D.
Example: 255.255.255.0

Example

netmask 255.255.255.0

Syntax

comment <WORD>

Mode

Dynamic Scope

Description

Set dynamic DHCP scope comment.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

comment "my dynamic scope"

Syntax

no comment

Mode

Dynamic Scope

Description

Clear dynamic DHCP scope comment.

Example

no comment

Syntax

allow-bootp

Mode

Dynamic Scope

Description

Enable allow BOOTP clients to use range.

Example

allow-bootp

Syntax

no allow-bootp

Mode

Dynamic Scope

Description

Disable allow BOOTP clients to use range.

Example

no allow-bootp

Syntax

domain-name <HOSTNAME>

Mode

Dynamic Scope

Description

Set DHCP domain name.

Options

<HOSTNAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com

Example

domain-name example.com

Syntax

no domain-name

Mode

Dynamic Scope

Description

Clear DHCP domain name.

Example

no domain-name

Syntax

dns server { inherit | primary <IPV4_HOST> | secondary <IPV4_HOST> | tertiary <IPV4_HOST> }

Mode

Dynamic Scope

Description

Manually set DNS settings or inherit DNS settings dynamically from the sonicwall's DNS settings.

Options

 
inheritInherit DNS servers.
 
primarySpecify primary DNS server IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
 
secondarySpecify secondary DNS server IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
 
tertiarySpecify tertiary DNS server IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

dns server primary 192.168.168.165

dns server inherit

Syntax

no dns server { primary | secondary | tertiary }

Mode

Dynamic Scope

Description

Manually clear DNS server IP address.

Options

 
primaryClear primary DNS server IP address.
 
secondaryClear secondary DNS server IP address.
 
tertiaryClear tertiary DNS server IP address.

Example

no dns server primary

Syntax

wins { primary <IPV4_HOST> | secondary <IPV4_HOST> }

Mode

Dynamic Scope

Description

Set the WINS server IP address.

Options

 
primaryPrimary WINS server IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
 
secondarySecondary WINS server IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

wins primary 192.168.168.169

Syntax

no wins { primary | secondary }

Mode

Dynamic Scope

Description

Clear the WINS server IP address.

Options

 
primaryPrimary WINS server IP address.
 
secondarySecondary WINS server IP address.

Example

no wins primary

Syntax

call-manager { primary <WORD> | secondary <WORD> | tertiary <WORD> }

Mode

Dynamic Scope

Description

Set VOIP call managers.

Options

 
primarySpecify primary VOIP call manager IP address.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
secondarySpecify secondary VOIP call manager IP address.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
tertiarySpecify tertiary VOIP call manager address.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

call-manager primary 192.168.168.161

Syntax

no call-manager { primary | secondary | tertiary }

Mode

Dynamic Scope

Description

Clear VOIP call managers.

Options

 
primaryClear primary VOIP call manager IP address.
 
secondaryClear secondary VOIP call manager IP address.
 
tertiaryClear tertiary VOIP call manager address.

Example

no call-manager primary

Syntax

network-boot { boot-file <WORD> | next-server <IPV4_HOST> | server-name <WORD> }

Mode

Dynamic Scope

Description

Set network boot parameters.

Options

 
boot-fileSpecify boot file.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
next-serverSpecify next server.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
 
server-nameSpecify server name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

network-boot next-server 192.168.168.161

Syntax

no network-boot { boot-file | next-server | server-name }

Mode

Dynamic Scope

Description

Clear network boot parameters.

Options

 
boot-fileClear boot file.
 
next-serverClear next server.
 
server-nameClear server name.

Example

no network-boot next-server

Syntax

no generic-option

Mode

Dynamic Scope

Description

Clear DHCP generic option group.

Example

no generic-option

Syntax

generic-option { group <DHCP_OPTION_GROUP> | object <DHCP_OPTION_OBJECT> }

Mode

Dynamic Scope

Description

Set DHCP generic option group.

Options

 
groupSpecify generic option group.
<DHCP_OPTION_GROUP> DHCP server option group name.
Example: Corp Network DHCP Group
 
objectSpecify generic option object.
<DHCP_OPTION_OBJECT> DHCP server option object name.
Example: Corp Network DHCP Options

Example

generic-option object "NetServers"

Syntax

always-send-option

Mode

Dynamic Scope

Description

Enable send generic options always.

Example

always-send-option

Syntax

no always-send-option

Mode

Dynamic Scope

Description

Disable send generic options always.

Example

no always-send-option

Syntax

enable

Mode

Static Scope

Description

Enable static DHCP server scope.

Example

enable

Syntax

no enable

Mode

Static Scope

Description

Disable DHCP server scope.

Example

no enable

Syntax

name <WORD>

Mode

Static Scope

Description

Set DHCP static scope name.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

name "My Domain Server"

Syntax

no name

Mode

Static Scope

Description

Clear DHCP static scope name.

Example

no name

Syntax

ip <IPV4_HOST>

Mode

Static Scope

Description

Set DHCP static scope IP address.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

ip 10.10.10.10

Syntax

mac <MAC>

Mode

Static Scope

Description

Set DHCP static scope ethernet address.

Options

<MAC> MAC address in the form: HH:HH:HH:HH:HH:HH OR HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD

Example

mac 00:01:02:03:04:05

Syntax

lease-time <UINT16>

Mode

Static Scope

Description

Set DHCP static scope lease time.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

lease-time 1440

Syntax

default-gateway <IPV4_HOST>

Mode

Static Scope

Description

Set DHCP static scope default gateway.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

default-gateway 192.168.168.254

Syntax

netmask <IPV4_MASK>

Mode

Static Scope

Description

Set DHCP static scope subnet mask.

Options

<IPV4_MASK> IPV4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D.
Example: 255.255.255.0

Example

netmask 255.255.255.0

Syntax

comment <WORD>

Mode

Static Scope

Description

Set DHCP static scope comment.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

comment "my static scope"

Syntax

no comment

Mode

Static Scope

Description

Clear DHCP static scope comment.

Example

no comment

Syntax

domain-name <HOSTNAME>

Mode

Static Scope

Description

Set DHCP domain name.

Options

<HOSTNAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com

Example

domain-name example.com

Syntax

no domain-name

Mode

Static Scope

Description

Clear DHCP domain name.

Example

no domain-name

Syntax

dns server { inherit | primary <IPV4_HOST> | secondary <IPV4_HOST> | tertiary <IPV4_HOST> }

Mode

Static Scope

Description

Manually set DNS settings or inherit DNS settings dynamically from the sonicwall's DNS settings.

Options

 
inheritInherit DNS servers.
 
primarySpecify primary DNS server IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
 
secondarySpecify secondary DNS server IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
 
tertiarySpecify tertiary DNS server IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

dns server primary 192.168.168.165

Syntax

no dns server { primary | secondary | tertiary }

Mode

Static Scope

Description

Manually clear DNS server IP address.

Options

 
primaryClear primary DNS server IP address.
 
secondaryClear secondary DNS server IP address.
 
tertiaryClear tertiary DNS server IP address.

Example

no dns server primary

Syntax

wins { primary <IPV4_HOST> | secondary <IPV4_HOST> }

Mode

Static Scope

Description

Set the WINS server IP address.

Options

 
primaryPrimary WINS server IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
 
secondarySecondary WINS server IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

wins primary 192.168.168.169

Syntax

no wins { primary | secondary }

Mode

Static Scope

Description

Clear the WINS server IP address.

Options

 
primaryPrimary WINS server IP address.
 
secondarySecondary WINS server IP address.

Example

no wins primary

Syntax

call-manager { primary <HOSTNAME> | secondary <WORD> | tertiary <WORD> }

Mode

Static Scope

Description

Set VOIP call managers.

Options

 
primarySpecify primary VOIP call manager IP address.
<HOSTNAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com
 
secondarySpecify secondary VOIP call manager IP address.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
tertiarySpecify tertiary VOIP call manager address.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

call-manager manual primary 192.168.168.161

Syntax

no call-manager { primary | secondary | tertiary }

Mode

Static Scope

Description

Clear VOIP call managers.

Options

 
primaryClear primary VOIP call manager IP address.
 
secondaryClear secondary VOIP call manager IP address.
 
tertiaryClear tertiary VOIP call manager address.

Example

no call-manager primary

Syntax

network-boot { boot-file <WORD> | next-server <IPV4_HOST> | server-name <WORD> }

Mode

Static Scope

Description

Set network boot parameters.

Options

 
boot-fileSpecify boot file.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
next-serverSpecify next server.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
 
server-nameSpecify server name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

network-boot next-server 192.168.168.161

Syntax

no network-boot { boot-file | next-server | server-name }

Mode

Static Scope

Description

Clear network boot parameters.

Options

 
boot-fileClear boot file.
 
next-serverClear next server.
 
server-nameClear server name.

Example

no network-boot next-server

Syntax

no generic-option

Mode

Static Scope

Description

Clear DHCP generic option group.

Example

no generic-option

Syntax

generic-option { group <DHCP_OPTION_GROUP> | object <DHCP_OPTION_OBJECT> }

Mode

Static Scope

Description

Set DHCP generic option group.

Options

 
groupSpecify generic option group.
<DHCP_OPTION_GROUP> DHCP server option group name.
Example: Corp Network DHCP Group
 
objectSpecify generic option object.
<DHCP_OPTION_OBJECT> DHCP server option object name.
Example: Corp Network DHCP Options

Example

generic-option object "NetServers"

Syntax

always-send-option

Mode

Static Scope

Description

Enable send generic options always.

Example

always-send-option

Syntax

no always-send-option

Mode

Static Scope

Description

Disable send generic options always.

Example

no always-send-option

Syntax

name <DHCP_OPTION_OBJECT>

Mode

DHCP Option

Description

Set DHCP server option object name.

Options

<DHCP_OPTION_OBJECT> DHCP server option object name.
Example: Corp Network DHCP Options

Example

name "LAN Specific DHCP Option"

Syntax

number <UINT8>

Mode

DHCP Option

Description

Set DHCP server option object number.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

number 53

Syntax

array

Mode

DHCP Option

Description

Enable DHCP server option array.

Example

array

Syntax

no array

Mode

DHCP Option

Description

Disable DHCP server option array.

Example

no array

Syntax

no value

Mode

DHCP Option

Description

Clear DHCP server option object value.

Example

no value

Syntax

value { boolean <UINT8> | domain-name <HOSTNAME> | four-byte <UINT32> | ip <IPV4_HOST> | one-byte <UINT8> | string <WORD> | two-byte <UINT16> }

Mode

DHCP Option

Description

Set DHCP server option object value.

Options

 
booleanOption object type: boolean.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
 
domain-nameOption object type: domain name.
<HOSTNAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com
 
four-byteOption object type: four byte.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123
 
ipOption object type: IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
 
one-byteOption object type: one byte.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
 
stringOption object type: string.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
two-byteOption object type: two byte.
<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

value ip 192.168.168.168

Syntax

name <DHCP_OPTION_GROUP>

Mode

DHCP Option Group

Description

Set DHCP server option group name.

Options

<DHCP_OPTION_GROUP> DHCP server option group name.
Example: Corp Network DHCP Group

Example

name "LAN Specific DHCP Option"

Syntax

option object <DHCP_OPTION_OBJECT>

Mode

DHCP Option Group

Description

Add DHCP server option object to group.

Options

<DHCP_OPTION_OBJECT> DHCP server option object name.
Example: Corp Network DHCP Options

Example

option object "LAN Specific DHCP Option"

Syntax

no option object <DHCP_OPTION_GROUP_OBJECT>

Mode

DHCP Option Group

Description

Remove DHCP server option object from group.

Options

<DHCP_OPTION_GROUP_OBJECT> DHCP server option object name in specify option group.
Example: Corp Network DHCP Group

Example

no option object "LAN Specific DHCP Option"

Syntax

option group <DHCP_OPTION_GROUP>

Mode

DHCP Option Group

Description

Add DHCP server option group to group.

Options

<DHCP_OPTION_GROUP> DHCP server option group name.
Example: Corp Network DHCP Group

Example

option group group1

Syntax

no option group <DHCP_OPTION_GROUP_GROUP>

Mode

DHCP Option Group

Description

Remove DHCP server option group from group.

Options

<DHCP_OPTION_GROUP_GROUP> DHCP server option group name in specify option group.
Example: Corp Network DHCP Group

Example

no option group group1

Syntax

clear failover-lb statistics

Mode

All Modes (
excluding Top Level)

Description

Reset failover and load balancing statistics.

Example

clear failover-lb statistics

Syntax

failover-lb

Mode

Config

Description

Enter failover and load balancing configuration mode.

Example

failover-lb

Syntax

enable

Mode

Failover & LB

Description

Enable failover and load balancing.

Example

enable

Syntax

no enable

Mode

Failover & LB

Description

Disable failover and load balancing.

Example

no enable

Syntax

respond-to-probes [ any-tcp-syn port <IPV4_PORT> | disable-any-tcp-syn ]

Mode

Failover & LB

Description

Enable respond to probes.

Options

 
any-tcp-synEnable responding to any TCP SYN.
portTCP port.
<IPV4_PORT> Integer in the form: D OR 0xHHHH.
Example: 80
 
disable-any-tcp-synDisable responding to any TCP SYN.

Example

respond-to-probes any-tcp-syn port 8080

Syntax

no respond-to-probes

Mode

Failover & LB

Description

Disable respond to probes.

Example

no respond-to-probes

Syntax

group <FLB_GROUP_NAME>

Mode

Failover & LB

Description

Add/Edit load balancing group.

Options

<FLB_GROUP_NAME> Failover & LB group name.
Example: myFLBGroup

Example

group " Default LB Group"

Syntax

type { basic | ratio | round-robin | spillover }

Mode

LB Group

Description

Configure failover and load balancing type.

Options

 
basicConnection use primary member unless failover occurs.
 
ratioConnections use members according to the set percentages.
 
round-robinConnections cycle through members in round robin fashion.
 
spilloverConnections use primary member until bandwidth is exceeded.

Example

type round-robin

Syntax

preempt

Mode

LB Group

Description

Enable preempt and failback to preferred member when possible.

Example

preempt

Syntax

no preempt

Mode

LB Group

Description

Disable preempt and failback to preferred member when possible.

Example

no preempt

Syntax

spillover-bandwidth <UINT32>

Mode

LB Group

Description

Set the bandwidth at which spill-over occurs in Kbps.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

spillover-bandwidth 1000

Syntax

address-binding

Mode

LB Group

Description

Enable use source and destination IP address binding.

Example

address-binding

Syntax

no address-binding

Mode

LB Group

Description

Disable use source and destination IP address binding.

Example

no address-binding

Syntax

auto-adjust-ratio

Mode

LB Group

Description

Automatically adjust all member ratios so total is 100%.

Example

auto-adjust-ratio

Syntax

interface <FLB_GROUP_MEMBER>

Mode

LB Group

Description

Edit interface load balancing group member.

Options

<FLB_GROUP_MEMBER> WAN interface name.
Example: X0

Example

interface X2

Syntax

no interface <FLB_CURRENT_GROUP_MEMBER>

Mode

LB Group

Description

Remove interface load balancing group member.

Options

<FLB_CURRENT_GROUP_MEMBER> Group member name.
Example: X0

Example

no interface X2

Syntax

final-backup <FLB_FINAL_BACKUP>

Mode

LB Group

Description

Add/Replace final backup interface in load balancing group.

Options

<FLB_FINAL_BACKUP> WAN interface name.
Example: X0

Example

final-backup X4

Syntax

no final-backup

Mode

LB Group

Description

Remove final backup interface in load balancing group.

Example

no final-backup

Syntax

probing

Mode

LB Group

Description

Enter probing configuration mode.

Example

probing

Syntax

health-check <UINT16>

Mode

Probing

Description

Set the interval to perform health check of member (logical probing, physical link-check) in seconds.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

health-check 5

Syntax

missed-intervals <UINT16>

Mode

Probing

Description

Set the number of intervals to deactivate the member after.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

missed-intervals 6

Syntax

successful-intervals <UINT16>

Mode

Probing

Description

Set the number of intervals to reactivate the member after.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

successful-intervals 3

Syntax

global-responder

Mode

Probing

Description

Enable probing on all members using SonicWALL's global responder.

Example

global-responder

Syntax

no global-responder

Mode

Probing

Description

Disable probing on all members using SonicWALL's global responder and set to physical monitoring only.

Example

no global-responder

Syntax

rank <UINT32>

Mode

LB Group Member

Description

Interface rank.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

rank 2

Syntax

percent <FLB_CURRENT_GROUP_MEMBER> <UINT8>

Mode

LB Group

Description

Set the member usage percent for the interface.

Options

<FLB_CURRENT_GROUP_MEMBER> Group member name.
Example: X0
<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

percent X1 55

Syntax

probe-type { logical | physical }

Mode

LB Group Member

Description

Configure probing type.

Options

 
logicalUse logical/probe monitoring.
 
physicalUse only physical checking of member status, no probing.

Example

probe-type logical

Syntax

probe-condition { always | both | either | main }

Mode

LB Group Member

Description

Configure under what condition probes succeed.

Options

 
alwaysAlways succeeds (no probing).
 
bothProbes succeed when both main target and alternate target respond.
 
eitherProbes succeed when either main target or alternate target responds.
 
mainProbes succeed when main target responds.

Example

probe-condition either

Syntax

main-target [ protocol { ping | tcp <IPV4_PORT> } ] [ host <HOSTNAME> ]

Mode

LB Group Member

Description

Configure main target probe settings.

Options

protocolSet the probe protocol.
 
pingPing probes.
 
tcpTCP SYN probes.
<IPV4_PORT> Integer in the form: D OR 0xHHHH.
Example: 80
hostTarget name or IP address.
<HOSTNAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com

Example

main-target protocol tcp 8080 host 192.168.168.254

Syntax

alternate-target [ protocol { ping | tcp <IPV4_PORT> } ] [ host <HOSTNAME> ]

Mode

LB Group Member

Description

Configure alternate target probe settings.

Options

protocolSet the probe protocol.
 
pingPing probes.
 
tcpTCP SYN probes.
<IPV4_PORT> Integer in the form: D OR 0xHHHH.
Example: 80
hostTarget Name or IP address.
<HOSTNAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com

Example

alternate-target protocol tcp 8080 host 192.168.168.253

Syntax

default-target <IPV4_HOST>

Mode

LB Group Member

Description

Configure the default target.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

default-target 192.168.168.254

Syntax

no default-target

Mode

LB Group Member

Description

Clear the default target.

Example

no default-target

Syntax

ip-helper

Mode

Config

Description

Configure IP helper.

Example

ip-helper

Syntax

enable

Mode

IP Helper

Description

Enable IP helper.

Example

enable

Syntax

no enable

Mode

IP Helper

Description

Disable IP helper.

Example

no enable

Syntax

policy protocol <IPH_PROTOCOL> source { group <ADDR_GROUP_NAME> | interface <INTERFACE_NAME> | name <ADDR_NETWORK_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | zone <ZONE_NO_MULTICAST_NAME> } destination { group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_IPH_POLICY_DST_NAME> | network <ADDR_NETWORK> <ADDR_MASK> }

Mode

IP Helper

Description

Add/Edit IP helper policy.

Options

protocolSpecify the IP helper relay protocol.
<IPH_PROTOCOL> IP Helper relay protocol name.
Example: mydns
sourceSpecify source.
 
groupIP helper policy source address object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
interfaceIP helper policy source interface.
<INTERFACE_NAME> Interface name.
Example: X0
 
nameIP helper policy source address object name.
<ADDR_NETWORK_NAME> Network address object name.
Example: Sales Network
 
networkIP helper policy source network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
zoneIP helper policy source zone.
<ZONE_NO_MULTICAST_NAME> Zone object name.
Example: DMZ
destinationSpecify destination.
 
groupDestination address object group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostDestination address object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameDestination address object name.
<ADDR_IPH_POLICY_DST_NAME> Host or network address object name.
Example: Web Server
 
networkIP helper policy source network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n

Example

policy protocol netBIOS source name "X0 Subnet" destination name "X1 Subnet"

Syntax

no policy protocol <IPH_PROTOCOL> source { group <ADDR_GROUP_NAME> | interface <INTERFACE_NAME> | name <ADDR_NETWORK_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | zone <ZONE_NO_MULTICAST_NAME> } destination { group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_IPH_POLICY_DST_NAME> | network <ADDR_NETWORK> <ADDR_MASK> }

Mode

IP Helper

Description

Delete IP helper policy.

Options

protocolSpecify the IP helper relay protocol.
<IPH_PROTOCOL> IP Helper relay protocol name.
Example: mydns
sourceSpecify source.
 
groupIP helper policy source address object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
interfaceIP helper policy source interface.
<INTERFACE_NAME> Interface name.
Example: X0
 
nameIP helper policy source address object name.
<ADDR_NETWORK_NAME> Network address object name.
Example: Sales Network
 
networkIP helper policy source network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
zoneIP helper policy source zone.
<ZONE_NO_MULTICAST_NAME> Zone object name.
Example: DMZ
destinationSpecify destination.
 
groupDestination address object group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostDestination address object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameDestination address object name.
<ADDR_IPH_POLICY_DST_NAME> Host or network address object name.
Example: Web Server
 
networkIP helper policy source network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n

Example

no policy source "Interface X0" destination name "File Server" protocol netBIOS

Syntax

no policies

Mode

IP Helper

Description

Delete all IP helper Policies.

Example

no policies

Syntax

protocol { enable | name } <IPH_PROTOCOL>

Mode

IP Helper

Description

Add/Edit IP helper protocol.

Options

 
enableEnable specified IP helper relay protocol.
 
nameIP helper relay protocol name.
<IPH_PROTOCOL> IP Helper relay protocol name.
Example: mydns

Example

protocol name mydns

Syntax

no protocol { enable | name } <IPH_PROTOCOL>

Mode

IP Helper

Description

Delete IP helper relay protocol.

Options

 
enableEnable IP Helper settings or objects.
 
nameIP helper relay protocol name.
<IPH_PROTOCOL> IP Helper relay protocol name.
Example: mydns

Example

no protocol name mydns

Syntax

no protocols

Mode

IP Helper

Description

Delete all IP helper relay protocols.

Example

no protocols

Syntax

enable

Mode

IP Helper Policy

Description

Enable IP helper policy.

Example

enable

Syntax

no enable

Mode

IP Helper Policy

Description

Disable IP helper policy.

Example

no enable

Syntax

protocol <IPH_PROTOCOL>

Mode

IP Helper Policy

Description

Specify IP helper relay protocol associated with this policy.

Options

<IPH_PROTOCOL> IP Helper relay protocol name.
Example: mydns

Example

protocol mydns

Syntax

source { group <ADDR_GROUP_NAME> | interface <INTERFACE_NAME> | name <ADDR_NETWORK_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | zone <ZONE_NO_MULTICAST_NAME> }

Mode

IP Helper Policy

Description

Specify source zone or interface for IP helper policy.

Options

 
groupIP helper policy source address object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
interfaceIP helper policy source interface.
<INTERFACE_NAME> Interface name.
Example: X0
 
nameIP helper policy source address object name.
<ADDR_NETWORK_NAME> Network address object name.
Example: Sales Network
 
networkIP helper policy source network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
zoneIP helper policy source zone.
<ZONE_NO_MULTICAST_NAME> Zone object name.
Example: DMZ

Example

source InterfaceX0

Syntax

destination { group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_IPH_POLICY_DST_NAME> | network <ADDR_NETWORK> <ADDR_MASK> }

Mode

IP Helper Policy

Description

Specify IP helper policy destination.

Options

 
groupDestination address object group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostDestination address object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameDestination address object name.
<ADDR_IPH_POLICY_DST_NAME> Host or network address object name.
Example: Web Server
 
networkIP helper policy source network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n

Example

destination name "mydest"

Syntax

comment <WORD>

Mode

IP Helper Policy

Description

Specify comment for IP helper policy.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

comment "Need to allow NetBIOS between clients"

Syntax

no comment

Mode

IP Helper Policy

Description

Clear comment for IP helper policy.

Example

no comment

Syntax

name <IPH_PROTOCOL>

Mode

IP Helper Protocol

Description

Specify IP Helper relay protocol name.

Options

<IPH_PROTOCOL> IP Helper relay protocol name.
Example: mydns

Example

name mydns

Syntax

enable

Mode

IP Helper Protocol

Description

Enable IP helper relay protocol.

Example

enable

Syntax

no enable

Mode

IP Helper Protocol

Description

Disable IP helper relay protocol.

Example

no enable

Syntax

no port1

Mode

IP Helper Protocol

Description

Clear IP helper relay protocol beginning UDP port.

Example

no port1

Syntax

port1 <IPV4_PORT>

Mode

IP Helper Protocol

Description

Specify IP helper relay protocol beginning UDP port.

Options

<IPV4_PORT> Integer in the form: D OR 0xHHHH.
Example: 80

Example

port1 53

Syntax

no port2

Mode

IP Helper Protocol

Description

Clear IP helper relay protocol ending UDP port.

Example

no port2

Syntax

port2 <IPV4_PORT>

Mode

IP Helper Protocol

Description

Specify IP helper relay protocol ending UDP port.

Options

<IPV4_PORT> Integer in the form: D OR 0xHHHH.
Example: 80

Example

port2 54

Syntax

timeout { 10 | 20 | 30 | 40 | 50 | 60 }

Mode

IP Helper Protocol

Description

Specify IP helper relay protocol timeout.

Options

 
10Timeout value (in seconds).
 
20Timeout value (in seconds).
 
30Timeout value (in seconds).
 
40Timeout value (in seconds).
 
50Timeout value (in seconds).
 
60Timeout value (in seconds).

Example

timeout 20

Syntax

source-translation

Mode

IP Helper Protocol

Description

Allow IP source translation for IP helper relay protocol.

Example

source-translation

Syntax

no source-translation

Mode

IP Helper Protocol

Description

Enable allowing IP source translation for IP helper relay protocol.

Example

no source-translation

Syntax

raw

Mode

IP Helper Protocol

Description

Enable raw mode for IP helper relay protocol.

Example

raw

Syntax

no raw

Mode

IP Helper Protocol

Description

Disable raw mode for IP helper relay protocol.

Example

no raw

Syntax

mac-ip-anti-spoof

Mode

Config

Description

Configure MAC-IP anti-spoof settings.

Example

mac-ip-anti-spoof

Syntax

interface <MAC_IP_ANTI_SPOOF_INTERFACE>

Mode

MAC Anti-Spoof

Description

Configure MAC-IP anti-spoof for the specified interface.

Options

<MAC_IP_ANTI_SPOOF_INTERFACE> MAC-IP anti-spoof interface.
Example: X0

Example

interface X1

Syntax

cache entry <MAC_IP_ANTI_SPOOF_STATIC_IP> <MAC_IP_ANTI_SPOOF_STATIC_MAC> <MAC_IP_ANTI_SPOOF_STATIC_INTERFACE>

Mode

MAC Anti-Spoof

Description

Add/edit an MAC-IP anti-spoof cache entry.

Options

<MAC_IP_ANTI_SPOOF_STATIC_IP> MAC-IP anti-spoof static ip.
Example: 192.168.168.168
<MAC_IP_ANTI_SPOOF_STATIC_MAC> MAC-IP anti-spoof static mac.
Example: 00:0C:F1:56:98:AD
<MAC_IP_ANTI_SPOOF_STATIC_INTERFACE> MAC-IP anti-spoof enabled static interface.
Example: X0

Example

cache entry 10.10.10.10 00:01:02:03:04:05 X0

Syntax

no cache entry <MAC_IP_ANTI_SPOOF_STATIC_IP> <MAC_IP_ANTI_SPOOF_STATIC_MAC> <MAC_IP_ANTI_SPOOF_STATIC_INTERFACE>

Mode

MAC Anti-Spoof

Description

Delete an MAC-IP anti-spoof cache entry.

Options

<MAC_IP_ANTI_SPOOF_STATIC_IP> MAC-IP anti-spoof static ip.
Example: 192.168.168.168
<MAC_IP_ANTI_SPOOF_STATIC_MAC> MAC-IP anti-spoof static mac.
Example: 00:0C:F1:56:98:AD
<MAC_IP_ANTI_SPOOF_STATIC_INTERFACE> MAC-IP anti-spoof enabled static interface.
Example: X0

Example

no cache entry 10.10.10.10 00:01:02:03:04:05 X0

Syntax

no cache entries

Mode

MAC Anti-Spoof

Description

Delete all MAC-IP anti-spoof cache entries.

Example

no cache entries

Syntax

router

Mode

MAC Anti-Spoof Cache

Description

Device is a router(a network exist behind this device).

Example

router

Syntax

no router

Mode

MAC Anti-Spoof Cache

Description

Device is not a router.

Example

no router

Syntax

blacklisted

Mode

MAC Anti-Spoof Cache

Description

Device is blacklisted.

Example

blacklisted

Syntax

no blacklisted

Mode

MAC Anti-Spoof Cache

Description

Device is not blacklisted.

Example

no blacklisted

Syntax

ip <IPV4_HOST>

Mode

MAC Anti-Spoof Cache

Description

IP address.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Syntax

mac <MAC>

Mode

MAC Anti-Spoof Cache

Description

MAC address.

Options

<MAC> MAC address in the form: HH:HH:HH:HH:HH:HH OR HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD

Syntax

interface <MAC_IP_ANTI_SPOOF_STATIC_INTERFACE>

Mode

MAC Anti-Spoof Cache

Description

Interface.

Options

<MAC_IP_ANTI_SPOOF_STATIC_INTERFACE> MAC-IP anti-spoof enabled static interface.
Example: X0

Syntax

clear cache statistics

Mode

MAC Anti-Spoof

Description

Clear MAC-IP anti-spoof cache statistics.

Example

clear cache statistics

Syntax

clear spoof-detected-list

Mode

MAC Anti-Spoof

Description

Clear the whole spoof detected list.

Options

spoof-detected-listSpoof detected list.

Example

clear spoof-detected-list

Syntax

resolve spoof-detected-list

Mode

MAC Anti-Spoof

Description

Resolve names for the whole spoof detected list.

Options

spoof-detected-listSpoof detected list.

Example

resolve spoof-detected-list

Syntax

enable

Mode

MAC Anti-Spoof IF

Description

Enable MAC-IP based anti-spoofing on this interface.

Example

enable

Syntax

no enable

Mode

MAC Anti-Spoof IF

Description

Disable MAC-IP based anti-spoofing on this interface.

Example

no enable

Syntax

static-arp

Mode

MAC Anti-Spoof IF

Description

Enable population of MAC-IP anti-spoof from static ARP entries.

Example

static-arp

Syntax

no static-arp

Mode

MAC Anti-Spoof IF

Description

Disable population of MAC-IP anti-spoof from static ARP entries.

Example

no static-arp

Syntax

dhcp-server

Mode

MAC Anti-Spoof IF

Description

Enable population of MAC-IP anti-spoof entry from DHCP lease (SonicWall's DHCP server).

Example

dhcp-server

Syntax

no dhcp-server

Mode

MAC Anti-Spoof IF

Description

Disable population of MAC-IP anti-spoof entry from DHCP lease (SonicWall's DHCP server).

Example

no dhcp-server

Syntax

dhcp-relay

Mode

MAC Anti-Spoof IF

Description

Enable population of MAC-IP anti-spoof entry from DHCP lease (DHCP relay - IP helper).

Example

dhcp-relay

Syntax

no dhcp-relay

Mode

MAC Anti-Spoof IF

Description

Disable population of MAC-IP anti-spoof entry from DHCP lease (DHCP relay - IP helper).

Example

no dhcp-relay

Syntax

arp-lock

Mode

MAC Anti-Spoof IF

Description

Enable locking of MAC-IP binding in ARP cache to prevent ARP poisoning from others.

Example

arp-lock

Syntax

no arp-lock

Mode

MAC Anti-Spoof IF

Description

Disable locking of MAC-IP binding in ARP cache.

Example

no arp-lock

Syntax

arp-watch

Mode

MAC Anti-Spoof IF

Description

Enable prevention of ARP poisoning of connected machines.

Example

arp-watch

Syntax

no arp-watch

Mode

MAC Anti-Spoof IF

Description

Disable prevention of ARP poisoning of connected machines.

Example

no arp-watch

Syntax

enforce-ingress

Mode

MAC Anti-Spoof IF

Description

Enable enforcement of ingress anti-spoof - drop packets not matching MAC-IP anti-spoof cache.

Example

enforce-ingress

Syntax

no enforce-ingress

Mode

MAC Anti-Spoof IF

Description

Disable enforcement of ingress anti-spoof.

Example

no enforce-ingress

Syntax

spoof-detection

Mode

MAC Anti-Spoof IF

Description

Enable creation of MAC-IP spoof detected list for packets failing to match anti-spoof cache.

Example

spoof-detection

Syntax

no spoof-detection

Mode

MAC Anti-Spoof IF

Description

Disable creation of MAC-IP spoof detected list for packets failing to match anti-spoof cache.

Example

no spoof-detection

Syntax

allow-management

Mode

MAC Anti-Spoof IF

Description

Enable all traffic destined to the box to be allowed without a valid MAC-IP anti-spoof cache.

Example

allow-management

Syntax

no allow-management

Mode

MAC Anti-Spoof IF

Description

Disable all traffic destined to the box to be allowed without a valid MAC-IP anti-spoof cache.

Example

no allow-management

Syntax

no nat-policy inbound <NAT_INTERFACE> outbound <NAT_INTERFACE> [ source { { any | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] [ translated-source { { group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | original | range <ADDR_BEGIN> <ADDR_END> } } ] [ destination { { any | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] [ translated-destination { { group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | original | range <ADDR_BEGIN> <ADDR_END> } } ] [ service { { any | group <SVC_GROUP_NAME> | name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ] [ translated-service { { group <SVC_GROUP_NAME> | name <SVC_NAME> | original | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ]

Mode

Config

Description

Delete a NAT policy.

Options

<NAT_INTERFACE> Interface name.
Example: X0
outboundOutbound interface.
<NAT_INTERFACE> Interface name.
Example: X0
sourceOriginal source (\"Any\" if not specified).
 
anyAny host.
 
groupAddress object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
translated-sourceTranslated source (\"Original\" if not specified).
 
groupAddress object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
originalOriginal source IP.
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
destinationOriginal destination (\"Any\" if not specified).
 
anyAny host.
 
groupAddress object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
translated-destinationTranslated destination (\"Original\" if not specified).
 
groupAddress object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
originalOriginal destination IP.
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
serviceOriginal service (\"Any\" if not specified).
 
anyAny service.
 
groupService group.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolService object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80
translated-serviceTranslated service (\"Original\" if not specified).
 
groupService group.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
originalOriginal service.
 
protocolService object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80

Example

no nat-policy inbound X3 outbound X4 source any translated-source original destination name "Web Server Public" translated-destination name "Web Server Private" service "My Web Services" translated-service original

Syntax

no nat-policy ipv6 inbound <NAT_INTERFACE> outbound <NAT_INTERFACE> [ source { { any | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] [ translated-source { { group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | original | range <ADDR_BEGIN> <ADDR_END> } } ] [ destination { { any | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] [ translated-destination { { group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | original | range <ADDR_BEGIN> <ADDR_END> } } ] [ service { { any | group <SVC_GROUP_NAME> | name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ] [ translated-service { { group <SVC_GROUP_NAME> | name <SVC_NAME> | original | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ]

Mode

Config

Description

Delete a IPv6 NAT policy.

Options

<NAT_INTERFACE> Interface name.
Example: X0
outboundOutbound interface.
<NAT_INTERFACE> Interface name.
Example: X0
sourceOriginal source (\"Any\" if not specified).
 
anyAny host.
 
groupAddress object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
translated-sourceTranslated source (\"Original\" if not specified).
 
groupAddress object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
originalOriginal source IP.
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
destinationOriginal destination (\"Any\" if not specified).
 
anyAny host.
 
groupAddress object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
translated-destinationTranslated destination (\"Original\" if not specified).
 
groupAddress object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
originalOriginal destination IP.
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
serviceOriginal service (\"Any\" if not specified).
 
anyAny service.
 
groupService group.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolService object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80
translated-serviceTranslated service (\"Original\" if not specified).
 
groupService group.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
originalOriginal service.
 
protocolService object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80

Example

no nat-policy ipv6 inbound X3 outbound X4 source any translated-source original destination name "Web Server Public" translated-destination name "Web Server Private" service "My Web Services" translated-service original

Syntax

no nat-policy id <OBJECT_INDEX>

Mode

Config

Description

Delete a NAT policy by associated ID.

Options

<OBJECT_INDEX> Integer in the form: D OR 0xHHHHHHHH.
Example: 1

Example

no nat-policy id 14

Syntax

no nat-policy ipv6 id <OBJECT_INDEX>

Mode

Config

Description

Delete an IPv6 NAT policy by associated ID.

Options

<OBJECT_INDEX> Integer in the form: D OR 0xHHHHHHHH.
Example: 1

Example

no nat-policy ipv6 id 14

Syntax

no nat-policies [ ipv4 | ipv6 ]

Mode

Config

Description

Delete all NAT policies.

Options

 
ipv4Delete all IPv4 NAT policies.
 
ipv6Delete all IPv6 NAT policies.

Example

no nat-policies

Syntax

nat-policy inbound <NAT_INTERFACE> outbound <NAT_INTERFACE> [ source { { any | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] [ translated-source { { group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | original | range <ADDR_BEGIN> <ADDR_END> } } ] [ destination { { any | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] [ translated-destination { { group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | original | range <ADDR_BEGIN> <ADDR_END> } } ] [ service { { any | group <SVC_GROUP_NAME> | name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ] [ translated-service { { group <SVC_GROUP_NAME> | name <SVC_NAME> | original | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ]

Mode

Config

Description

Add/edit a NAT policy and enter its configuration mode.

Options

<NAT_INTERFACE> Interface name.
Example: X0
outboundOutbound interface.
<NAT_INTERFACE> Interface name.
Example: X0
sourceOriginal source (\"Any\" if not specified).
 
anyAny host.
 
groupAddress object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
translated-sourceTranslated source (\"Original\" if not specified).
 
groupAddress object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
originalOriginal source IP.
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
destinationOriginal destination (\"Any\" if not specified).
 
anyAny host.
 
groupAddress object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
translated-destinationTranslated destination (\"Original\" if not specified).
 
groupAddress object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
originalOriginal destination IP.
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
serviceOriginal service (\"Any\" if not specified).
 
anyAny service.
 
groupService group.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolService object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80
translated-serviceTranslated service (\"Original\" if not specified).
 
groupService group.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
originalOriginal service.
 
protocolService object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80

Example

nat-policy inbound X3 outbound X4 source any translated-source original destination name "Web Server Public" translated-destination name "Web Server Private" service "My Web Services" translated-service original

Syntax

nat-policy ipv6 inbound <NAT_INTERFACE> outbound <NAT_INTERFACE> [ source { { any | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] [ translated-source { { group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | original | range <ADDR_BEGIN> <ADDR_END> } } ] [ destination { { any | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] [ translated-destination { { group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | original | range <ADDR_BEGIN> <ADDR_END> } } ] [ service { { any | group <SVC_GROUP_NAME> | name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ] [ translated-service { { group <SVC_GROUP_NAME> | name <SVC_NAME> | original | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ]

Mode

Config

Description

Add/edit a IPv6 NAT policy and enter its configuration mode.

Options

<NAT_INTERFACE> Interface name.
Example: X0
outboundOutbound interface.
<NAT_INTERFACE> Interface name.
Example: X0
sourceOriginal source (\"Any\" if not specified).
 
anyAny host.
 
groupAddress object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
translated-sourceTranslated source (\"Original\" if not specified).
 
groupAddress object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
originalOriginal source IP.
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
destinationOriginal destination (\"Any\" if not specified).
 
anyAny host.
 
groupAddress object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
translated-destinationTranslated destination (\"Original\" if not specified).
 
groupAddress object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
originalOriginal destination IP.
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
serviceOriginal service (\"Any\" if not specified).
 
anyAny service.
 
groupService group.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolService object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80
translated-serviceTranslated service (\"Original\" if not specified).
 
groupService group.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
originalOriginal service.
 
protocolService object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80

Example

nat-policy ipv6 inbound X3 outbound X4 source any translated-source original destination name "Web Server Public" translated-destination name "Web Server Private" service "My Web Services" translated-service original

Syntax

nat-policy id <OBJECT_INDEX>

Mode

Config

Description

Edit a NAT policy by associated ID.

Options

<OBJECT_INDEX> Integer in the form: D OR 0xHHHHHHHH.
Example: 1

Example

nat-policy id 15

Syntax

nat-policy ipv6 id <OBJECT_INDEX>

Mode

Config

Description

Edit an IPv6 NAT policy by associated ID.

Options

<OBJECT_INDEX> Integer in the form: D OR 0xHHHHHHHH.
Example: 1

Example

nat-policy ipv6 id 15

Syntax

id <OBJECT_INDEX>

Mode

NAT

IPv6 NAT

Description

Nat policy ID.

Options

<OBJECT_INDEX> Integer in the form: D OR 0xHHHHHHHH.
Example: 1

Example

id 55

Syntax

comment <WORD>

Mode

NAT

IPv6 NAT

Description

Specify a comment for this NAT policy.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

comment "Public HTTP Server"

Syntax

no comment

Mode

NAT

IPv6 NAT

Description

Clear NAT policy comment.

Example

no comment

Syntax

enable

Mode

NAT

IPv6 NAT

Description

Enable NAT policy.

Example

enable

Syntax

no enable

Mode

NAT

IPv6 NAT

Description

Enable NAT policy.

Example

no enable

Syntax

inbound <NAT_INTERFACE>

Mode

NAT

IPv6 NAT

Description

Specify the inbound interface for the NAT policy.

Options

<NAT_INTERFACE> Interface name.
Example: X0

Example

inbound X1

Syntax

outbound <NAT_INTERFACE>

Mode

NAT

IPv6 NAT

Description

Specify the outbound interface for the NAT policy.

Options

<NAT_INTERFACE> Interface name.
Example: X0

Example

outbound X0

Syntax

destination { { any | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } }

Mode

NAT

IPv6 NAT

Description

Specify the original destination for the NAT policy.

Options

 
anyAny host.
 
groupAddress object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

destination name "Web Server Public"

Syntax

source { { any | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } }

Mode

NAT

IPv6 NAT

Description

Specify the original source for the NAT policy.

Options

 
anyAny host.
 
groupAddress object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

source any

Syntax

service { { any | group <SVC_GROUP_NAME> | name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } }

Mode

NAT

IPv6 NAT

Description

Specify the original service for the NAT policy.

Options

 
anyAny service.
 
groupService group.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolService object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80

Example

service name "My Web Services"

Syntax

reflexive

Mode

NAT

IPv6 NAT

Description

Configure a reflexive rule.

Example

reflexive

Syntax

no reflexive

Mode

NAT

IPv6 NAT

Description

Disable configuration of a reflexive rule.

Example

no reflexive

Syntax

translated-destination { { group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | original | range <ADDR_BEGIN> <ADDR_END> } }

Mode

NAT

IPv6 NAT

Description

Specify the translated destination for the NAT policy.

Options

 
groupAddress object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
originalOriginal destination IP.
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

translated-destination name "Web Server Private"

Syntax

translated-source { { group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | original | range <ADDR_BEGIN> <ADDR_END> } }

Mode

NAT

IPv6 NAT

Description

Specify the translated source for the NAT policy.

Options

 
groupAddress object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
originalOriginal source IP.
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

translated-source original

Syntax

translated-service { { group <SVC_GROUP_NAME> | name <SVC_NAME> | original | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } }

Mode

NAT

IPv6 NAT

Description

Specify the translated service for the NAT policy.

Options

 
groupService group.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
originalOriginal service.
 
protocolService object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80

Example

translated-service original

Syntax

virtual-group { any | id <VIRTUAL_GROUP_ID> }

Mode

NAT

IPv6 NAT

Description

Specify virtual group for the NAT policy.

Options

 
anyAny virtual group.
 
idVirtual group id.
<VIRTUAL_GROUP_ID> Integer in the form: D OR 0xHH.
Example: 1

Example

virtual-group any

Syntax

high-availability

Mode

NAT

Description

NAT high availability and load balancing configuration mode.

Example

high-availability

Syntax

nat-method { block-remap | random-distribution | round-robin | sticky-ip | symmetrical-remap }

Mode

NAT

Description

Set the NAT destination translation method.

Options

 
block-remapBlock remap.
 
random-distributionRandom distribution.
 
round-robinRound robin.
 
sticky-ipSticky IP.
 
symmetrical-remapSymmetrical remap.

Example

nat-method sticky-ip

Syntax

probing

Mode

High Availability

Description

Enable HA probing and enter configuration mode.

Example

probing

Syntax

no probing

Mode

High Availability

Description

Disable HA probing.

Example

no probing

Syntax

probe-every <UINT16>

Mode

High Availability Probe

Description

Set probe interval (in seconds).

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

probe-every 5

Syntax

probe-type { icmp-ping | tcp <IPV4_PORT> }

Mode

High Availability Probe

Description

Set probe IP type.

Options

 
icmp-pingICMP ping probe.
 
tcpTCP probe.
<IPV4_PORT> Integer in the form: D OR 0xHHHH.
Example: 80

Example

probe-type tcp 80

Syntax

reply-timeout <UINT16>

Mode

High Availability Probe

Description

Set reply timeout (in seconds).

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

reply-timeout 5

Syntax

deactivate-after <UINT16>

Mode

High Availability Probe

Description

Set number of missed probes required before deactivating the NAT policy.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

deactivate-after 4

Syntax

reactivate-after <UINT16>

Mode

High Availability Probe

Description

Set number of successful probes required before reactivating the NAT policy.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

reactivate-after 3

Syntax

rst-as-miss

Mode

High Availability Probe

Description

Enable count RST response as miss.

Example

rst-as-miss

Syntax

no rst-as-miss

Mode

High Availability Probe

Description

Disable count RST response as miss.

Example

no rst-as-miss

Syntax

no network-monitor policy <NETMON_NAME>

Mode

Config

Description

Delete network monitor policy.

Options

<NETMON_NAME> Atom Object name.
Example: Web Services Monitor

Example

no network-monitor policy "Remote Servers"

Syntax

no network-monitor policies

Mode

Config

Description

Delete all network monitor policies.

Example

no network-monitor policies

Syntax

clear network-monitor statistics

Mode

Config

Description

Clear network monitor statistics.

Example

clear network-monitor statistics

Syntax

network-monitor policy <NETMON_NAME>

Mode

Config

Description

Add/edit a network monitor policy.

Options

<NETMON_NAME> Atom Object name.
Example: Web Services Monitor

Example

network-monitor policy "Remote Servers"

Syntax

name <NETMON_NAME>

Mode

Network Monitor Policy

Description

Edit a network monitor policy name.

Options

<NETMON_NAME> Atom Object name.
Example: Web Services Monitor

Example

name "Remote Servers"

Syntax

no probe-target

Mode

Network Monitor Policy

Description

Clear the probe target.

Example

no probe-target

Syntax

probe-target { fqdn <ADDR_FQDN> | group <ADDR_FHR_GROUP> | host <ADDR_HOST> | name <ADDR_FQDN_HOST_RANGE_NAME> | range <ADDR_BEGIN> <ADDR_END> }

Mode

Network Monitor Policy

Description

Set the probe target.

Options

 
fqdnSet the probe target to FQDN address.
<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
groupSet the probe target to group address object.
<ADDR_FHR_GROUP> FQDN/host/range group address object name.
Example: Web Server Group
 
hostSet the probe target to host address.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameSet the probe target to named address object.
<ADDR_FQDN_HOST_RANGE_NAME> FQDN/host/range address object name.
Example: Web Server
 
rangeSet the probe target to range of addresses.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

probe-target name "Remote Target"

Syntax

next-hop { host <ADDR_HOST> | name <ADDR_HOST_NAME> }

Mode

Network Monitor Policy

Description

Set the next hop gateway.

Options

 
hostSet the next hop to host address.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameSet the next hop to named address object.
<ADDR_HOST_NAME> Host address object name.
Example: Web Server

Example

next-hop name "X1 Default Gateway"

Syntax

no next-hop

Mode

Network Monitor Policy

Description

Clear the next hop gateway.

Example

no next-hop

Syntax

local-ip { host <NETMON_HOST> | name <ADDR_HOST_NAME> }

Mode

Network Monitor Policy

Description

Set the local IP address.

Options

 
hostSet the local IP to host address.
<NETMON_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameSet the local IP to named address object.
<ADDR_HOST_NAME> Host address object name.
Example: Web Server

Example

local-ip name "X1 IP"

Syntax

no local-ip

Mode

Network Monitor Policy

Description

Clear the local IP address.

Example

no local-ip

Syntax

outbound-interface <NETMON_INTERFACE>

Mode

Network Monitor Policy

Description

Set outbound interface.

Options

<NETMON_INTERFACE> Interface name.
Example: X0

Example

outbound-interface X2

Syntax

probe-type { ping | ping-explicit | tcp <IPV4_PORT> | tcp-explicit <IPV4_PORT> }

Mode

Network Monitor Policy

Description

Set probe type and probe type for TCP.

Options

 
pingPing probe.
 
ping-explicitPing probe using explicit route.
 
tcpTCP probe.
<IPV4_PORT> Integer in the form: D OR 0xHHHH.
Example: 80
 
tcp-explicitTCP probe using explicit route.
<IPV4_PORT> Integer in the form: D OR 0xHHHH.
Example: 80

Example

probe-type tcp-explicit 80

Syntax

probe-interval <UINT16>

Mode

Network Monitor Policy

Description

Set probe host interval.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

probe-interval 5

Syntax

reply-timeout <UINT8>

Mode

Network Monitor Policy

Description

Set probing reply timeout.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

reply-timeout 2

Syntax

missed-intervals <UINT8>

Mode

Network Monitor Policy

Description

Probe state is set to DOWN after specified number of missed intervals.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

missed-intervals 3

Syntax

successful-intervals <UINT8>

Mode

Network Monitor Policy

Description

Probe state is set to UP after specified number of successful intervals.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

successful-intervals 3

Syntax

must-respond

Mode

Network Monitor Policy

Description

Enable all hosts must respond.

Example

must-respond

Syntax

no must-respond

Mode

Network Monitor Policy

Description

Disable all hosts must respond.

Example

no must-respond

Syntax

rst-as-miss

Mode

Network Monitor Policy

Description

Enable RST response counts as miss.

Example

rst-as-miss

Syntax

no rst-as-miss

Mode

Network Monitor Policy

Description

Disable RST response counts as miss.

Example

no rst-as-miss

Syntax

comment <WORD>

Mode

Network Monitor Policy

Description

Set network monitor policy comment.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

comment "Remote Servers"

Syntax

no comment

Mode

Network Monitor Policy

Description

Clear network monitor policy comment.

Example

no comment

Syntax

routing

Mode

Config

Description

Enter routing configuration mode.

Example

routing

Syntax

mode { advanced | simple }

Mode

Routing

Description

Routing mode.

Options

 
advancedAdvanced routing.
 
simpleSimple RIP advertisement.

Example

mode simple

mode advanced

Syntax

nsm

Mode

Routing

Description

Configure network services module (NSM) protocol.

Example

nsm

Syntax

ospf

Mode

Routing

Description

Configure open shortest path first (OSPF) protocol.

Example

ospf

Syntax

rip

Mode

Routing

Description

Configure routing information protocol (RIP).

Example

rip

Syntax

ospf6

Mode

Routing

Description

Configure Open Shortest Path First (OSPFv3) protocol.

Example

ospf6

Syntax

ripng

Mode

Routing

Description

Configure Routing Information Protocol (RIPng).

Example

ripng

Syntax

no bgp

Mode

Routing

Description

Disable border gateway protocol (BGP).

Example

no bgp

Syntax

bgp

Mode

Routing

Description

Enable and configure border gateway protocol (BGP).

Example

bgp

Syntax

default-route-metric <UINT8>

Mode

Routing

Description

Set metric for default routes received from advanced routing protocols.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

default-route-metric 110

Syntax

no policy interface <ROUTING_INTERFACE_NAME> metric <UINT8> [ source { { any | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_HOST_NETWORK_RANGE_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] [ destination { { any | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_HOST_NETWORK_RANGE_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] [ service { { any | group <SVC_GROUP_NAME> | name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ] [ gateway { { default | host <ADDR_HOST> | name <ADDR_HOST_NAME> } } ]

Mode

Routing

Description

Delete a route policy.

Options

<ROUTING_INTERFACE_NAME> Route interface name.
Example: X0
metricRoute policy metric.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
sourceRoute policy source.
 
anyAny host.
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_HOST_NETWORK_RANGE_NAME> Host/network/range address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
destinationRoute policy destination.
 
anyAny host.
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_HOST_NETWORK_RANGE_NAME> Host/network/range address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
serviceRoute policy service.
 
anyAny service.
 
groupService group.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolService object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80
gatewayRoute policy gateway.
 
defaultDefault gateway 0.0.0.0/::
 
hostGateway IP.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_HOST_NAME> Host address object name.
Example: Web Server

Example

no policy interface X4 metric 255 service name "FTP" gateway default

Syntax

no policy ipv6 interface <ROUTING_INTERFACE_NAME> metric <UINT8> [ source { { any | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_HOST_NETWORK_RANGE_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] [ destination { { any | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_HOST_NETWORK_RANGE_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] [ service { { any | group <SVC_GROUP_NAME> | name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ] [ gateway { { default | host <ADDR_HOST> | name <ADDR_HOST_NAME> } } ]

Mode

Routing

Description

Delete an IPv6 route policy.

Options

<ROUTING_INTERFACE_NAME> Route interface name.
Example: X0
metricRoute policy metric.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
sourceRoute policy source.
 
anyAny host.
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_HOST_NETWORK_RANGE_NAME> Host/network/range address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
destinationRoute policy destination.
 
anyAny host.
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_HOST_NETWORK_RANGE_NAME> Host/network/range address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
serviceRoute policy service.
 
anyAny service.
 
groupService group.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolService object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80
gatewayRoute policy gateway.
 
defaultDefault gateway 0.0.0.0/::
 
hostGateway IP.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_HOST_NAME> Host address object name.
Example: Web Server

Example

no policy ipv6 interface X4 metric 255 service name "FTP" gateway default

Syntax

no policy id <OBJECT_INDEX>

Mode

Routing

Description

Delete a route policy by associated ID.

Options

<OBJECT_INDEX> Integer in the form: D OR 0xHHHHHHHH.
Example: 1

Example

no policy id 7

Syntax

no policy ipv6 id <OBJECT_INDEX>

Mode

Routing

Description

Delete an IPv6 route policy by associated ID.

Options

<OBJECT_INDEX> Integer in the form: D OR 0xHHHHHHHH.
Example: 1

Example

no policy ipv6 id 7

Syntax

no policies [ ipv4 | ipv6 ]

Mode

Routing

Description

Delete all route policies.

Options

 
ipv4Delete all IPv4 route policies.
 
ipv6Delete all IPv6 route policies.

Example

no policies

no policies ipv4
no policies ipv6

Syntax

policy interface <ROUTING_INTERFACE_NAME> metric <UINT8> [ source { { any | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_HOST_NETWORK_RANGE_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] [ destination { { any | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_HOST_NETWORK_RANGE_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] [ service { { any | group <SVC_GROUP_NAME> | name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ] [ gateway { { default | host <ADDR_HOST> | name <ADDR_HOST_NAME> } } ]

Mode

Routing

Description

Add/edit a route policy.

Options

<ROUTING_INTERFACE_NAME> Route interface name.
Example: X0
metricRoute policy metric.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
sourceRoute policy source.
 
anyAny host.
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_HOST_NETWORK_RANGE_NAME> Host/network/range address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
destinationRoute policy destination.
 
anyAny host.
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_HOST_NETWORK_RANGE_NAME> Host/network/range address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
serviceRoute policy service.
 
anyAny service.
 
groupService group.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolService object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80
gatewayRoute policy gateway.
 
defaultDefault gateway 0.0.0.0/::
 
hostGateway IP.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_HOST_NAME> Host address object name.
Example: Web Server

Example

policy interface X4 metric 255 source any destination any service any gateway default

Syntax

policy ipv6 interface <ROUTING_INTERFACE_NAME> metric <UINT8> [ source { { any | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_HOST_NETWORK_RANGE_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] [ destination { { any | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_HOST_NETWORK_RANGE_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] [ service { { any | group <SVC_GROUP_NAME> | name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ] [ gateway { { default | host <ADDR_HOST> | name <ADDR_HOST_NAME> } } ]

Mode

Routing

Description

Add/edit a IPv6 route policy.

Options

<ROUTING_INTERFACE_NAME> Route interface name.
Example: X0
metricRoute policy metric.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
sourceRoute policy source.
 
anyAny host.
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_HOST_NETWORK_RANGE_NAME> Host/network/range address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
destinationRoute policy destination.
 
anyAny host.
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_HOST_NETWORK_RANGE_NAME> Host/network/range address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
serviceRoute policy service.
 
anyAny service.
 
groupService group.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolService object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80
gatewayRoute policy gateway.
 
defaultDefault gateway 0.0.0.0/::
 
hostGateway IP.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_HOST_NAME> Host address object name.
Example: Web Server

Example

policy ipv6 interface X4 metric 255 source any destination any service any gateway default

Syntax

policy id <OBJECT_INDEX>

Mode

Routing

Description

Edit a route policy by associated ID.

Options

<OBJECT_INDEX> Integer in the form: D OR 0xHHHHHHHH.
Example: 1

Example

policy id 7

Syntax

policy ipv6 id <OBJECT_INDEX>

Mode

Routing

Description

Edit an IPv6 route policy by associated ID.

Options

<OBJECT_INDEX> Integer in the form: D OR 0xHHHHHHHH.
Example: 1

Example

policy ipv6 id 7

Syntax

id <OBJECT_INDEX>

Mode

Routing Policy

IPV6 Routing Policy

Description

Route policy ID.

Options

<OBJECT_INDEX> Integer in the form: D OR 0xHHHHHHHH.
Example: 1

Example

id 55

Syntax

enable

Mode

Routing Policy

Description

Enable route policy.

Example

enable

Syntax

no enable

Mode

Routing Policy

Description

Disable route policy.

Example

no enable

Syntax

source { { any | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_HOST_NETWORK_RANGE_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } }

Mode

Routing Policy

IPV6 Routing Policy

Description

Set route policy source.

Options

 
anyAny host.
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_HOST_NETWORK_RANGE_NAME> Host/network/range address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

source name "X0 Default Gateway"

source group "Corp LAN2"
source any

Syntax

destination { { any | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_HOST_NETWORK_RANGE_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } }

Mode

Routing Policy

IPV6 Routing Policy

Description

Set route policy destination.

Options

 
anyAny host.
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_HOST_NETWORK_RANGE_NAME> Host/network/range address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

destination name "X0 Default Gateway"

destination group "Corp LAN2"
destination any

Syntax

service { { any | group <SVC_GROUP_NAME> | name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } }

Mode

Routing Policy

IPV6 Routing Policy

Description

Set route policy service.

Options

 
anyAny service.
 
groupService group.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolService object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80

Example

service name "LAN Service"

Syntax

gateway { { default | host <ADDR_HOST> | name <ADDR_HOST_NAME> } }

Mode

Routing Policy

IPV6 Routing Policy

Description

Set route policy gateway.

Options

 
defaultDefault gateway 0.0.0.0/::
 
hostGateway IP.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_HOST_NAME> Host address object name.
Example: Web Server

Example

gateway name "X0 Default Gateway"

gateway default

Syntax

interface <ROUTING_INTERFACE_NAME>

Mode

Routing Policy

IPV6 Routing Policy

Description

Set route policy interface.

Options

<ROUTING_INTERFACE_NAME> Route interface name.
Example: X0

Example

interface X2

Syntax

metric <UINT8>

Mode

Routing Policy

IPV6 Routing Policy

Description

Set route policy metric.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

metric 1

Syntax

no comment

Mode

Routing Policy

IPV6 Routing Policy

Description

Clear route policy comment.

Example

no comment

Syntax

comment <WORD>

Mode

Routing Policy

IPV6 Routing Policy

Description

Set route policy comment.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

comment "Route to Corporate Servers"

Syntax

disable-on-interface-down

Mode

Routing Policy

IPV6 Routing Policy

Description

Disable route when the interface is disconnected.

Example

disable-on-interface-down

Syntax

no disable-on-interface-down

Mode

Routing Policy

IPV6 Routing Policy

Description

Leave route enabled when the interface is disconnected.

Example

no disable-on-interface-down

Syntax

vpn-precedence

Mode

Routing Policy

IPV6 Routing Policy

Description

Allow VPN path to take precedence.

Example

vpn-precedence

Syntax

no vpn-precedence

Mode

Routing Policy

IPV6 Routing Policy

Description

Disable allow VPN path to take precedence.

Example

no vpn-precedence

Syntax

tcp-acceleration

Mode

Routing Policy

IPV6 Routing Policy

Description

Enable permit TCP acceleration.

Example

tcp-acceleration

Syntax

no tcp-acceleration

Mode

Routing Policy

IPV6 Routing Policy

Description

Disable permit TCP acceleration.

Example

no tcp-acceleration

Syntax

auto-add-access-rules

Mode

Routing Policy

IPV6 Routing Policy

Description

Enable auto-add access rules.

Example

auto-add-access-rules

Syntax

no auto-add-access-rules

Mode

Routing Policy

IPV6 Routing Policy

Description

Disable auto-add access rules.

Example

no auto-add-access-rules

Syntax

probe <NETMON_NAME>

Mode

Routing Policy

IPV6 Routing Policy

Description

Set route policy probing.

Options

<NETMON_NAME> Atom Object name.
Example: Web Services Monitor

Example

probe Web-Servers

Syntax

no probe

Mode

Routing Policy

IPV6 Routing Policy

Description

Disable route policy probing.

Example

no probe

Syntax

disable-when-probes-succeed

Mode

Routing Policy

IPV6 Routing Policy

Description

Disable route when probe succeeds.

Example

disable-when-probes-succeed

Syntax

no disable-when-probes-succeed

Mode

Routing Policy

IPV6 Routing Policy

Description

Do not disable route when probe succeeds.

Example

no disable-when-probes-succeed

Syntax

default-probe-state-up

Mode

Routing Policy

IPV6 Routing Policy

Description

Set probe default state to up.

Example

default-probe-state-up

Syntax

no default-probe-state-up

Mode

Routing Policy

IPV6 Routing Policy

Description

Set probe default state to down.

Example

no default-probe-state-up

Syntax

ipv6 default-route-metric <UINT8>

Mode

Routing

Description

Apply the metric to IPv6 default routes learned through router advertisement.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

ipv6 default-route-metric 20

Syntax

web-proxy

Mode

Config

Description

Set automatic proxy forwarding (web only).

Example

web-proxy

Syntax

no server

Mode

Web Proxy

Description

Clear web proxy hostname/IP and port.

Example

no server

Syntax

server <HOSTNAME> port <UINT16>

Mode

Web Proxy

Description

Set web proxy hostname/IP and port.

Options

<HOSTNAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com
portSet web proxy TCP port.
<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

server 10.10.10.100 port 3129

Syntax

bypass-upon-failure

Mode

Web Proxy

Description

Enable bypass proxy servers upon proxy server failure.

Example

bypass-upon-failure

Syntax

no bypass-upon-failure

Mode

Web Proxy

Description

Disable bypass proxy servers upon proxy server failure.

Example

no bypass-upon-failure

Syntax

forward-public-requests

Mode

Web Proxy

Description

Enable forward public zone client requests to proxy server.

Example

forward-public-requests

Syntax

no forward-public-requests

Mode

Web Proxy

Description

Disable forward public zone client requests to proxy server.

Example

no forward-public-requests

Syntax

divert-traffic-to-wxa

Mode

Web Proxy

Description

Enable divert traffic to the WXA series appliance's web cache.

Example

divert-traffic-to-wxa

Syntax

no divert-traffic-to-wxa

Mode

Web Proxy

Description

Disable divert traffic to the WXA series appliance's web cache.

Example

no divert-traffic-to-wxa

Syntax

client-inclusion { any | fqdn <ADDR_FQDN> | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | mac <ADDR_MAC> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> }

Mode

Web Proxy

Description

Set client inclusion address object.

Options

 
anySet client inclusion to any address object.
 
fqdnSet client inclusion as full qualified domain name (FQDN) address.
<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
groupSet client inclusion to named address group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostSet client inclusion as host address.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
macSet client inclusion as MAC address.
<ADDR_MAC> Address object MAC address in the form: HH:HH:HH:HH:HH:HH or HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD
 
nameSet client inclusion to named address object.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkSet client inclusion to network address.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeSet client inclusion to range of address.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

client-inclusion any

Syntax

server-exclusion { fqdn <ADDR_FQDN> | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | mac <ADDR_MAC> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> }

Mode

Web Proxy

Description

Set server exclusion address object.

Options

 
fqdnSet server exclusion as full qualified domain name (FQDN) address.
<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
groupSet server exclusion to named address group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostSet server exclusion as host address.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
macSet server exclusion as MAC address.
<ADDR_MAC> Address object MAC address in the form: HH:HH:HH:HH:HH:HH or HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD
 
nameSet server exclusion to named address object.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkSet server exclusion to network address.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeSet server exclusion to range of address.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

server-exclusion name "X1 IP"

Syntax

no server-exclusion

Mode

Web Proxy

Description

Clear server exclusion address object.

Example

no server-exclusion

Syntax

user-proxy-server <HOSTNAME>

Mode

Web Proxy

Description

Add proxy server through which users' web requests may come.

Options

<HOSTNAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com

Example

user-proxy-server example.com

Syntax

no user-proxy-server <USER_NETPROXY_SERVER>

Mode

Web Proxy

Description

Delete proxy server through which users' web requests may come.

Options

<USER_NETPROXY_SERVER> User net proxy server.
Example: example.com

Example

no user-proxy-server example.com

Syntax

no user-proxy-servers

Mode

Web Proxy

Description

Delete all proxy servers through which users' web requests may come.

Example

no user-proxy-servers

Syntax

no ndp entry <NDP_IPV6_HOST> <NDP_MAC> <NDP_INTERFACE>

Mode

Config

Description

Delete an NDP entry.

Options

<NDP_IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b
<NDP_MAC> MAC address in the form: HH:HH:HH:HH:HH:HH OR HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD
<NDP_INTERFACE> Interface name.
Example: X0

Example

no ndp entry 2001:10:10:10:2D0:02BB:03CC:04DD 02:BB:03:CC:04:DD X0

Syntax

no ndp entries

Mode

Config

Description

Delete all NDP entries.

Example

no ndp entries

Syntax

ndp reachable-time <UINT16>

Mode

Config

Description

Set neighbor discovery base reachable time in seconds.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

ndp reachable-time 30

Syntax

no ndp reachable-time

Mode

Config

Description

Clear neighbor discovery base reachable time.

Example

no ndp reachable-time

Syntax

ndp entry <NDP_IPV6_HOST> <NDP_MAC> <NDP_INTERFACE>

Mode

Config

Description

Add/edit an NDP entry.

Options

<NDP_IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b
<NDP_MAC> MAC address in the form: HH:HH:HH:HH:HH:HH OR HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD
<NDP_INTERFACE> Interface name.
Example: X0

Example

ndp entry 2001:10:10:10:2D0:02BB:03CC:04DD 02:BB:03:CC:04:DD X0

Syntax

ip <NDP_IPV6_HOST>

Mode

Static NDP

Description

Configure static NDP IP.

Options

<NDP_IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b

Example

ip 2001:10:10:10:2D0:02BB:03CC:04DD

Syntax

mac <NDP_MAC>

Mode

Static NDP

Description

Configure static NDP MAC address.

Options

<NDP_MAC> MAC address in the form: HH:HH:HH:HH:HH:HH OR HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD

Example

mac 00:01:02:03:04:05

Syntax

interface <NDP_INTERFACE>

Mode

Static NDP

Description

Configure static NDP interface.

Options

<NDP_INTERFACE> Interface name.
Example: X0

Example

interface X0

Syntax

clear ndp cache entries

Mode

Config

Description

Clear all non-permanent entries.

Example

clear ndp cache entries

Syntax

clear ndp cache entry <NDP_FLUSH_IPV6_HOST> <NDP_FLUSH_IF_NAME>

Mode

Config

Description

Clear one NDP entry.

Options

<NDP_FLUSH_IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b
<NDP_FLUSH_IF_NAME> Interface name.
Example: X0

Example

clear ndp cache entry 2001:10:10:10:2D0:02BB:03CC:04DD X0

Syntax

tunnel-interface ipv6 <IPV6_TUNNEL_INTERFACE>

Mode

Config

Description

Add/edit tunnel interface.

Options

ipv6Add/edit IPv6 tunnel interface.
<IPV6_TUNNEL_INTERFACE> IPv6 Interface name.
Example: myTunnelInterface

Example

tunnel-interface CorpIPv6Tunnel

Syntax

no tunnel-interface ipv6 <IPV6_TUNNEL_INTERFACE>

Mode

Config

Description

Delete tunnel interface.

Options

ipv6Delete IPv6 tunnel interface.
<IPV6_TUNNEL_INTERFACE> IPv6 Interface name.
Example: myTunnelInterface

Example

no tunnel-interface CorpIPv6Tunnel

Syntax

name <IPV6_TUNNEL_INTERFACE>

Mode

Tunnel Interface

Description

Set tunnel interface name.

Options

<IPV6_TUNNEL_INTERFACE> IPv6 Interface name.
Example: myTunnelInterface

Example

name CorpIPv6Tunnel

Syntax

zone <INTERFACE_ZONE_NAME>

Mode

Tunnel Interface

Description

Set tunnel interface zone.

Options

<INTERFACE_ZONE_NAME> Zone object name.
Example: DMZ

Example

zone WAN

Syntax

no zone

Mode

Tunnel Interface

Description

Clear tunnel interface zone.

Example

no zone

Syntax

type { 6rd | 6to4 | gre | isatap | manual }

Mode

Tunnel Interface

Description

Set the tunnel interface type.

Options

 
6rd6rd tunnel.
 
6to4IPv6 6to4 tunnel.
 
greGRE tunnel.
 
isatapISATAP tunnel.
 
manualManual tunnel.

Example

type manual

Syntax

ip <IPV6_HOST>

Mode

Manual Tunnel Interface

GRE Tunnel Interface
6to4 Tunnel Interface
6rd Tunnel Interface

Description

Set tunnel interface IPv6 address.

Options

<IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b

Example

ip 3ffe:1900:4545::f8ff:fe21:67cf

Syntax

no ip

Mode

Manual Tunnel Interface

GRE Tunnel Interface
6to4 Tunnel Interface
6rd Tunnel Interface

Description

Clear tunnel interface IPv6 address.

Example

no ip

Syntax

prefix-length <UINT8>

Mode

Manual Tunnel Interface

GRE Tunnel Interface
6to4 Tunnel Interface
6rd Tunnel Interface

Description

Set interface IPv6 prefix length.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

prefix-length 64

Syntax

comment <WORD>

Mode

Tunnel Interface

Description

Set tunnel interface comment.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

comment "IPv6 tunnel to Corporate"

Syntax

no comment

Mode

Tunnel Interface

Description

Clear tunnel interface comment.

Example

no comment

Syntax

management { http | https | ping | snmp }

Mode

Interface IPv6

Tunnel Interface

Description

Enable management for the specified protocols.

Options

 
httpHTTP.
 
httpsHTTPS.
 
pingPing.
 
snmpSNMP.

Example

management https

Syntax

no management { http | https | ping | snmp }

Mode

Interface IPv6

Tunnel Interface

Description

Disable management for the specified protocols.

Options

 
httpHTTP.
 
httpsHTTPS.
 
pingPing.
 
snmpSNMP.

Example

no management https

Syntax

user-login [ http ] [ https ]

Mode

Interface IPv6

Tunnel Interface

Description

Enable user login for the specified protocols.

Options

httpHTTP.
httpsHTTPS.

Example

user-login http https

Syntax

no user-login [ http ] [ https ]

Mode

Interface IPv6

Tunnel Interface

Description

Disable user login for the specified protocols.

Options

httpHTTP.
httpsHTTPS.

Example

no user-login http

Syntax

https-redirect

Mode

Interface IPv6

Tunnel Interface

Description

Enable redirection from HTTP to HTTPS.

Example

https-redirect

Syntax

no https-redirect

Mode

Interface IPv6

Tunnel Interface

Description

Disable redirection from HTTP to HTTPS.

Example

no https-redirect

Syntax

remote ipv4-address { host <TUNNEL_IPV4_ADDR_HOST> | name <TUNNEL_IPV4_ADDR_HOST_NAME> }

Mode

Manual Tunnel Interface

Description

Configure the remote IPv4 address.

Options

 
hostConfigure the remote IPv4 address to host address.
<TUNNEL_IPV4_ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameConfigure the remote IPv4 address to named address object.
<TUNNEL_IPV4_ADDR_HOST_NAME> Host address object name.
Example: Web Server

Example

remote ipv4-address host 198.165.165.4

Syntax

no remote ipv4-address

Mode

Manual Tunnel Interface

Description

Clear the remote IPv4 address.

Example

no remote ipv4-address

Syntax

remote ipv6-network { group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> }

Mode

Manual Tunnel Interface

Description

Configure the remote IPv6 network.

Options

 
groupConfigure the remote IPv6 network to named address object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostConfigure the remote network to host address.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameConfigure the remote IPv6 network to named address object.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkConfigure the remote network to network address.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeConfigure the remote network to range of addresses.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

remote ipv6-network name IPv6RemoteNetwork

Syntax

no remote ipv6-network

Mode

Manual Tunnel Interface

Description

Clear the remote IPv6 network.

Example

no remote ipv6-network

Syntax

bound-to { any | interface <IPV6_TUNNEL_BOUND_TO_INTERFACE> }

Mode

Manual Tunnel Interface

Description

Set tunnel interface bound to.

Options

 
anyBound to any interface.
 
interfaceBound to interface.
<IPV6_TUNNEL_BOUND_TO_INTERFACE> Interface name.
Example: X0

Example

bound-to interface X1

Syntax

link-mtu <UINT16>

Mode

Manual Tunnel Interface

Description

Set tunnel interface link MTU.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

link-mtu 1500

Syntax

remote ipv4-address { host <TUNNEL_IPV4_ADDR_HOST> | name <TUNNEL_IPV4_ADDR_HOST_NAME> }

Mode

GRE Tunnel Interface

Description

Configure the remote IPv4 address.

Options

 
hostConfigure the remote IPv4 address to host address.
<TUNNEL_IPV4_ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameConfigure the remote IPv4 address to named address object.
<TUNNEL_IPV4_ADDR_HOST_NAME> Host address object name.
Example: Web Server

Example

remote ipv4-address host 198.165.165.4

Syntax

no remote ipv4-address

Mode

GRE Tunnel Interface

Description

Clear the remote IPv4 address.

Example

no remote ipv4-address

Syntax

remote ipv6-network { group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> }

Mode

GRE Tunnel Interface

Description

Configure the remote IPv6 network.

Options

 
groupConfigure the remote IPv6 network to named address object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostConfigure the remote network to host address.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameConfigure the remote IPv6 network to named address object.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkConfigure the remote network to network address.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeConfigure the remote network to range of addresses.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

remote ipv6-network name IPv6RemoteNetwork

Syntax

no remote ipv6-network

Mode

GRE Tunnel Interface

Description

Clear the remote IPv6 network.

Example

no remote ipv6-network

Syntax

bound-to { any | interface <IPV6_TUNNEL_BOUND_TO_INTERFACE> }

Mode

GRE Tunnel Interface

Description

Set tunnel interface bound to.

Options

 
anyBound to any interface.
 
interfaceBound to interface.
<IPV6_TUNNEL_BOUND_TO_INTERFACE> Interface name.
Example: X0

Example

bound-to interface X1

Syntax

link-mtu <UINT16>

Mode

GRE Tunnel Interface

Description

Set tunnel interface link MTU.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

link-mtu 1500

Syntax

enable

Mode

6to4 Tunnel Interface

Description

Enable IPv6 6to4 tunnel.

Example

enable

Syntax

no enable

Mode

6to4 Tunnel Interface

Description

Disable IPv6 6to4 tunnel.

Example

no enable

Syntax

link-mtu <UINT16>

Mode

6to4 Tunnel Interface

Description

Set tunnel interface link MTU.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

link-mtu 1500

Syntax

bound-to interface <IPV6_TUNNEL_BOUND_TO_INTERFACE>

Mode

6rd Tunnel Interface

Description

Set tunnel interface bound to.

Options

interfaceBound to interface.
<IPV6_TUNNEL_BOUND_TO_INTERFACE> Interface name.
Example: X0

Example

bound-to interface X1

Syntax

no bound-to

Mode

6rd Tunnel Interface

Description

Clear tunnel interface bound to.

Example

no bound-to

Syntax

dynamic

Mode

6rd Tunnel Interface

Description

Enable dynamic acquisition of IP configuration data.

Example

dynamic

Syntax

no dynamic

Mode

6rd Tunnel Interface

Description

Disable dynamic acquisition of IP configuration data.

Example

no dynamic

Syntax

6rd prefix <IPV6_HOST>

Mode

6rd Tunnel Interface

Description

Set tunnel interface 6rd prefix.

Options

<IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b

Example

6rd prefix 2001::

Syntax

no 6rd prefix

Mode

6rd Tunnel Interface

Description

Clear tunnel interface 6rd prefix.

Example

no 6rd prefix

Syntax

6rd prefix-length <UINT8>

Mode

6rd Tunnel Interface

Description

Set tunnel interface 6rd prefix length.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

6rd prefix-length 64

Syntax

no 6rd prefix-length

Mode

6rd Tunnel Interface

Description

Clear tunnel interface 6rd prefix length.

Example

no 6rd prefix-length

Syntax

border-relay-ipv4-address <IPV4_HOST>

Mode

6rd Tunnel Interface

Description

Set tunnel interface border relay IPv4 address.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

border-relay-ipv4-address 10.10.10.10

Syntax

no border-relay-ipv4-address

Mode

6rd Tunnel Interface

Description

Clear tunnel interface border relay IPv4 address.

Example

no border-relay-ipv4-address

Syntax

mask-length <UINT8>

Mode

6rd Tunnel Interface

Description

Set tunnel interface IPv4 mask length.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

mask-length 64

Syntax

no mask-length

Mode

6rd Tunnel Interface

Description

Clear tunnel interface IPv4 mask length.

Example

no mask-length

Syntax

link-mtu <UINT16>

Mode

6rd Tunnel Interface

Description

Set tunnel interface link MTU.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

link-mtu 1500

Syntax

default-route

Mode

6rd Tunnel Interface

Description

Enable add default route.

Example

default-route

Syntax

no default-route

Mode

6rd Tunnel Interface

Description

Disable add default route.

Example

no default-route

Syntax

bound-to interface <IPV6_TUNNEL_BOUND_TO_INTERFACE>

Mode

ISATAP Tunnel Interface

Description

Set tunnel interface bound to.

Options

interfaceBound to interface.
<IPV6_TUNNEL_BOUND_TO_INTERFACE> Interface name.
Example: X0

Example

bound-to interface X1

Syntax

no bound-to

Mode

ISATAP Tunnel Interface

Description

Clear tunnel interface bound to.

Example

no bound-to

Syntax

prefix { name <ISATAP_ADDR_NETWORK_NAME> | network <ISATAP_ADDR_NETWORK> <ISATAP_ADDR_MASK> }

Mode

ISATAP Tunnel Interface

Description

Set tunnel interface IPv6 subnet prefix.

Options

 
nameSet tunnel interface IPv6 subnet prefix to named address object.
<ISATAP_ADDR_NETWORK_NAME> Network address object name.
Example: Sales Network
 
networkSet tunnel interface IPv6 subnet prefix to network address.
<ISATAP_ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ISATAP_ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n

Example

prefix name ipv6Network

Syntax

no prefix

Mode

ISATAP Tunnel Interface

Description

Clear tunnel interface IPv6 subnet prefix.

Example

no prefix

Syntax

link-mtu <UINT16>

Mode

ISATAP Tunnel Interface

Description

Set tunnel interface link MTU.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

link-mtu 1500

Syntax

ipv6-traffic

Mode

Interface IPv6

Description

Enable IPv6 traffic on this interface.

Example

ipv6-traffic

Syntax

no ipv6-traffic

Mode

Interface IPv6

Description

Disable IPv6 traffic on this interface.

Example

no ipv6-traffic

Syntax

listen-router-advertisement

Mode

Interface IPv6

Description

Enable listening to route advertisement.

Example

listen-router-advertisement

Syntax

no listen-router-advertisement

Mode

Interface IPv6

Description

Disable listening to route advertisement.

Example

no listen-router-advertisement

Syntax

stateless-address-autoconfig

Mode

Interface IPv6

Description

Enable stateless address autoconfiguration.

Example

stateless-address-autoconfig

Syntax

no stateless-address-autoconfig

Mode

Interface IPv6

Description

Disable stateless address autoconfiguration.

Example

no stateless-address-autoconfig

Syntax

duplicate-address-detection-transmits <UINT8>

Mode

Interface IPv6

Description

Set duplicate address detection transmits.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

duplicate-address-detection-transmits 1

Syntax

no duplicate-address-detection-transmits

Mode

Interface IPv6

Description

Clear duplicate address detection transmits.

Example

no duplicate-address-detection-transmits

Syntax

reachable-time <UINT16>

Mode

Interface IPv6

Description

Set neighbor discovery base reachable time in seconds.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

reachable-time 30

Syntax

no reachable-time

Mode

Interface IPv6

Description

Clear neighbor discovery base reachable time.

Example

no reachable-time

Syntax

max ndp-size <UINT32>

Mode

Interface IPv6

Description

Set max NDP size per interface.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

max ndp-size 30

Syntax

no max ndp-size

Mode

Interface IPv6

Description

Clear max NDP size per interface.

Example

no max ndp-size

Syntax

ip-assignment { auto | dhcpv6 | l2bridge | static }

Mode

Interface IPv6

Description

Set interface IPv6 assignment.

Options

 
autoInterface IPv6 configuration set to auto.
 
dhcpv6Interface IPv6 configuration obtained by dhcpv6.
 
l2bridgeInterface uses layer two bridging.
 
staticStatic IPv6 configuration assignment.

Example

ip-assignment dhcpv6

ip-assignment static
ip-assignment auto

Syntax

no ip-assignment

Mode

Interface IPv6

Description

Clear interface IPv6 assignment.

Example

no ip-assignment

Syntax

ip <IPV6_HOST>

Mode

Static IPv6 Assignment

Description

Set interface IPv6 address.

Options

<IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b

Example

ip 3ffe:1900:4545::f8ff:fe21:67cf

Syntax

no ip

Mode

Static IPv6 Assignment

Description

Clear interface IPv6 address.

Example

no ip

Syntax

backup-ip <IPV6_HOST>

Mode

Static IPv6 Assignment

Description

Set MGMT interface IPv6 address (Secondary).

Options

<IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b

Example

backup-ip 10.10.10.10

Syntax

no backup-ip

Mode

Static IPv6 Assignment

Description

Clear MGMT interface IPv6 address (Secondary).

Example

no backup-ip

Syntax

prefix-length <UINT8>

Mode

Static IPv6 Assignment

Description

Set interface IPv6 prefix length.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

prefix-length 64

Syntax

dns primary <IPV6_HOST>

Mode

Static IPv6 Assignment

Description

Set the primary DNS server IP address.

Options

<IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b

Example

dns primary 3ffe:1900:4545::f8ff:fe21:67cf

Syntax

dns secondary <IPV6_HOST>

Mode

Static IPv6 Assignment

Description

Set the secondary DNS server IP address.

Options

<IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b

Example

dns secondary 3ffe:1900:4545::f8ff:fe21:67cf

Syntax

dns ternary <IPV6_HOST>

Mode

Static IPv6 Assignment

Description

Set the ternary DNS server IP address.

Options

<IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b

Example

dns ternary 3ffe:1900:4545::f8ff:fe21:67cf

Syntax

no dns primary

Mode

Static IPv6 Assignment

Description

Clear the primary DNS server IP address.

Example

no dns primary

Syntax

no dns secondary

Mode

Static IPv6 Assignment

Description

Clear the secondary DNS server IP address.

Example

no dns secondary

Syntax

no dns ternary

Mode

Static IPv6 Assignment

Description

Clear the ternary DNS server IP address.

Example

no dns ternary

Syntax

gateway <IPV6_HOST>

Mode

Static IPv6 Assignment

Description

Set interface gateway.

Options

<IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b

Example

gateway 3ffe:1900:4545:201::202

Syntax

no gateway

Mode

Static IPv6 Assignment

Description

Clear interface gateway.

Example

no gateway

Syntax

advertise subnet-prefix

Mode

Static IPv6 Assignment

Description

Enable advertise subnet prefix of IPv6 primary static address.

Example

advertise subnet-prefix

Syntax

no advertise subnet-prefix

Mode

Static IPv6 Assignment

Description

Disable advertise subnet prefix of IPv6 primary static address.

Example

no advertise subnet-prefix

Syntax

extra-ip { 6rd | prefix-delegation | static } <IPV6_EXTRA_ADDR>

Mode

Static IPv6 Assignment

Description

Add/edit extra interface IPv6 address.

Options

 
6rdAdd downstream IPv6 address delegated from 6rd
 
prefix-delegationAdd downstream IPv6 address delegated from DHCP-PD
 
staticAdd statioc IPv6 address
<IPV6_EXTRA_ADDR> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b

Example

extra-ip static 3ffe:1900:4545::f8ff:fe21:67c2

Syntax

no extra-ip { 6rd | prefix-delegation | static } <IPV6_EXTRA_ADDR>

Mode

Static IPv6 Assignment

Description

Delete extra interface IPv6 address.

Options

 
6rdDelete downstream IPv6 address delegated from 6rd
 
prefix-delegationDelete downstream IPv6 address delegated from DHCP-PD
 
staticDelete statioc IPv6 address
<IPV6_EXTRA_ADDR> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b

Example

no extra-ip static 3ffe:1900:4545::f8ff:fe21:67c2

Syntax

no extra-ipv6-addresses

Mode

Static IPv6 Assignment

Description

Delete all extra interface IPv6 addresses.

Example

no extra-ipv6-addresses

Syntax

router-advertisement

Mode

Static IPv6 Assignment

L2 Bridge IPv6 Assignment

Description

Enter router advertisement configuration mode.

Example

router-advertisement

Syntax

multicast

Mode

Interface IPv6

Description

Enable IPv6 multicast support.

Example

multicast

Syntax

no multicast

Mode

Interface IPv6

Description

Disable IPv6 multicast support.

Example

no multicast

Syntax

type { 6rd | prefix-delegation | static }

Mode

IPv6 Extra Address

Description

Set interface IPv6 extra address type.

Options

 
6rdAdd downstream IPv6 address delegated from 6rd
 
prefix-delegationAdd downstream IPv6 address delegated from DHCP-PD
 
staticAdd statioc IPv6 address

Example

type static

Syntax

ip <IPV6_EXTRA_ADDR>

Mode

IPv6 Extra Address

Description

Set interface IPv6 address.

Options

<IPV6_EXTRA_ADDR> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b

Example

ip 3ffe:1900:4545::f8ff:fe21:67cf

Syntax

prefix-length <UINT8>

Mode

IPv6 Extra Address

Description

Set interface IPv6 prefix length.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

prefix-length 64

Syntax

delegated-prefix name <DELEGATED_PREFIX_ADDR_HOST_NAME>

Mode

IPv6 Extra Address

Description

Set delegated prefix assignment.

Options

nameSet delegated prefix to named address object.
<DELEGATED_PREFIX_ADDR_HOST_NAME> Host address object name.
Example: Web Server

Example

delegated-prefix-assignment

Syntax

no delegated-prefix

Mode

IPv6 Extra Address

Description

Clear delegated prefix assignment.

Example

no delegated-prefix

Syntax

preferred ip <IPV6_HOST>

Mode

IPv6 Extra Address

Description

Set interface preferred IPv6 address.

Options

<IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b

Example

preferred ip 3ffe:1900:4545::f8ff:fe21:67cf

Syntax

preferred prefix-length <UINT8>

Mode

IPv6 Extra Address

Description

Set interface IPv6 preferred prefix length.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

preferred prefix-length 64

Syntax

no preferred prefix-length

Mode

IPv6 Extra Address

Description

Clear interface IPv6 preferred prefix length.

Example

no preferred prefix-length

Syntax

advertise subnet-prefix

Mode

IPv6 Extra Address

Description

Enable advertise subnet prefix of IPv6 address.

Example

advertise subnet-prefix

Syntax

no advertise subnet-prefix

Mode

IPv6 Extra Address

Description

Disable advertise subnet prefix of IPv6 address.

Example

no advertise subnet-prefix

Syntax

enable

Mode

Static IPv6 Assignment Router Advertisement

Description

Enable IPv6 router advertisement.

Example

enable

Syntax

no enable

Mode

Static IPv6 Assignment Router Advertisement

Description

Disable IPv6 router advertisement.

Example

no enable

Syntax

interval { max <UINT32> | min <UINT32> }

Mode

Static IPv6 Assignment Router Advertisement

Description

Set IPv6 router advertisement interval range.

Options

 
maxRouter advertisement interval range maximum.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123
 
minRouter advertisement interval range minimum.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

interval min 200

Syntax

link-mtu <UINT32>

Mode

Static IPv6 Assignment Router Advertisement

Description

Set IPv6 router advertisement link MTU.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

link-mtu 1400

Syntax

no link-mtu

Mode

Static IPv6 Assignment Router Advertisement

Description

Set IPv6 router advertisement link MTU as unspecified.

Example

no link-mtu

Syntax

reachable-time <UINT32>

Mode

Static IPv6 Assignment Router Advertisement

Description

Set the time the node assumes the neighbor is reachable in seconds.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

reachable-time 5

Syntax

no reachable-time

Mode

Static IPv6 Assignment Router Advertisement

Description

Clear the time the node assumes the neighbor is reachable as unspecified.

Example

no reachable-time

Syntax

retransmit-timer <UINT32>

Mode

Static IPv6 Assignment Router Advertisement

Description

Set the time between retransmitted neighbor solicitation messages in seconds.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

retransmit-timer 30

Syntax

no retransmit-timer

Mode

Static IPv6 Assignment Router Advertisement

Description

Clear the time between retransmitted neighbor solicitation messages as unspecified.

Example

no retransmit-timer

Syntax

current-hop-limit <UINT8>

Mode

Static IPv6 Assignment Router Advertisement

Description

Set current hop limit.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

current-hop-limit 64

Syntax

no current-hop-limit

Mode

Static IPv6 Assignment Router Advertisement

Description

Set current hop limit as unspecified.

Example

no current-hop-limit

Syntax

router-lifetime <UINT16>

Mode

Static IPv6 Assignment Router Advertisement

Description

Set the lifetime when a router is accepted as the default router in seconds.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

router-lifetime 1800

Syntax

no router-lifetime

Mode

Static IPv6 Assignment Router Advertisement

Description

Set the lifetime when a router is accepted as the default router as unspecified.

Example

no router-lifetime

Syntax

managed

Mode

Static IPv6 Assignment Router Advertisement

Description

Enable IPv6 addresses as available via stateful addresses configuration.

Example

managed

Syntax

no managed

Mode

Static IPv6 Assignment Router Advertisement

Description

Disable IPv6 addresses as available via stateful addresses configuration.

Example

no managed

Syntax

other-config

Mode

Static IPv6 Assignment Router Advertisement

Description

Enable non-address configuration as available via stateful addresses configuration.

Example

other-config

Syntax

no other-config

Mode

Static IPv6 Assignment Router Advertisement

Description

Disable non-address configuration as available via stateful addresses configuration.

Example

no other-config

Syntax

prefix <IPV6_ADVERTISING_PREFIX>

Mode

Static IPv6 Assignment Router Advertisement

Description

Add/edit advertising prefix.

Options

<IPV6_ADVERTISING_PREFIX> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2001::

Example

prefix 2001:1:1:1::

Syntax

no prefix <IPV6_ADVERTISING_PREFIX>

Mode

Static IPv6 Assignment Router Advertisement

Description

Delete the specified advertising prefix.

Options

<IPV6_ADVERTISING_PREFIX> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2001::

Example

no prefix 2001:1:1:1::

Syntax

no prefixes

Mode

Static IPv6 Assignment Router Advertisement

Description

Delete all advertising prefixes.

Example

no prefixes

Syntax

prefix <IPV6_ADVERTISING_PREFIX>

Mode

Static IPv6 Assignment Router Advertisement Prefix

Description

Set advertising prefix.

Options

<IPV6_ADVERTISING_PREFIX> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2001::

Example

prefix 2001:1:1:1::

Syntax

valid-lifetime <UINT32>

Mode

Static IPv6 Assignment Router Advertisement Prefix

Description

Set advertising prefix valid lifetime in minutes.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

valid-lifetime 10

Syntax

preferred lifetime <UINT32>

Mode

Static IPv6 Assignment Router Advertisement Prefix

Description

Set advertising prefix valid preferred lifetime in minutes.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

preferred lifetime 10

Syntax

on-link

Mode

Static IPv6 Assignment Router Advertisement Prefix

Description

Enable using prefix for on-link determination.

Example

on-link

Syntax

no on-link

Mode

Static IPv6 Assignment Router Advertisement Prefix

Description

Disable using prefix for on-link determination.

Example

no on-link

Syntax

autonomous

Mode

Static IPv6 Assignment Router Advertisement Prefix

Description

Enable autonomous address configuration indicating prefix can be used for stateless address configuration.

Example

autonomous

Syntax

no autonomous

Mode

Static IPv6 Assignment Router Advertisement Prefix

Description

Disable autonomous address configuration.

Example

no autonomous

Syntax

prefix-delegation

Mode

DHCPv6 Assignment

Description

Enable DHCPv6 prefix delegation.

Example

prefix-delegation

Syntax

no prefix-delegation

Mode

DHCPv6 Assignment

Description

Disable DHCPv6 prefix delegation.

Example

no prefix-delegation

Syntax

preferred <IPV6_HOST> <UINT8>

Mode

Prefix delegation

Description

Enable send preferred delegated prefix.

Options

<IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b
<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

preferred 2001:: 64

Syntax

no preferred

Mode

Prefix delegation

Description

Disable send preferred delegated prefix.

Example

no preferred

Syntax

send-hints

Mode

Prefix delegation

Description

Enable send hints for renewing previous delegated prefix on startup.

Example

send-hints

Syntax

no send-hints

Mode

Prefix delegation

Description

Disable send hints for renewing previous delegated prefix on startup.

Example

no send-hints

Syntax

rapid-commit

Mode

DHCPv6 Assignment

Description

Enable use rapid commit option.

Example

rapid-commit

Syntax

no rapid-commit

Mode

DHCPv6 Assignment

Description

Disable use rapid commit option.

Example

no rapid-commit

Syntax

send-hints

Mode

DHCPv6 Assignment

Description

Enable send hints for renewing previous IP on startup.

Example

send-hints

Syntax

no send-hints

Mode

DHCPv6 Assignment

Description

Disable send hints for renewing previous IP on startup.

Example

no send-hints

Syntax

mode { auto | manual }

Mode

DHCPv6 Assignment

Description

Set dhcpv6 mode.

Options

 
autoAutomatic.
 
manualManual.

Example

mode manual

Syntax

info-only

Mode

DHCPv6 Assignment

Description

Enable only request stateless infomation.

Example

info-only

Syntax

no info-only

Mode

DHCPv6 Assignment

Description

Disable only request stateless infomation.

Example

no info-only

Syntax

release delegated-prefix

Mode

DHCPv6 Assignment

Description

Release designated interface lease or delegated prefixes acquired via DHCPv6.

Options

delegated-prefixRelease delegated prefixes acquired via DHCPv6.

Example

release

Syntax

renew delegated-prefix

Mode

DHCPv6 Assignment

Description

Renew designated interface lease or delegated prefixes acquired via DHCPv6.

Options

delegated-prefixRenew delegated prefixes acquired via DHCPv6.

Example

renew

Syntax

enable

Mode

IPv6 DHCP Server

Description

Enable IPv6 DHCP server.

Example

enable

Syntax

no enable

Mode

IPv6 DHCP Server

Description

Disable IPv6 DHCP server.

Example

no enable

Syntax

option object <DHCP_OPTION_OBJECT>

Mode

IPv6 DHCP Server

Description

Add/edit IPv6 DHCP server option object.

Options

<DHCP_OPTION_OBJECT> DHCP server option object name.
Example: Corp Network DHCP Options

Example

option object "LAN Specific DHCP Option"

Syntax

no option object <DHCP_OPTION_OBJECT>

Mode

IPv6 DHCP Server

Description

Delete IPv6 DHCP server option object.

Options

<DHCP_OPTION_OBJECT> DHCP server option object name.
Example: Corp Network DHCP Options

Example

no option object "LAN Specific DHCP Option"

Syntax

no option objects

Mode

IPv6 DHCP Server

Description

Delete all IPv6 DHCP server option objects.

Example

no option objects

Syntax

name <DHCP_OPTION_OBJECT>

Mode

IPv6 DHCP Option Object

Description

Set IPv6 DHCP server option object name.

Options

<DHCP_OPTION_OBJECT> DHCP server option object name.
Example: Corp Network DHCP Options

Example

name "LAN Specific DHCP Option"

Syntax

number <DHCP_IPV6_OPTION_OBJECT_NUMBER>

Mode

IPv6 DHCP Option Object

Description

Set IPv6 DHCP server option object number.

Options

<DHCP_IPV6_OPTION_OBJECT_NUMBER> IPv6 DHCP server option object number.
Example: 12

Example

number 12

Syntax

array

Mode

IPv6 DHCP Option Object

Description

Enable IPv6 DHCP server option object array.

Example

array

Syntax

no array

Mode

IPv6 DHCP Option Object

Description

Disable IPv6 DHCP server option object array.

Example

no array

Syntax

value { boolean <UINT8> | domain-name <HOSTNAME> | four-byte <UINT32> | ip <IPV6_HOST> | one-byte <UINT8> | string <WORD> | two-byte <UINT16> }

Mode

IPv6 DHCP Option Object

Description

Set IPv6 DHCP server option object value. If Option Array is checked , multiple values can be entered separated by ;.

Options

 
booleanOption object type: boolean.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
 
domain-nameOption object type: domain name.
<HOSTNAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com
 
four-byteOption object type: four byte data.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123
 
ipOption object type: IP address.
<IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b
 
one-byteOption object type: one byte.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
 
stringOption object type: string.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
two-byteOption object type: two byte.
<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

value ip fe80::1

value domain-name domainName
value four-byte 123
value two-byte 123
value one-byte 23
value string "String value"
value boolean 0

Syntax

no value

Mode

IPv6 DHCP Option Object

Description

Clear IPv6 DHCP server option object value.

Example

no value

Syntax

option group <DHCP_OPTION_GROUP>

Mode

IPv6 DHCP Server

Description

Add/edit IPv6 DHCP server option group.

Options

<DHCP_OPTION_GROUP> DHCP server option group name.
Example: Corp Network DHCP Group

Example

option group "LAN Specific DHCP Options"

Syntax

no option group <DHCP_OPTION_GROUP>

Mode

IPv6 DHCP Server

Description

Delete one IPv6 DHCP server option group.

Options

<DHCP_OPTION_GROUP> DHCP server option group name.
Example: Corp Network DHCP Group

Example

no option group "LAN Specific DHCP Options"

Syntax

no option groups

Mode

IPv6 DHCP Server

Description

Delete all IPv6 DHCP server option groups.

Example

no option groups

Syntax

name <DHCP_OPTION_GROUP>

Mode

IPv6 DHCP Server Option Group

Description

Set IPv6 DHCP server option group name.

Options

<DHCP_OPTION_GROUP> DHCP server option group name.
Example: Corp Network DHCP Group

Example

name "LAN Specific DHCP Options"

Syntax

option object <DHCP_OPTION_OBJECT>

Mode

IPv6 DHCP Server Option Group

Description

Add IPv6 DHCP server option object to group.

Options

<DHCP_OPTION_OBJECT> DHCP server option object name.
Example: Corp Network DHCP Options

Example

option object "Specific DHCP Options"

Syntax

no option object <DHCP_OPTION_GROUP_OBJECT>

Mode

IPv6 DHCP Server Option Group

Description

Remove IPv6 DHCP server option object from group.

Options

<DHCP_OPTION_GROUP_OBJECT> DHCP server option object name in specify option group.
Example: Corp Network DHCP Group

Example

no option object "Specific DHCP Options"

Syntax

option group <DHCP_OPTION_GROUP>

Mode

IPv6 DHCP Server Option Group

Description

Add IPv6 DHCP server option group to group.

Options

<DHCP_OPTION_GROUP> DHCP server option group name.
Example: Corp Network DHCP Group

Example

option group "Specific DHCP Options"

Syntax

no option group <DHCP_OPTION_GROUP_GROUP>

Mode

IPv6 DHCP Server Option Group

Description

Remove IPv6 DHCP server option group from group.

Options

<DHCP_OPTION_GROUP_GROUP> DHCP server option group name in specify option group.
Example: Corp Network DHCP Group

Example

no option group "Specific DHCP Options"

Syntax

scope dynamic <DHCP_IPV6_DYNAMIC_SCOPE_NAME>

Mode

IPv6 DHCP Server

Description

Add/edit IPv6 DHCP dynamic scope and enter its configuration mode.

Options

<DHCP_IPV6_DYNAMIC_SCOPE_NAME> IPv6 DHCP server dynamic scope name.
Example: abc

Example

scope dynamic "dyanmicScope"

Syntax

no scope dynamic <DHCP_IPV6_DYNAMIC_SCOPE_NAME>

Mode

IPv6 DHCP Server

Description

Delete one IPv6 DHCP dynamic scope.

Options

<DHCP_IPV6_DYNAMIC_SCOPE_NAME> IPv6 DHCP server dynamic scope name.
Example: abc

Example

no scope dynamic "dyanmicScope"

Syntax

no scopes dynamic

Mode

IPv6 DHCP Server

Description

Delete all IPv6 DHCP server dynamic scope.

Example

no scopes dynamic

Syntax

name <DHCP_IPV6_DYNAMIC_SCOPE_NAME>

Mode

IPv6 DHCP Server Dynamic Scope

Description

Set IPv6 DHCP server dynamic scope name.

Options

<DHCP_IPV6_DYNAMIC_SCOPE_NAME> IPv6 DHCP server dynamic scope name.
Example: abc

Example

name "Dynamic Scope Name"

Syntax

enable

Mode

IPv6 DHCP Server Dynamic Scope

Description

Enable IPv6 DHCP server dynamic scope.

Example

enable

Syntax

no enable

Mode

IPv6 DHCP Server Dynamic Scope

Description

Disable IPv6 DHCP server dynamic scope.

Example

no enable

Syntax

prefix <IPV6_HOST>

Mode

IPv6 DHCP Server Dynamic Scope

Description

Set IPv6 DHCP server dynamic scope prefix.

Options

<IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b

Example

prefix fe00::

Syntax

no prefix

Mode

IPv6 DHCP Server Dynamic Scope

Description

Clear IPv6 DHCP server dynamic scope prefix.

Example

no prefix

Syntax

range <IPV6_HOST> <IPV6_HOST>

Mode

IPv6 DHCP Server Dynamic Scope

Description

Set IPv6 DHCP dynamic scope range.

Options

<IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b
<IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b

Example

range fe00::1 fe00::2014

Syntax

no range

Mode

IPv6 DHCP Server Dynamic Scope

Description

Clear IPv6 DHCP servr dynamic scope range.

Example

no range

Syntax

valid-lifetime <UINT32>

Mode

IPv6 DHCP Server Dynamic Scope

Description

Set IPv6 DHCP server dynamic scope valid lifetime (minutes).

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

valid-lifetime 2160

Syntax

no valid-lifetime

Mode

IPv6 DHCP Server Dynamic Scope

Description

Clear IPv6 DHCP server dynamic scope valid lifetime.

Example

no valid-lifetime

Syntax

preferred-lifetime <UINT32>

Mode

IPv6 DHCP Server Dynamic Scope

Description

Set IPv6 DHCP server dynamic scope preferred lifetime (minutes).

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

preferred-lifetime 1440

Syntax

no preferred-lifetime

Mode

IPv6 DHCP Server Dynamic Scope

Description

Clear IPv6 DHCP server dynamic scope preferred lifetime.

Example

no preferred-lifetime

Syntax

comment <WORD>

Mode

IPv6 DHCP Server Dynamic Scope

Description

Set IPv6 DHCP server dynamic scope comment.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

comment "Comment for dynamic scope"

Syntax

no comment

Mode

IPv6 DHCP Server Dynamic Scope

Description

Clear IPv6 DHCP server dynamic scope comment.

Example

no comment

Syntax

always-send-option

Mode

IPv6 DHCP Server Dynamic Scope

Description

Enable IPv6 DHCP server dynamic scope always send IPv6 options.

Example

always-send-option

Syntax

no always-send-option

Mode

IPv6 DHCP Server Dynamic Scope

Description

Diable IPv6 DHCP server dynamic scope always send IPv6 options.

Example

no always-send-option

Syntax

domain-name <HOSTNAME>

Mode

IPv6 DHCP Server Dynamic Scope

Description

Set IPv6 DHCP server dynamic scope domain name.

Options

<HOSTNAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com

Example

domain-name example.com

Syntax

no domain-name

Mode

IPv6 DHCP Server Dynamic Scope

Description

Clear IPv6 DHCP server dynamic scope domain name.

Example

no domain-name

Syntax

dns server { inherit | primary <IPV6_HOST> | secondary <IPV6_HOST> | tertiary <IPV6_HOST> }

Mode

IPv6 DHCP Server Dynamic Scope

Description

set IPv6 DHCP server DNS settings or inherit DNS settings dynamically from the sonicwall's DNS settings.

Options

 
inheritInherit DNS servers.
 
primarySpecify primary DNS server IP address.
<IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b
 
secondarySpecify secondary DNS server IP address.
<IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b
 
tertiarySpecify tertiary DNS server IP address.
<IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b

Example

dns server primary fe80::1

dns server inherit

Syntax

no dns server { primary | secondary | tertiary }

Mode

IPv6 DHCP Server Dynamic Scope

Description

Clear IPv6 DHCP server dynamic scope DNS server IP.

Options

 
primaryClear primary DNS server IP address.
 
secondaryClear secondary DNS server IP address.
 
tertiaryClear tertiary DNS server IP address.

Example

no dns server primary

Syntax

generic-option { group <DHCP_OPTION_GROUP> | object <DHCP_OPTION_OBJECT> }

Mode

IPv6 DHCP Server Dynamic Scope

Description

Set IPv6 DHCP server option object or group for dynamic scope.

Options

 
groupSet IPv6 DHCP server option group for dynamic scope.
<DHCP_OPTION_GROUP> DHCP server option group name.
Example: Corp Network DHCP Group
 
objectSet IPv6 DHCP server option object for dynamic scope.
<DHCP_OPTION_OBJECT> DHCP server option object name.
Example: Corp Network DHCP Options

Example

generic-option object "Specific object DHCP Option" generic-option group "Specific Group DHCP Option"

Syntax

no generic-option

Mode

IPv6 DHCP Server Dynamic Scope

Description

Clear IPv6 DHCP server dynamic scope generic option.

Example

no generic-option

Syntax

scope static <DHCP_IPV6_STATIC_SCOPE_NAME>

Mode

IPv6 DHCP Server

Description

Add/edit IPv6 DHCP server static scope.

Options

<DHCP_IPV6_STATIC_SCOPE_NAME> IPv6 DHCP server static scope name.
Example: abc

Example

scope static "dhcps6StaticName"

Syntax

no scope static <DHCP_IPV6_STATIC_SCOPE_NAME>

Mode

IPv6 DHCP Server

Description

Delete IPv6 DHCP server static scope.

Options

<DHCP_IPV6_STATIC_SCOPE_NAME> IPv6 DHCP server static scope name.
Example: abc

Example

no scope static fe00::1

Syntax

no scopes static

Mode

IPv6 DHCP Server

Description

Delete all IPv6 DHCP server static scopes.

Example

no scopes static

Syntax

enable

Mode

IPv6 DHCP Server Static Scope

Description

Enable IPv6 DHCP server static scope.

Example

enable

Syntax

no enable

Mode

IPv6 DHCP Server Static Scope

Description

Disable IPv6 DHCP server static scope.

Example

no enable

Syntax

name <DHCP_IPV6_STATIC_SCOPE_NAME>

Mode

IPv6 DHCP Server Static Scope

Description

Set IPv6 DHCP server static scope name.

Options

<DHCP_IPV6_STATIC_SCOPE_NAME> IPv6 DHCP server static scope name.
Example: abc

Example

name "Static scope Name"

Syntax

no name

Mode

IPv6 DHCP Server Static Scope

Description

Clear IPv6 DHCP server static scope name.

Example

no name

Syntax

prefix <IPV6_HOST>

Mode

IPv6 DHCP Server Static Scope

Description

Set IPv6 DHCP server static scope prefix.

Options

<IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b

Example

prefix fe00::

Syntax

no prefix

Mode

IPv6 DHCP Server Static Scope

Description

Clear IPv6 DHCP server static scope prefix.

Example

no prefix

Syntax

ip <IPV6_HOST>

Mode

IPv6 DHCP Server Static Scope

Description

Set IPv6 DHCP server static scope IP.

Options

<IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b

Example

ip fe80::10

Syntax

no ip

Mode

IPv6 DHCP Server Static Scope

Description

Clear IPv6 DHCP server static scope IP.

Example

no ip

Syntax

iaid <UINT32>

Mode

IPv6 DHCP Server Static Scope

Description

Set IPv6 DHCP server static scope IAID.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

iaid 2014

Syntax

no iaid

Mode

IPv6 DHCP Server Static Scope

Description

Clear IPv6 DHCP server static scope IAID.

Example

no iaid

Syntax

duid <WORD>

Mode

IPv6 DHCP Server Static Scope

Description

Set IPv6 DHCP server static scope DUID.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

duid 0003000110F0A0F3A23B

Syntax

no duid

Mode

IPv6 DHCP Server Static Scope

Description

Clear IPv6 DHCP server static scope DUID.

Example

no duid

Syntax

lifetime { preferred <UINT32> | valid <UINT32> }

Mode

IPv6 DHCP Server Static Scope

Description

Set IPv6 DHCP server static scope valid or preferred lifetime (minutes).

Options

 
preferredSet IPv6 DHCP server static scope preferred lifetime (minutes).
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123
 
validSet IPv6 DHCP server static scope valid lifetime (minutes).
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

lifetime valid 2160

lifetime preferred 1440

Syntax

no lifetime { preferred | valid }

Mode

IPv6 DHCP Server Static Scope

Description

Clear IPv6 DHCP server static scope valid or preferred lifetime.

Options

 
preferredClear IPv6 DHCP server static scope preferred lifetime.
 
validClear IPv6 DHCP server static scope valid lifetime.

Example

no lifetime valid

no lifetime preferred

Syntax

comment <WORD>

Mode

IPv6 DHCP Server Static Scope

Description

Set IPv6 DHCP server static scope comment.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

commnet "IPv6 DHCP server commnet"

Syntax

no comment

Mode

IPv6 DHCP Server Static Scope

Description

Clear IPv6 DHCP server static scope comment.

Example

no comment

Syntax

send-options-always

Mode

IPv6 DHCP Server Static Scope

Description

Enable send IPv6 DHCP server options always.

Example

send-option-always

Syntax

no send-options-always

Mode

IPv6 DHCP Server Static Scope

Description

Disable send IPv6 DHCP server options always.

Example

no send-option-always

Syntax

domain-name <HOSTNAME>

Mode

IPv6 DHCP Server Static Scope

Description

Set IPv6 DHCP server static scope domain name.

Options

<HOSTNAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com

Example

domain-name "IPv6 DHCP server domain name"

Syntax

no domain-name

Mode

IPv6 DHCP Server Static Scope

Description

Clear IPv6 DHCP server static scope domain name.

Example

no domain-name

Syntax

dns server { inherit | primary <IPV6_HOST> | secondary <IPV6_HOST> | tertiary <IPV6_HOST> }

Mode

IPv6 DHCP Server Static Scope

Description

set IPv6 DHCP server DNS settings or inherit DNS settings dynamically from the SonicWALL's DNS settings.

Options

 
inheritInherit DNS servers.
 
primarySpecify primary DNS server IP address.
<IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b
 
secondarySpecify secondary DNS server IP address.
<IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b
 
tertiarySpecify tertiary DNS server IP address.
<IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b

Example

dns server primary fe80::1

dns server inherit

Syntax

no dns server { primary | secondary | tertiary }

Mode

IPv6 DHCP Server Static Scope

Description

Clear IPv6 DHCP server static scope DNS server IP.

Options

 
primaryClear primary DNS server IP address.
 
secondaryClear secondary DNS server IP address.
 
tertiaryClear tertiary DNS server IP address.

Example

no dns server primary

Syntax

generic-option { group <DHCP_OPTION_GROUP> | object <DHCP_OPTION_OBJECT> }

Mode

IPv6 DHCP Server Static Scope

Description

Set IPv6 DHCP server option object or group for static scope.

Options

 
groupSet IPv6 DHCP server option group for static scope.
<DHCP_OPTION_GROUP> DHCP server option group name.
Example: Corp Network DHCP Group
 
objectSet IPv6 DHCP server option object for static scope.
<DHCP_OPTION_OBJECT> DHCP server option object name.
Example: Corp Network DHCP Options

Example

generic-option object "Specific object DHCP Option" generic-option group "Specific Group DHCP Option"

Syntax

no generic-option

Mode

IPv6 DHCP Server Static Scope

Description

Clear IPv6 DHCP server static scope generic option.

Example

no generic-option

Syntax

no lease <DHCP_IPV6_LEASE_HOST>

Mode

IPv6 DHCP Server

Description

Delete IPv6 DHCP server lease.

Options

<DHCP_IPV6_LEASE_HOST> IPv6 DHCP server lease IP.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b

Example

no lease fe80::100

Syntax

no leases

Mode

IPv6 DHCP Server

Description

Delete all IPv6 DHCP server leases.

Example

no leases

Syntax

show interfaces [ [ ip ] | [ ipv4 | ipv6 ] [ { { physical | vlan } [ pending-config ] } | statistics ] | display-all-traffic | mac ] [ json | validate | xml ]

Mode

All Modes

Description

Show all interfaces.

Options

 
ipShow interfaces IP.
 
 
ipv4Show all IPv4 interfaces.
 
ipv6Show all IPv6 interfaces.
 
 
physicalShow physical interfaces.
 
vlanShow VLAN interfaces.
pending-configShow pending configuration changes.
 
statisticsShow interfaces statistics.
 
display-all-trafficShow interface statistics option.
 
macShow interfaces MAC.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show interfaces

Syntax

show interface [ ipv6 ] <CONFIGURABLE_INTERFACE> [ vlan <VLAN_TAG> ] [ { dialup { data-usage | session-details <WORD> | sessions | status } | ip | mac | pending-config | statistics } ] [ json | validate | xml ]

Mode

All Modes

Description

Show interface configuration.

Options

ipv6Show IPv6 interface configuration.
<CONFIGURABLE_INTERFACE> Interface name.
Example: X0
vlanSub-interface VLAN.
<VLAN_TAG> VLAN tag.
Example: 23
 
dialupShow 3G/Modem status, sessions, or usage.
 
data-usageShow 3G data usage.
 
session-detailsShow 3G session details for specified session.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
sessionsShow 3G sessions.
 
statusShow 3G/Modem status.
 
ipShow interface IP.
 
macShow interface MAC.
 
pending-configShow pending configuration changes.
 
statisticsShow interface statistics.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show interface X0

Syntax

show arp [ cache | entries | entry <ARP_IPV4_HOST> <ARP_MAC> <ARP_INTERFACE> | statistics ] [ { pending-config | with-pending-config } ] [ json | validate | xml ]

Mode

All Modes

Description

Show ARP status or configuration.

Options

 
cacheShow ARP cache.
 
entriesShow all static ARP entries.
 
entryShow a specified static ARP entry.
<ARP_IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
<ARP_MAC> MAC address in the form: HH:HH:HH:HH:HH:HH OR HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD
<ARP_INTERFACE> Interface name.
Example: X0
 
statisticsShow ARP statistics.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show arp

show arp entries
show arp entry 10.10.10.10 00:01:02:03:04:05 X0
show arp cache
show arp statistics

Syntax

show dns [ [ fqdn-binding | rebinding | servers [ ipv4 | ipv6 ] ] [ { pending-config | with-pending-config } ] | cache [ interface-reverse ] ]

Mode

All Modes

Description

Show DNS configuration.

Options

 
 
fqdn-bindingShow DNS binging for FQDN configuration.
 
rebindingShow DNS rebinding attack prevention configuration.
 
serversShow DNS server configuration.
 
ipv4Show IPv4 DNS server configuration.
 
ipv6Show IPv6 DNS server configuration.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
cacheShow DNS cache.
interface-reverseShow interface names reverse DNS cache.

Example

show dns servers

Syntax

show dynamic-dns profiles [ { pending-config | with-pending-config } | status ]

Mode

All Modes

Description

Show all dynamic DNS profiles.

Options

 
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
statusShow all dynamic DNS profiles status.

Example

show dynamic-dns profiles

Syntax

show dynamic-dns profile <DDNS_PROFILE_NAME> [ { pending-config | with-pending-config } | status ]

Mode

All Modes

Description

Show dynamic DNS profile.

Options

<DDNS_PROFILE_NAME> Dynamic DNS profile name.
Example: mydns
 
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
statusShow a dynamic DNS profile status.

Example

show dynamic-dns profile DynDNS.org

Syntax

show dhcp-server [ [ ipv6 [ [ leases [ statistic ] | option { { group <DHCP_OPTION_GROUP> | groups | object <DHCP_OPTION_OBJECT> | objects } } | scope { { dynamic <DHCP_IPV6_DYNAMIC_SCOPE_NAME> | static <DHCP_IPV6_STATIC_SCOPE_NAME> } } | scopes { { dynamic | static } } ] ] ] | [ ipv4 ] [ [ leases [ statistic ] | option { { group <DHCP_OPTION_GROUP> | groups | object <DHCP_OPTION_OBJECT> | objects } } | scope { { dynamic <SCOPE_START_IPV4_HOST> <SCOPE_END_IPV4_HOST> | static <STATIC_SCOPE_IPV4_HOST> <STATIC_SCOPE_MAC> } } | scopes { { dynamic | static } } ] ] ] [ { pending-config | with-pending-config } ] [ json | validate | xml ]

Mode

All Modes

Description

Show DHCP server configuration.

Options

 
ipv6Show IPv6 DHCP server configuration.
 
leasesShow IPv6 DHCP server leases.
statisticShow IPv6 DHCP server leases status.
 
optionIPv6 DHCP server option configuration.
 
groupSpecify option group.
<DHCP_OPTION_GROUP> DHCP server option group name.
Example: Corp Network DHCP Group
 
groupsIPv6 DHCP server all option groups.
 
objectSpecify option object.
<DHCP_OPTION_OBJECT> DHCP server option object name.
Example: Corp Network DHCP Options
 
objectsIPv6 DHCP server all option objects.
 
scopeIPv6 DHCP server static or dynamic scope.
 
dynamicIPv6 DHCP server dynamic configuration.
<DHCP_IPV6_DYNAMIC_SCOPE_NAME> IPv6 DHCP server dynamic scope name.
Example: abc
 
staticIPv6 DHCP server static configuration.
<DHCP_IPV6_STATIC_SCOPE_NAME> IPv6 DHCP server static scope name.
Example: abc
 
scopesIPv6 DHCP server all static or dynamic scopes.
 
dynamicIPv6 DHCP server dynamic configuration.
 
staticIPv6 DHCP server static configuration.
 
ipv4Show IPv4 DHCP server configuration.
 
leasesShow DHCP server leases.
statisticShow DHCP server leases status.
 
optionDHCP server option configuration.
 
groupSpecify option group.
<DHCP_OPTION_GROUP> DHCP server option group name.
Example: Corp Network DHCP Group
 
groupsAll option groups.
 
objectSpecify option object.
<DHCP_OPTION_OBJECT> DHCP server option object name.
Example: Corp Network DHCP Options
 
objectsAll option objects.
 
scopeDHCP server static or dynamic scope.
 
dynamicDHCP server dynamic configuration.
<SCOPE_START_IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
<SCOPE_END_IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
 
staticDHCP server static configuration.
<STATIC_SCOPE_IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
<STATIC_SCOPE_MAC> MAC address in the form: HH:HH:HH:HH:HH:HH OR HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD
 
scopesDHCP server all static or dynamic scopes.
 
dynamicDHCP server dynamic configuration.
 
staticDHCP server static configuration.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show dhcp-server

Syntax

show failover-lb [ group <FLB_GROUP_NAME> | responder | statistics | status ] [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show Failover and Load Balancing status or configuration.

Options

 
groupShow Failover and Load Balancing Group configuration.
<FLB_GROUP_NAME> Failover & LB group name.
Example: myFLBGroup
 
responderShow status for Respond To Probes.
 
statisticsShow Failover and Load Balancing statistics.
 
statusShow status of all Failover and Load Balancing groups.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show failover-lb

Syntax

show ip-helper [ { policies | protocol <IPH_PROTOCOL> | protocols } [ statistics ] | dhcp-relay-leases ] [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show IP helper status or configuration.

Options

 
 
policiesShow all IP helper policies.
 
protocolShow an IP helper relay protocol.
<IPH_PROTOCOL> IP Helper relay protocol name.
Example: mydns
 
protocolsShow all IP helper relay protocols.
statisticsShow statistics for policies or specified protocol.
 
dhcp-relay-leasesShow all IP helper DHCP relay leases.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show ip-helper

Syntax

show mac-ip-anti-spoof [ cache { { entries [ status ] | entry <MAC_IP_ANTI_SPOOF_STATIC_IP> <MAC_IP_ANTI_SPOOF_STATIC_MAC> <MAC_IP_ANTI_SPOOF_STATIC_INTERFACE> } } | detected-list | interface <MAC_IP_ANTI_SPOOF_INTERFACE> | interfaces | lookup-statistics ] [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show MAC-IP anti-spoof configuration and information.

Options

 
cacheShow MAC-IP anti-spoof cache.
 
entriesShow all MAC anti-spoof cache entries.
statusShow all MAC-IP anti-spoof cache entries status.
 
entryShow an MAC anti-spoof cache entry.
<MAC_IP_ANTI_SPOOF_STATIC_IP> MAC-IP anti-spoof static ip.
Example: 192.168.168.168
<MAC_IP_ANTI_SPOOF_STATIC_MAC> MAC-IP anti-spoof static mac.
Example: 00:0C:F1:56:98:AD
<MAC_IP_ANTI_SPOOF_STATIC_INTERFACE> MAC-IP anti-spoof enabled static interface.
Example: X0
 
detected-listShow MAC-IP anti-spoof spoof detected list.
 
interfaceShow MAC-IP anti-spoof interface configuration.
<MAC_IP_ANTI_SPOOF_INTERFACE> MAC-IP anti-spoof interface.
Example: X0
 
interfacesShow MAC-IP anti-spoof configuration for all interfaces.
 
lookup-statisticsShow MAC-IP anti-spoof lookup statistics.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show mac-ip-anti-spoof

Syntax

show nat-policies [ ipv4 | ipv6 ] [ statistics ] [ { custom | default } ] [ { pending-config | with-pending-config } ] [ json | validate | xml ]

Mode

All Modes

Description

Show all NAT policies.

Options

 
ipv4Show only IPv4 NAT policies.
 
ipv6Show only IPv6 NAT policies.
statisticsShow statistics for all nat policies.
 
customShow custom configuration.
 
defaultShow system/factory default configuration.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show nat-policies

Syntax

show nat-policy inbound <NAT_INTERFACE> outbound <NAT_INTERFACE> [ source { { any | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] [ translated-source { { group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | original | range <ADDR_BEGIN> <ADDR_END> } } ] [ destination { { any | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] [ translated-destination { { group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | original | range <ADDR_BEGIN> <ADDR_END> } } ] [ service { { any | group <SVC_GROUP_NAME> | name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ] [ translated-service { { group <SVC_GROUP_NAME> | name <SVC_NAME> | original | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ] [ statistics ] [ { pending-config | with-pending-config } ] [ json | validate | xml ]

Mode

All Modes

Description

Show NAT policy.

Options

<NAT_INTERFACE> Interface name.
Example: X0
outboundOutbound interface.
<NAT_INTERFACE> Interface name.
Example: X0
sourceOriginal source (\"Any\" if not specified).
 
anyAny host.
 
groupAddress object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
translated-sourceTranslated source (\"Original\" if not specified).
 
groupAddress object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
originalOriginal source IP.
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
destinationOriginal destination (\"Any\" if not specified).
 
anyAny host.
 
groupAddress object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
translated-destinationTranslated destination (\"Original\" if not specified).
 
groupAddress object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
originalOriginal destination IP.
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
serviceOriginal service (\"Any\" if not specified).
 
anyAny service.
 
groupService group.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolService object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80
translated-serviceTranslated service (\"Original\" if not specified).
 
groupService group.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
originalOriginal service.
 
protocolService object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80
statisticsShow statistics for specified nat policy.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show nat-policy inbound X3 outbound X4 source any translated-source original destination name "Web Server Public" translated-destination name "Web Server Private" service "My Web Services" translated-service original

Syntax

show nat-policy ipv6 inbound <NAT_INTERFACE> outbound <NAT_INTERFACE> [ source { { any | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] [ translated-source { { group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | original | range <ADDR_BEGIN> <ADDR_END> } } ] [ destination { { any | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] [ translated-destination { { group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | original | range <ADDR_BEGIN> <ADDR_END> } } ] [ service { { any | group <SVC_GROUP_NAME> | name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ] [ translated-service { { group <SVC_GROUP_NAME> | name <SVC_NAME> | original | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ] [ statistics ] [ { pending-config | with-pending-config } ] [ json | validate | xml ]

Mode

All Modes

Description

Show IPv6 NAT policy.

Options

<NAT_INTERFACE> Interface name.
Example: X0
outboundOutbound interface.
<NAT_INTERFACE> Interface name.
Example: X0
sourceOriginal source (\"Any\" if not specified).
 
anyAny host.
 
groupAddress object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
translated-sourceTranslated source (\"Original\" if not specified).
 
groupAddress object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
originalOriginal source IP.
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
destinationOriginal destination (\"Any\" if not specified).
 
anyAny host.
 
groupAddress object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
translated-destinationTranslated destination (\"Original\" if not specified).
 
groupAddress object group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
originalOriginal destination IP.
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
serviceOriginal service (\"Any\" if not specified).
 
anyAny service.
 
groupService group.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolService object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80
translated-serviceTranslated service (\"Original\" if not specified).
 
groupService group.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
originalOriginal service.
 
protocolService object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80
statisticsShow statistics for specified nat policy.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show nat-policy ipv6 inbound X3 outbound X4 source any translated-source original destination name "Web Server Public" translated-destination name "Web Server Private" service "My Web Services" translated-service original

Syntax

show nat-policy id <OBJECT_INDEX> [ { pending-config | with-pending-config } ] [ json | validate | xml ]

Mode

All Modes

Description

Show NAT policy by associated ID.

Options

<OBJECT_INDEX> Integer in the form: D OR 0xHHHHHHHH.
Example: 1
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show nat-policy id 15

Syntax

show nat-policy ipv6 id <OBJECT_INDEX> [ { pending-config | with-pending-config } ] [ json | validate | xml ]

Mode

All Modes

Description

Show IPv6 NAT Policy by associated ID.

Options

<OBJECT_INDEX> Integer in the form: D OR 0xHHHHHHHH.
Example: 1
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show nat-policy ipv6 id 15

Syntax

show network-monitor policies [ status ] [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show all network monitor policies.

Options

statusShow all network monitor policies status.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show network-monitor policies

Syntax

show network-monitor policy <NETMON_NAME> [ { pending-config | with-pending-config } | status ]

Mode

All Modes

Description

Show network monitor policy.

Options

<NETMON_NAME> Atom Object name.
Example: Web Services Monitor
 
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
statusShow a specific network monitor policy status.

Example

show network-monitor policy "Remote Servers"

Syntax

show routing mode [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show routing mode.

Options

 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show routing mode

Syntax

show routing policies [ ipv4 | ipv6 ] [ { dynamic | system } ] [ { custom | default } ] [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show all route policies.

Options

 
ipv4Show only IPv4 route policies.
 
ipv6Show only IPv6 route policies.
 
dynamicShow all dynamic route policies.
 
systemShow all ephemeral system route policies.
 
customShow custom configuration.
 
defaultShow system/factory default configuration.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show routing policies

Syntax

show routing policy interface <ROUTING_INTERFACE_NAME> metric <UINT8> [ source { { any | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_HOST_NETWORK_RANGE_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] [ destination { { any | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_HOST_NETWORK_RANGE_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] [ service { { any | group <SVC_GROUP_NAME> | name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ] [ gateway { { default | host <ADDR_HOST> | name <ADDR_HOST_NAME> } } ] [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show a route policy.

Options

<ROUTING_INTERFACE_NAME> Route interface name.
Example: X0
metricRoute policy metric.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
sourceRoute policy source.
 
anyAny host.
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_HOST_NETWORK_RANGE_NAME> Host/network/range address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
destinationRoute policy destination.
 
anyAny host.
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_HOST_NETWORK_RANGE_NAME> Host/network/range address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
serviceRoute policy service.
 
anyAny service.
 
groupService group.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolService object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80
gatewayRoute policy gateway.
 
defaultDefault gateway 0.0.0.0/::
 
hostGateway IP.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_HOST_NAME> Host address object name.
Example: Web Server
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show routing policy interface X4 metric 255 service name "FTP"

Syntax

show routing policy ipv6 interface <ROUTING_INTERFACE_NAME> metric <UINT8> [ source { { any | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_HOST_NETWORK_RANGE_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] [ destination { { any | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_HOST_NETWORK_RANGE_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] [ service { { any | group <SVC_GROUP_NAME> | name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ] [ gateway { { default | host <ADDR_HOST> | name <ADDR_HOST_NAME> } } ] [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show an IPv6 route policy.

Options

<ROUTING_INTERFACE_NAME> Route interface name.
Example: X0
metricRoute policy metric.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
sourceRoute policy source.
 
anyAny host.
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_HOST_NETWORK_RANGE_NAME> Host/network/range address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
destinationRoute policy destination.
 
anyAny host.
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_HOST_NETWORK_RANGE_NAME> Host/network/range address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
serviceRoute policy service.
 
anyAny service.
 
groupService group.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolService object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80
gatewayRoute policy gateway.
 
defaultDefault gateway 0.0.0.0/::
 
hostGateway IP.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<ADDR_HOST_NAME> Host address object name.
Example: Web Server
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show routing policy ipv6 interface X4 metric 255 service name "FTP"

Syntax

show routing policy id <OBJECT_INDEX>

Mode

All Modes

Description

Show a route policy by associated ID.

Options

<OBJECT_INDEX> Integer in the form: D OR 0xHHHHHHHH.
Example: 1

Example

show routing policy id 3

Syntax

show routing policy ipv6 id <OBJECT_INDEX>

Mode

All Modes

Description

Show an IPv6 route policy by associated ID.

Options

<OBJECT_INDEX> Integer in the form: D OR 0xHHHHHHHH.
Example: 1

Example

show routing policy ipv6 id 3

Syntax

show routing nsm [ database | interface ]

Mode

All Modes

Description

Show routing NSM status or configuration.

Options

 
databaseDatabase summary.
 
interfaceInterface status and configuration.

Example

show routing nsm

Syntax

show routing rip [ database ]

Mode

All Modes

Description

Show routing RIP status or configuration.

Options

databaseDatabase summary.

Example

show routing rip

Syntax

show routing ospf [ database | neighbor | routes ]

Mode

All Modes

Description

Show routing OSPF status or configuration.

Options

 
databaseDatabase summary.
 
neighborNeighbor list.
 
routesOSPF routing table.

Example

show routing ospf

Syntax

show routing bgp [ neighbor | summary | unicast ]

Mode

All Modes

Description

Show routing BGP status or configuration.

Options

 
neighborNeighbor list.
 
summarySummary of BGP neighbor status.
 
unicast

Example

show routing bgp

Syntax

show web-proxy [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show web proxy configuration.

Options

 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show web-proxy

Syntax

show ndp [ cache | entries | entry <NDP_IPV6_HOST> <NDP_MAC> <NDP_INTERFACE> ] [ { pending-config | with-pending-config } ] [ json | validate | xml ]

Mode

All Modes

Description

Show NDP status or configuration.

Options

 
cacheShow NDP caches.
 
entriesShow all static NDP entries.
 
entryShow a static NDP entry.
<NDP_IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b
<NDP_MAC> MAC address in the form: HH:HH:HH:HH:HH:HH OR HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD
<NDP_INTERFACE> Interface name.
Example: X0
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show ndp entries

show ndp
show ndp entry 2001:10:10:10:2D0:02BB:03CC:04DD 02:BB:03:CC:04:DD X0
show ndp cache

Syntax

show tunnel-interface ipv6 <IPV6_TUNNEL_INTERFACE> [ { pending-config | with-pending-config } ] [ json | validate | xml ]

Mode

All Modes

Description

Show IPv6 tunnel interface configuration.

Options

ipv6Show IPv6 tunnel interface configuration.
<IPV6_TUNNEL_INTERFACE> IPv6 Interface name.
Example: myTunnelInterface
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show tunnel-interface CorpIPv6Tunnel

Syntax

show tunnel-interfaces ipv6 [ { pending-config | with-pending-config } ] [ json | validate | xml ]

Mode

All Modes

Description

Show all IPv6 tunnel interfaces configuration.

Options

ipv6Show all IPv6 tunnel interface configuration.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show tunnel-interfaces

Syntax

firewall

Mode

Config

Description

Configure firewall settings.

Example

firewall

Syntax

stealth-mode

Mode

All Modes

Description

Enable stealth mode.

Example

stealth-mode

Syntax

no stealth-mode

Mode

All Modes

Description

Disable stealth mode.

Example

no stealth-mode

Syntax

randomize-id

Mode

All Modes

Description

Enable randomize IP ID.

Example

randomize-id

Syntax

no randomize-id

Mode

All Modes

Description

Disable randomize IP ID.

Example

no randomize-id

Syntax

decrement ttl

Mode

All Modes

Description

Enable decrement IP TTL for forwarded traffic.

Example

decrement ttl

Syntax

no decrement ttl

Mode

All Modes

Description

Disable decrement IP TTL for forwarded traffic.

Example

no decrement ttl

Syntax

icmp time-exceeded-packets

Mode

All Modes

Description

Generate ICMP time-exceeded packets.

Example

icmp time-exceeded-packets

Syntax

no icmp time-exceeded-packets

Mode

All Modes

Description

Never generate ICMP time-exceeded packets.

Example

no icmp time-exceeded-packets

Syntax

ftp-transforms-in-service-object { group <SVC_GROUP_NAME> | name <SVC_NAME> }

Mode

All Modes

Description

Enable FTP transformations for TCP port(s) in service object.

Options

 
groupService group name.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS

Example

ftp-transforms-in-service-object name Ping

Syntax

sqlnet

Mode

All Modes

Description

Enable support for oracle (SQLNet).

Example

sqlnet

Syntax

no sqlnet

Mode

All Modes

Description

Disable support for oracle (SQLNet).

Example

no sqlnet

Syntax

rtsp-transformations

Mode

All Modes

Description

Enable RTSP transformations.

Example

rtsp-transformations

Syntax

no rtsp-transformations

Mode

All Modes

Description

Disable RTSP transformations.

Example

no rtsp-transformations

Syntax

drop source-routed

Mode

All Modes

Description

Enable drop source routed IP packets.

Example

drop source-routed

Syntax

no drop source-routed

Mode

All Modes

Description

Disable drop source routed IP packets.

Example

no drop source-routed

Syntax

connections { highest | optimized | recommended }

Mode

All Modes

Description

Set the type of connections.

Options

 
highest UTM services (application firewall, anti-spyware, gateway AV, and IPS engine) disabled for highest number of SPI connections.
 
optimizedOptimized for deployments requiring more UTM connections but less performance critical.
 
recommendedRecommended for normal deployments with UTM services enabled.

Example

connections highest

Syntax

force-ftp-data

Mode

All Modes

Description

Force inbound and outbound FTP data connections to use the default port: 20.

Example

force-ftp-data

Syntax

no force-ftp-data

Mode

All Modes

Description

Disable force inbound and outbound FTP data connections to use the default port: 20.

Example

no force-ftp-data

Syntax

apply-rules-for-intra-lan

Mode

All Modes

Description

Enable apply firewall rules for intra-LAN traffic to/from the same interface.

Example

apply-rules-for-intra-lan

Syntax

no apply-rules-for-intra-lan

Mode

All Modes

Description

Disable apply firewall rules for intra-LAN traffic to/from the same interface.

Example

no apply-rules-for-intra-lan

Syntax

ip checksum-enforcement

Mode

All Modes

Description

Enable IP header checksum enforcement.

Example

ip checksum-enforcement

Syntax

no ip checksum-enforcement

Mode

All Modes

Description

Disable IP header checksum enforcement.

Example

no ip checksum-enforcement

Syntax

udp checksum-enforcement

Mode

All Modes

Description

Enable UDP checksum enforcement.

Example

udp checksum-enforcement

Syntax

no udp checksum-enforcement

Mode

All Modes

Description

Disable UDP checksum enforcement.

Example

no udp checksum-enforcement

Syntax

jumbo-frame

Mode

All Modes

Description

Enable support jumbo frame.

Example

jumbo-frame

Syntax

no jumbo-frame

Mode

All Modes

Description

Disable support jumbo frame.

Example

no jumbo-frame

Syntax

ipv6 drop { reserved-address-packets | routing-header-0 }

Mode

All Modes

Description

Configure firewall IPv6 drop actions.

Options

 
reserved-address-packetsEnable drop and log network packets whose source or destination address is reserved by RFC.
 
routing-header-0Enable drop IPv6 routing header type 0 packets.

Example

ipv6 drop routing-header-0

ipv6 drop reserved-address-packets

Syntax

no ipv6 drop { reserved-address-packets | routing-header-0 }

Mode

All Modes

Description

Configure firewall IPv6 drop actions.

Options

 
reserved-address-packetsDisable drop and log network packets whose source or destination address is reserved by RFC.
 
routing-header-0Disable drop IPv6 routing header type 0 packets.

Example

no ipv6 drop routing-header-0

no ipv6 drop reserved-address-packets

Syntax

ipv6 decrement hop-limit

Mode

All Modes

Description

Enable decrement IPv6 hop limit for forwarded traffic.

Example

ipv6 decrement hop-limit

Syntax

no ipv6 decrement hop-limit

Mode

All Modes

Description

Disable decrement IPv6 hop limit for forwarded traffic.

Example

no ipv6 decrement hop-limit

Syntax

ipv6 icmp { destination-unreachable | parameter-problem | redirect | time-exceeded }

Mode

All Modes

Description

Set IPv6 ICMP packets.

Options

 
destination-unreachableGenerate IPv6 ICMP destination unreachable packets
 
parameter-problemGenerate IPv6 ICMP parameter problem packets
 
redirectGenerate IPv6 ICMP redirect packets
 
time-exceededGenerate IPv6 ICMP time-exceeded packets

Example

ipv6 icmp time-exceeded

ipv6 icmp destination-unreachable
ipv6 icmp redirect
ipv6 icmp parameter-problem

Syntax

no ipv6 icmp { destination-unreachable | parameter-problem | redirect | time-exceeded }

Mode

All Modes

Description

Set IPv6 ICMP packets.

Options

 
destination-unreachableNever generate IPv6 ICMP destination unreachable packets
 
parameter-problemNever generate IPv6 ICMP parameter problem packets
 
redirectNever generate IPv6 ICMP redirect packets
 
time-exceededNever generate IPv6 ICMP time-exceeded packets

Example

no ipv6 icmp time-exceeded

no ipv6 icmp destination-unreachable
no ipv6 icmp redirect
no ipv6 icmp parameter-problem

Syntax

ipv6 netbios-for-isatap [ life-time <UINT32> ]

Mode

All Modes

Description

Enable NetBIOS name query response for ISATAP and set lift time of resolved name ISATAP.

Options

life-timeResolved name ISATAP is valid for (seconds).
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

ipv6 netbios-for-isatap life-time 1000

Syntax

no ipv6 netbios-for-isatap

Mode

All Modes

Description

Disable NetBIOS name query response for ISATAP.

Example

no ipv6 netbios-for-isatap

Syntax

bandwidth-management

Mode

Config

Description

Enter bandwidth management configuration mode.

Example

bandwidth-management

Syntax

no type

Mode

Bandwidth Mangement

Description

Diable bandwidth management type.

Example

no type

Syntax

type { advanced | global }

Mode

Bandwidth Mangement

Description

Set bandwidth management type.

Options

 
advancedAdvanced.
 
globalGlobal.

Example

type global

Syntax

priority { high | highest | low | lowest | medium | medium-high | medium-low | realtime } [ guaranteed <UINT8> ] [ maximum <UINT8> ]

Mode

Bandwidth Mangement

Description

Set the specified priority.

Options

 
highHigh 2.
 
highestHighest 1.
 
lowLow 6.
 
lowestLowest 7.
 
mediumMedium 4.
 
medium-highMedium-high 3.
 
medium-lowMedium-low 5.
 
realtimeRealtime 0.
guaranteedGuaranteed percent.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
maximumMaximum/burst percent.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

priority medium-high guaranteed 30 maximum 80

Syntax

no priority { high | highest | low | lowest | medium | medium-high | medium-low | realtime }

Mode

Bandwidth Mangement

Description

Disable the specified priority.

Options

 
highHigh 2.
 
highestHighest 1.
 
lowLow 6.
 
lowestLowest 7.
 
mediumMedium 4.
 
medium-highMedium-high 3.
 
medium-lowMedium-low 5.
 
realtimeRealtime 0.

Example

no priority medium-low

Syntax

no multicast

Mode

Config

Description

Disable multicast.

Example

no multicast

Syntax

multicast

Mode

Config

Description

Configure multicast.

Example

multicast

Syntax

require-igmp-membership [ timeout <UINT8> ]

Mode

Multicast

Description

Enable require IGMP membership reports for multicast data forwarding.

Options

timeoutSet the multicast state table entry timeout in minutes.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

require-igmp-membership

Syntax

no require-igmp-membership

Mode

Multicast

Description

Disable require IGMP membership reports for multicast data forwarding.

Example

no require-igmp-membership

Syntax

reception { all | group <MULTICAST_ADDR_GROUP_NAME> | host <MULTICAST_ADDR_HOST> | name <MULTICAST_ADDR_NAME> | network <MULTICAST_ADDR_NETWORK> <MULTICAST_ADDR_MASK> | range <MULTICAST_ADDR_BEGIN> <MULTICAST_ADDR_END> }

Mode

Multicast

Description

Enable reception for the specified multicast addresses.

Options

 
allAll multicast host.
 
groupMulticast address object group.
<MULTICAST_ADDR_GROUP_NAME> Multicast address group name.
Example: Multicast Group
 
hostMulticast address object host.
<MULTICAST_ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameMulticast address object name.
<MULTICAST_ADDR_NAME> Multicast address object name.
Example: Multicast Address
 
networkMulticast address object network.
<MULTICAST_ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<MULTICAST_ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeMulticast address object range.
<MULTICAST_ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<MULTICAST_ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

reception all

reception name "Multicast Address"
reception group "Multicast Group"
reception host 224.0.0.12
reception range 192.168.168.10 192.168.168.20
reception network 192.168.168.0 255.255.255.0

Syntax

clear state-entries

Mode

Multicast

Description

Clear all the IGMP state entries.

Example

clear state-entries

Syntax

clear state-entry address <MULTICAST_GROUP_IPV4_HOST> interface <MULTICAST_INTERFACE>

Mode

Multicast

Description

Clear the specified IGMP state entry.

Options

addressSpecified multicast group address.
<MULTICAST_GROUP_IPV4_HOST> Group address object name.
Example: Sales Group
interfaceSpecified interface/ vpn tunnel.
<MULTICAST_INTERFACE> Multicast interface name.
Example: X0

Example

clear state-entry address 2.2.2.2 interface X1

Syntax

no access-rule from <ACCESS_RULE_ZONE_NAME> to <ACCESS_RULE_ZONE_NAME> action { { allow | deny | discard } } [ source { [ address { { any | fqdn <ADDR_FQDN> | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | mac <ADDR_MAC> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] [ port { { any | group <SVC_GROUP_NAME> | name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ] } ] [ service { { any | group <SVC_GROUP_NAME> | name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ] [ destination { [ address { { any | fqdn <ADDR_FQDN> | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | mac <ADDR_MAC> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] } ] [ schedule { { always-on | days <SCHED_DAYS> time <SCHED_TIME_BEGIN> <SCHED_TIME_END> | name <SCHED_NAME> } } ]

Mode

Config

Description

Delete firewall access rule policy.

Options

<ACCESS_RULE_ZONE_NAME> Zone object name.
Example: DMZ
toDestination zone.
<ACCESS_RULE_ZONE_NAME> Zone object name.
Example: DMZ
actionSet the action for this access rule.
 
allowAllow traffic matching the criteria.
 
denyDeny traffic matching the criteria.
 
discardDiscard traffic matching the criteria.
sourceSource.
addressSource address.
 
anyAny address.
 
fqdnAddress object full qualified domain name.
<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
macAddress object mac.
<ADDR_MAC> Address object MAC address in the form: HH:HH:HH:HH:HH:HH or HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
portSource port.
 
anyAny source service.
 
groupSource service Group name.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameSource service Object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolSource service Object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80
serviceService.
 
anyAny destination service.
 
groupService group name.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolService object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80
destinationDestination.
addressDestination address.
 
anyAny address.
 
fqdnAddress object full qualified domain name.
<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
macAddress object mac.
<ADDR_MAC> Address object MAC address in the form: HH:HH:HH:HH:HH:HH or HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
scheduleSchedule.
 
always-onAlways on.
 
daysSchedule object days.
<SCHED_DAYS> Days of the week in the form: SU-M-T-W-TH-F-SA.
Example: SU-M-TH-SA
timeSchedule object beginning/ending time.
<SCHED_TIME_BEGIN> Time in the form: DD:DD.
Example: 12:00
<SCHED_TIME_END> Time in the form: DD:DD.
Example: 12:00
 
nameSchedule object name.
<SCHED_NAME> Schedule object name.
Example: Work Hours

Syntax

no access-rule id <OBJECT_INDEX>

Mode

Config

Description

Delete firewall access rule policy by id.

Options

<OBJECT_INDEX> Integer in the form: D OR 0xHHHHHHHH.
Example: 1

Example

no access-rule id 25

Syntax

no access-rule statistics

Mode

Config

Description

Clear firewall access rule statistics.

Syntax

access-rule from <ACCESS_RULE_ZONE_NAME> to <ACCESS_RULE_ZONE_NAME> action { { allow | deny | discard } } [ source { [ address { { any | fqdn <ADDR_FQDN> | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | mac <ADDR_MAC> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] [ port { { any | group <SVC_GROUP_NAME> | name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ] } ] [ service { { any | group <SVC_GROUP_NAME> | name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ] [ destination { [ address { { any | fqdn <ADDR_FQDN> | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | mac <ADDR_MAC> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] } ] [ schedule { { always-on | days <SCHED_DAYS> time <SCHED_TIME_BEGIN> <SCHED_TIME_END> | name <SCHED_NAME> } } ]

Mode

Config

Description

Add/edit firewall access rule and enter configuration mode.

Options

<ACCESS_RULE_ZONE_NAME> Zone object name.
Example: DMZ
toDestination zone.
<ACCESS_RULE_ZONE_NAME> Zone object name.
Example: DMZ
actionSet the action for this access rule.
 
allowAllow traffic matching the criteria.
 
denyDeny traffic matching the criteria.
 
discardDiscard traffic matching the criteria.
sourceSource.
addressSource address.
 
anyAny address.
 
fqdnAddress object full qualified domain name.
<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
macAddress object mac.
<ADDR_MAC> Address object MAC address in the form: HH:HH:HH:HH:HH:HH or HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
portSource port.
 
anyAny source service.
 
groupSource service Group name.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameSource service Object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolSource service Object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80
serviceService.
 
anyAny destination service.
 
groupService group name.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolService object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80
destinationDestination.
addressDestination address.
 
anyAny address.
 
fqdnAddress object full qualified domain name.
<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
macAddress object mac.
<ADDR_MAC> Address object MAC address in the form: HH:HH:HH:HH:HH:HH or HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
scheduleSchedule.
 
always-onAlways on.
 
daysSchedule object days.
<SCHED_DAYS> Days of the week in the form: SU-M-T-W-TH-F-SA.
Example: SU-M-TH-SA
timeSchedule object beginning/ending time.
<SCHED_TIME_BEGIN> Time in the form: DD:DD.
Example: 12:00
<SCHED_TIME_END> Time in the form: DD:DD.
Example: 12:00
 
nameSchedule object name.
<SCHED_NAME> Schedule object name.
Example: Work Hours

Syntax

access-rule id <OBJECT_INDEX>

Mode

Config

Description

Edit firewall access rule by id and enter configuration mode.

Options

<OBJECT_INDEX> Integer in the form: D OR 0xHHHHHHHH.
Example: 1

Example

access-rule id 3

Syntax

access-rule restore-defaults [ from <ACCESS_RULE_ZONE_NAME> to <ACCESS_RULE_ZONE_NAME> ]

Mode

Config

Description

Restore firewall access rules to default settings.

Options

fromFrom zone.
<ACCESS_RULE_ZONE_NAME> Zone object name.
Example: DMZ
toTo zone.
<ACCESS_RULE_ZONE_NAME> Zone object name.
Example: DMZ

Example

access-rule restore-defaults from LAN to WAN

Syntax

no access-rule ipv6 from <ACCESS_RULE_ZONE_NAME> to <ACCESS_RULE_ZONE_NAME> action { { allow | deny | discard } } [ source { [ address { { any | fqdn <ADDR_FQDN> | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | mac <ADDR_MAC> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] [ port { { any | group <SVC_GROUP_NAME> | name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ] } ] [ service { { any | group <SVC_GROUP_NAME> | name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ] [ destination { [ address { { any | fqdn <ADDR_FQDN> | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | mac <ADDR_MAC> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] } ] [ schedule { { always-on | days <SCHED_DAYS> time <SCHED_TIME_BEGIN> <SCHED_TIME_END> | name <SCHED_NAME> } } ]

Mode

Config

Description

Delete firewall access rule policy.

Options

<ACCESS_RULE_ZONE_NAME> Zone object name.
Example: DMZ
toDestination zone.
<ACCESS_RULE_ZONE_NAME> Zone object name.
Example: DMZ
actionSet the action for this access rule.
 
allowAllow traffic matching the criteria.
 
denyDeny traffic matching the criteria.
 
discardDiscard traffic matching the criteria.
sourceSource.
addressSource address.
 
anyAny address.
 
fqdnAddress object full qualified domain name.
<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
macAddress object mac.
<ADDR_MAC> Address object MAC address in the form: HH:HH:HH:HH:HH:HH or HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
portSource port.
 
anyAny source service.
 
groupSource service Group name.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameSource service Object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolSource service Object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80
serviceService.
 
anyAny destination service.
 
groupService group name.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolService object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80
destinationDestination.
addressDestination address.
 
anyAny address.
 
fqdnAddress object full qualified domain name.
<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
macAddress object mac.
<ADDR_MAC> Address object MAC address in the form: HH:HH:HH:HH:HH:HH or HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
scheduleSchedule.
 
always-onAlways on.
 
daysSchedule object days.
<SCHED_DAYS> Days of the week in the form: SU-M-T-W-TH-F-SA.
Example: SU-M-TH-SA
timeSchedule object beginning/ending time.
<SCHED_TIME_BEGIN> Time in the form: DD:DD.
Example: 12:00
<SCHED_TIME_END> Time in the form: DD:DD.
Example: 12:00
 
nameSchedule object name.
<SCHED_NAME> Schedule object name.
Example: Work Hours

Syntax

no access-rule ipv6 id <OBJECT_INDEX>

Mode

Config

Description

Delete firewall access rule policy by id.

Options

<OBJECT_INDEX> Integer in the form: D OR 0xHHHHHHHH.
Example: 1

Example

no access-rule ipv6 id 25

Syntax

access-rule ipv6 from <ACCESS_RULE_ZONE_NAME> to <ACCESS_RULE_ZONE_NAME> action { { allow | deny | discard } } [ source { [ address { { any | fqdn <ADDR_FQDN> | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | mac <ADDR_MAC> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] [ port { { any | group <SVC_GROUP_NAME> | name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ] } ] [ service { { any | group <SVC_GROUP_NAME> | name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ] [ destination { [ address { { any | fqdn <ADDR_FQDN> | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | mac <ADDR_MAC> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] } ] [ schedule { { always-on | days <SCHED_DAYS> time <SCHED_TIME_BEGIN> <SCHED_TIME_END> | name <SCHED_NAME> } } ]

Mode

Config

Description

Add/Edit firewall access rule and enter configuration mode.

Options

<ACCESS_RULE_ZONE_NAME> Zone object name.
Example: DMZ
toDestination Zone.
<ACCESS_RULE_ZONE_NAME> Zone object name.
Example: DMZ
actionSet the action for this access rule.
 
allowAllow traffic matching the criteria.
 
denyDeny traffic matching the criteria.
 
discardDiscard traffic matching the criteria.
sourceSource.
addressSource address.
 
anyAny address.
 
fqdnAddress object full qualified domain name.
<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
macAddress object mac.
<ADDR_MAC> Address object MAC address in the form: HH:HH:HH:HH:HH:HH or HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
portSource port.
 
anyAny source service.
 
groupSource service Group name.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameSource service Object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolSource service Object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80
serviceService.
 
anyAny destination service.
 
groupService group name.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolService object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80
destinationDestination.
addressDestination address.
 
anyAny address.
 
fqdnAddress object full qualified domain name.
<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
macAddress object mac.
<ADDR_MAC> Address object MAC address in the form: HH:HH:HH:HH:HH:HH or HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
scheduleSchedule.
 
always-onAlways on.
 
daysSchedule object days.
<SCHED_DAYS> Days of the week in the form: SU-M-T-W-TH-F-SA.
Example: SU-M-TH-SA
timeSchedule object beginning/ending time.
<SCHED_TIME_BEGIN> Time in the form: DD:DD.
Example: 12:00
<SCHED_TIME_END> Time in the form: DD:DD.
Example: 12:00
 
nameSchedule object name.
<SCHED_NAME> Schedule object name.
Example: Work Hours

Syntax

access-rule ipv6 id <OBJECT_INDEX>

Mode

Config

Description

Edit firewall access rule by id and enter configuration mode.

Options

<OBJECT_INDEX> Integer in the form: D OR 0xHHHHHHHH.
Example: 1

Example

access-rule id 3

Syntax

access-rule ipv6 restore-defaults [ from <ACCESS_RULE_ZONE_NAME> to <ACCESS_RULE_ZONE_NAME> ]

Mode

Config

Description

Restore firewall access rules to default settings.

Options

fromFrom zone.
<ACCESS_RULE_ZONE_NAME> Zone object name.
Example: DMZ
toTo zone.
<ACCESS_RULE_ZONE_NAME> Zone object name.
Example: DMZ

Syntax

id <OBJECT_INDEX>

Mode

Access Rule

Access Rule IPv6

Description

Access policy table id.

Options

<OBJECT_INDEX> Integer in the form: D OR 0xHHHHHHHH.
Example: 1

Example

id 57

Syntax

from <ACCESS_RULE_ZONE_NAME>

Mode

Access Rule

Access Rule IPv6

Description

Specify a source zone for this access policy.

Options

<ACCESS_RULE_ZONE_NAME> Zone object name.
Example: DMZ

Example

from LAN

Syntax

to <ACCESS_RULE_ZONE_NAME>

Mode

Access Rule

Access Rule IPv6

Description

Specify a destination zone for this access policy.

Options

<ACCESS_RULE_ZONE_NAME> Zone object name.
Example: DMZ

Example

to LAN

Syntax

action { { allow | deny | discard } }

Mode

Access Rule

Access Rule IPv6

Description

Set the action for this access rule.

Options

 
allowAllow traffic matching the criteria.
 
denyDeny traffic matching the criteria.
 
discardDiscard traffic matching the criteria.

Example

action allow

Syntax

max-connections <UINT8>

Mode

Access Rule

Access Rule IPv6

Description

Set the number of connections allowed (% maximum connections).

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

max-connections 50

Syntax

tcp timeout <UINT32>

Mode

Access Rule

Access Rule IPv6

Description

Set the TCP connection inactivity timeout (seconds).

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

tcp timeout 15

Syntax

udp timeout <UINT32>

Mode

Access Rule

Access Rule IPv6

Description

Set the UPD connection inactivity timeout (seconds).

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

udp timeout 30

Syntax

fragments

Mode

Access Rule

Access Rule IPv6

Description

Allow fragmented packets on this access rule.

Example

fragments

Syntax

no fragments

Mode

Access Rule

Access Rule IPv6

Description

Disable fragmented packets on this access rule.

Example

no fragments

Syntax

botnet-filter

Mode

Access Rule

Description

Enable Botnet filter.

Example

botnet-filter

Syntax

no botnet-filter

Mode

Access Rule

Description

Disable Botnet filter.

Example

no botnet-filter

Syntax

comment <WORD>

Mode

Access Rule

Access Rule IPv6

Description

Specify a comment for this access policy.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

comment "Access Rule to allow IT to access servers"

Syntax

no comment

Mode

Access Rule

Access Rule IPv6

Description

Clear a comment for this access policy.

Example

no comment

Syntax

connection-limit destination [ threshold <UINT16> ]

Mode

Access Rule

Access Rule IPv6

Description

Enable connection limit for each destination IP address.

Options

thresholdSet the destination IP address connection limit threshold.
<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

connection-limit destination threshold 128

Syntax

no connection-limit destination

Mode

Access Rule

Access Rule IPv6

Description

Disable connection limit for each destination IP address.

Example

no connection-limit destination

Syntax

connection-limit source [ threshold <UINT16> ]

Mode

Access Rule

Access Rule IPv6

Description

Enable connection limit for each source IP address.

Options

thresholdSet the source IP address connection limit threshold.
<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

connection-limit source threshold 128

Syntax

no connection-limit source

Mode

Access Rule

Access Rule IPv6

Description

Disable connection limit for each source IP address.

Example

no connection-limit source

Syntax

destination address { { any | fqdn <ADDR_FQDN> | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | mac <ADDR_MAC> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } }

Mode

Access Rule

Access Rule IPv6

Description

Specify a destination for this access policy.

Options

 
anyAny address.
 
fqdnAddress object full qualified domain name.
<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
macAddress object mac.
<ADDR_MAC> Address object MAC address in the form: HH:HH:HH:HH:HH:HH or HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

destination address name "Corporate Servers"

Syntax

service { { any | group <SVC_GROUP_NAME> | name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } }

Mode

Access Rule

Access Rule IPv6

Description

Specify a service for this Access Policy.

Options

 
anyAny destination service.
 
groupService group name.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolService object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80

Example

service "Corporate Servers"

Syntax

enable

Mode

Access Rule

Access Rule IPv6

Description

Enable this access rule.

Example

enable

Syntax

no enable

Mode

Access Rule

Access Rule IPv6

Description

Disable this access rule.

Example

no enable

Syntax

flow-reporting

Mode

Access Rule

Access Rule IPv6

Description

Enable flow reporting.

Example

flow-reporting

Syntax

no flow-reporting

Mode

Access Rule

Access Rule IPv6

Description

Disable flow reporting.

Example

no flow-reporting

Syntax

geo-ip-filter

Mode

Access Rule

Description

Enable Geo-IP filter.

Example

geo-ip-filter

Syntax

no geo-ip-filter

Mode

Access Rule

Description

Disable Geo-IP filter.

Example

no geo-ip-filter

Syntax

logging

Mode

Access Rule

Access Rule IPv6

Description

Enable logging when this access rule is used.

Example

logging

Syntax

no logging

Mode

Access Rule

Access Rule IPv6

Description

Disable logging when this access rule is used.

Example

no logging

Syntax

packet-monitoring

Mode

Access Rule

Access Rule IPv6

Description

Enable packet monitoring.

Example

packet-monitoring

Syntax

no packet-monitoring

Mode

Access Rule

Access Rule IPv6

Description

Disable packet monitoring.

Example

no packet-monitoring

Syntax

management

Mode

Access Rule

Access Rule IPv6

Description

Allow management traffic.

Example

management

Syntax

no management

Mode

Access Rule

Access Rule IPv6

Description

Disable management traffic.

Example

no management

Syntax

single-sign-on

Mode

Access Rule

Access Rule IPv6

Description

Invoke single sign on to authenticate users.

Example

single-sign-on

Syntax

no single-sign-on

Mode

Access Rule

Access Rule IPv6

Description

Don't invoke single sign on to authenticate users.

Example

no single-sign-on

Syntax

quality-of-service class-of-service { explicit { { background | best-effort | controlled-load | excellent-effort | network-control | spare | video | voice } } | map | none | preserve }

Mode

Access Rule

Access Rule IPv6

Description

Set 802.1p marking action.

Options

 
explicitSet explicit marking.
 
backgroundBackground.
 
best-effortBest effort.
 
controlled-loadControlled load.
 
excellent-effortExcellent effort.
 
network-controlNetwork control.
 
spareSpare.
 
videoVideo (<100ms latency).
 
voiceVoice (<100ms latency).
 
mapMap marking.
 
noneNo marking.
 
preservePreserve marking.

Example

quality-of-service class-of-service preserve

Syntax

quality-of-service dscp { explicit <UINT8> | map [ { cos-override | disable-cos-override } ] | none | preserve }

Mode

Access Rule

Access Rule IPv6

Description

Set DSCP marking action.

Options

 
explicitSet explicit marking.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
 
mapMap marking.
 
cos-overrideAllow 802.1p marking to override DSCP values.
 
disable-cos-overrideDisable allowing of 802.1p marking to override DSCP values..
 
noneNo marking.
 
preservePreserve marking.

Example

quality-of-service dscp preserve

Syntax

reflexive

Mode

Access Rule

Access Rule IPv6

Description

Configure a reflexive rule.

Example

reflexive

Syntax

no reflexive

Mode

Access Rule

Access Rule IPv6

Description

Disable configuration of a reflexive rule.

Example

no reflexive

Syntax

schedule { { always-on | days <SCHED_DAYS> time <SCHED_TIME_BEGIN> <SCHED_TIME_END> | name <SCHED_NAME> } }

Mode

Access Rule

Access Rule IPv6

Description

Specify a schedule for this access policy.

Options

 
always-onAlways on.
 
daysSchedule object days.
<SCHED_DAYS> Days of the week in the form: SU-M-T-W-TH-F-SA.
Example: SU-M-TH-SA
timeSchedule object beginning/ending time.
<SCHED_TIME_BEGIN> Time in the form: DD:DD.
Example: 12:00
<SCHED_TIME_END> Time in the form: DD:DD.
Example: 12:00
 
nameSchedule object name.
<SCHED_NAME> Schedule object name.
Example: Work Hours

Example

schedule name "IT Maintenance"

Syntax

source address { { any | fqdn <ADDR_FQDN> | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | mac <ADDR_MAC> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } }

Mode

Access Rule

Access Rule IPv6

Description

Specify a service for this access policy.

Options

 
anyAny address.
 
fqdnAddress object full qualified domain name.
<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
macAddress object mac.
<ADDR_MAC> Address object MAC address in the form: HH:HH:HH:HH:HH:HH or HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

source address name "Corporate IT Administration"

Syntax

source port { { any | group <SVC_GROUP_NAME> | name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } }

Mode

Access Rule

Access Rule IPv6

Description

Specify a source port for this access policy.

Options

 
anyAny source service.
 
groupSource service group name.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameSource service object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolSource service object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80

Example

source port name "Corporate IT Administration"

Syntax

users included { { administrator | all | group <LOCAL_USER_GROUP_NAME> | guests | name <LOCAL_USER_NAME> } }

Mode

Access Rule

Access Rule IPv6

Description

Specify users that apply to this access policy.

Options

 
administratorAdministrator.
 
allAll users.
 
groupGroup object name.
<LOCAL_USER_GROUP_NAME> User group object name.
Example: Limited Administrators
 
guestsGuest users.
 
nameUser object name.
<LOCAL_USER_NAME> User object name.
Example: user1

Example

users included name "Corporate IT Administrators"

Syntax

users excluded { { administrator | group <LOCAL_USER_GROUP_NAME> | guests | name <LOCAL_USER_NAME> | none } }

Mode

Access Rule

Access Rule IPv6

Description

Specify users that are excluded from this access policy.

Options

 
administratorAdministrator.
 
groupGroup object name.
<LOCAL_USER_GROUP_NAME> User group object name.
Example: Limited Administrators
 
guestsGuest users.
 
nameUser object name.
<LOCAL_USER_NAME> User object name.
Example: user1
 
noneNo users.

Example

users excluded name "Corporate Users"

Syntax

bandwidth-management

Mode

Access Rule

Description

Enter ethernet bandwidth management configuration mode.

Example

bandwidth-management

Syntax

bandwidth-management

Mode

Access Rule IPv6

Description

Enter bandwidth management configuration mode.

Example

bandwidth-management

Syntax

egress { bandwidth-object <BANDWIDTH_RULE_NAME> | priority { high | highest | low | lowest | medium | medium-high | medium-low | realtime } }

Mode

Bandwidth Management

Bandwidth Management IPv6

Description

Enable egress bandwidth management and configure.

Options

 
bandwidth-objectBandwidth object name.
<BANDWIDTH_RULE_NAME> Bandwidth object name.
Example: \"Corp High Priority\"
 
priorityEgress traffic priority.
 
highHigh 2.
 
highestHighest 1.
 
lowLow 6.
 
lowestLowest 7.
 
mediumMedium 4.
 
medium-highMedium-high 3.
 
medium-lowMedium-low 5.
 
realtimeRealtime 0.

Example

egress bandwidth-object "Corp High Priority"

Syntax

no egress

Mode

Bandwidth Management

Bandwidth Management IPv6

Description

Disable egress bandwidth management.

Example

no egress

Syntax

ingress { bandwidth-object <BANDWIDTH_RULE_NAME> | priority { high | highest | low | lowest | medium | medium-high | medium-low | realtime } }

Mode

Bandwidth Management

Bandwidth Management IPv6

Description

Enable ingress bandwidth management and configure.

Options

 
bandwidth-objectBandwidth object name.
<BANDWIDTH_RULE_NAME> Bandwidth object name.
Example: \"Corp High Priority\"
 
priorityIngress traffic priority.
 
highHigh 2.
 
highestHighest 1.
 
lowLow 6.
 
lowestLowest 7.
 
mediumMedium 4.
 
medium-highMedium-high 3.
 
medium-lowMedium-low 5.
 
realtimeRealtime 0.

Example

ingress bandwidth-object "Corp High Priority"

Syntax

no ingress

Mode

Bandwidth Management

Bandwidth Management IPv6

Description

Disable ingress bandwidth management.

Example

no ingress

Syntax

usage-tracking

Mode

Bandwidth Management

Bandwidth Management IPv6

Description

Enable tracking bandwidth usage.

Example

usage-tracking

Syntax

no usage-tracking

Mode

Bandwidth Management

Bandwidth Management IPv6

Description

Disable tracking bandwidth usage.

Example

no usage-tracking

Syntax

ssl-control

Mode

Config

Description

Enable and configure SSL control settings.

Example

ssl-control

Syntax

no ssl-control

Mode

Config

Description

Disable SSL control.

Example

no ssl-control

Syntax

action { block | log }

Mode

SSL Control

Description

Action if an SSL policy violation is detected.

Options

 
blockBlock the connection and log the event.
 
logLog the event.

Example

action block

Syntax

blacklist

Mode

SSL Control

Description

Enable blacklist.

Example

blacklist

Syntax

no blacklist

Mode

SSL Control

Description

Disable blacklist.

Example

no blacklist

Syntax

detect-sslv2

Mode

SSL Control

Description

Enable detection of SSLv2.

Example

detect-sslv2

Syntax

no detect-sslv2

Mode

SSL Control

Description

Disable detection of SSLv2.

Example

no detect-sslv2

Syntax

detect-weak-ciphers

Mode

SSL Control

Description

Enable detection of weak ciphers.

Example

detect-weak-ciphers

Syntax

no detect-weak-ciphers

Mode

SSL Control

Description

Disable detection of weak ciphers.

Example

no detect-weak-ciphers

Syntax

whitelist

Mode

SSL Control

Description

Enable whitelist.

Example

whitelist

Syntax

no whitelist

Mode

SSL Control

Description

Disable whitelist.

Example

no whitelist

Syntax

detect-self-signed

Mode

SSL Control

Description

Enable detection of self-signed certificates.

Example

detect-self-signed

Syntax

no detect-self-signed

Mode

SSL Control

Description

Disable detection of self-signed certificates.

Example

no detect-self-signed

Syntax

detect-md5-digest

Mode

SSL Control

Description

Enable detection of MD5 digest.

Example

detect-md5-digest

Syntax

no detect-md5-digest

Mode

SSL Control

Description

Disable detection of MD5 digest.

Example

no detect-md5-digest

Syntax

detect-expired

Mode

SSL Control

Description

Enable detection of expired certificates.

Example

detect-expired

Syntax

no detect-expired

Mode

SSL Control

Description

Disable detection of expired certificates.

Example

no detect-expired

Syntax

untrusted-ca

Mode

SSL Control

Description

Enable detection of certificate signed by an untrusted CA.

Example

untrusted-ca

Syntax

no untrusted-ca

Mode

SSL Control

Description

Disable detection of certificate signed by an untrusted CA.

Example

no untrusted-ca

Syntax

blacklist-certificate <BLACKLIST_CERTIFICATE>

Mode

SSL Control

Description

Add entry to blacklist.

Options

<BLACKLIST_CERTIFICATE> Word in the form: WORD or \"QUOTED STRING\".
Example: certificateName

Example

blacklist-certificate www.badguys.com

Syntax

no blacklist-certificate <BLACKLIST_CERTIFICATE>

Mode

SSL Control

Description

Delete an entry from blacklist.

Options

<BLACKLIST_CERTIFICATE> Word in the form: WORD or \"QUOTED STRING\".
Example: certificateName

Example

no blacklist-certificate www.badguys.com

Syntax

no blacklist-certificates

Mode

SSL Control

Description

Delete all entries from blacklist.

Example

no blacklist-certificates

Syntax

whitelist-certificate <WHITELIST_CERTIFICATE>

Mode

SSL Control

Description

Add entry to whitelist.

Options

<WHITELIST_CERTIFICATE> Word in the form: WORD or \"QUOTED STRING\".
Example: certificateName

Example

whitelist-certificate www.badguys.com

Syntax

no whitelist-certificate <WHITELIST_CERTIFICATE>

Mode

SSL Control

Description

Delete an entry from whitelist.

Options

<WHITELIST_CERTIFICATE> Word in the form: WORD or \"QUOTED STRING\".
Example: certificateName

Example

no whitelist-certificate www.goodguys.com

Syntax

no whitelist-certificates

Mode

SSL Control

Description

Delete all entries from whitelist.

Example

no whitelist-certificates

Syntax

tcp

Mode

Config

Description

Configure TCP settings.

Example

tcp

Syntax

enforce-strict-compliance

Mode

TCP

Description

Enable enforcement of strict TCP compliance with RFC 793 and RFC 1122.

Example

enforce-strict-compliance

Syntax

no enforce-strict-compliance

Mode

TCP

Description

Disable enforcement of strict TCP compliance with RFC 793 and RFC 1122.

Example

no enforce-strict-compliance

Syntax

handshake-enforcement

Mode

TCP

Description

Enable TCP handshake enforcement.

Example

handshake-enforcement

Syntax

no handshake-enforcement

Mode

TCP

Description

Disable TCP handshake enforcement.

Example

no handshake-enforcement

Syntax

checksum-enforcement

Mode

TCP

Description

Enable TCP checksum enforcement.

Example

checksum-enforcement

Syntax

no checksum-enforcement

Mode

TCP

Description

Disable TCP checksum enforcement.

Example

no checksum-enforcement

Syntax

handshake-timeout <UINT32>

Mode

TCP

Description

Set the TCP handshake timeout in seconds.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

handshake-timeout 4

Syntax

no handshake-timeout

Mode

TCP

Description

Disable the TCP handshake timeout.

Example

no handshake-timeout

Syntax

default-connection-timeout <UINT32>

Mode

TCP

Description

Set default TCP connection timeout in minutes.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

default-connection-timeout 15

Syntax

maximum-segment-lifetime <UINT8>

Mode

TCP

Description

Set maximum segment lifetime in seconds.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

maximum-segment-lifetime 8

Syntax

syn-flood-protection-mode { always-proxy | proxy-suspect-attack | watch-and-report }

Mode

TCP

Description

Set TCP SYN flood protection mode.

Options

 
always-proxyAlways proxy WAN client connections.
 
proxy-suspect-attackProxy WAN client connections when attack is suspected.
 
watch-and-reportWatch and report possible SYN floods.

Example

syn-flood-protection-mode watch-and-report

Syntax

syn-attack-threshold <UINT32>

Mode

TCP

Description

Set attack threshold (incomplete connection attempts / second).

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

syn-attack-threshold 300

Syntax

support-tcp-sack

Mode

TCP

Description

Enable all LAN/DMZ servers support the TCP SACK option.

Example

support-tcp-sack

Syntax

no support-tcp-sack

Mode

TCP

Description

Disable all LAN/DMZ servers support the TCP SACK option.

Example

no support-tcp-sack

Syntax

limit-mss [ max <UINT16> ]

Mode

TCP

Description

Enable limit MSS sent to WAN clients (when connections are proxied).

Options

maxSet maximum TCP MSS sent to WAN clients.
<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

limit-mss max 1460

Syntax

no limit-mss

Mode

TCP

Description

Disable limit MSS sent to WAN clients (when connections are proxied).

Example

no limit-mss

Syntax

always-log-syn-packets

Mode

TCP

Description

Enable always log SYN packets received.

Example

always-log-syn-packets

Syntax

no always-log-syn-packets

Mode

TCP

Description

Disable always log SYN packets received.

Example

no always-log-syn-packets

Syntax

syn-flood-blacklisting

Mode

TCP

Description

Enable SYN/RST/FIN flood blacklisting on all interfaces.

Example

syn-flood-blacklisting

Syntax

no syn-flood-blacklisting

Mode

TCP

Description

Disable SYN/RST/FIN flood blacklisting on all interfaces.

Example

no syn-flood-blacklisting

Syntax

blacklist-threshold <UINT32>

Mode

TCP

Description

Set threshold for SYN/RST/FIN flood blacklisting (packets / sec).

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

blacklist-threshold 1000

Syntax

never-blacklist-wan

Mode

TCP

Description

Enable never blacklist WAN machines.

Example

never-blacklist-wan

Syntax

no never-blacklist-wan

Mode

TCP

Description

Disable never blacklist WAN machines.

Example

no never-blacklist-wan

Syntax

always-allow-management

Mode

TCP

Description

Enable always allow SonicWALL management traffic.

Example

always-allow-management

Syntax

no always-allow-management

Mode

TCP

Description

Disable always allow SonicWALL management traffic.

Example

no always-allow-management

Syntax

ddos on-wan-interfaces

Mode

TCP

Description

Enable DDOS protection on WAN interfaces.

Example

ddos on-wan-interfaces

Syntax

no ddos on-wan-interfaces

Mode

TCP

Description

Disable DDOS protection on WAN interfaces.

Example

no ddos on-wan-interfaces

Syntax

ddos threshold <UINT32>

Mode

TCP

Description

Set threshold for WAN DDOS protection (non-TCP packets / sec).

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

ddos threshold 1000

Syntax

no ddos threshold

Mode

TCP

Description

Clear threshold for WAN DDOS protection.

Example

no ddos threshold

Syntax

ddos fliter-bypass-rate <UINT32>

Mode

TCP

Description

Set WAN DDOS filter bypass rate (every n packets).

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

ddos fliter-bypass-rate 100

Syntax

no ddos fliter-bypass-rate

Mode

TCP

Description

Clear WAN DDOS filter bypass rate.

Example

no ddos fliter-bypass-rate

Syntax

ddos allow-list-timeout <UINT32>

Mode

TCP

Description

Set WAN DDOS allow list timeout.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

ddos allow-list-timeout 100

Syntax

no ddos allow-list-timeout

Mode

TCP

Description

Clear WAN DDOS allow list timeout.

Example

no ddos allow-list-timeout

Syntax

ddos always-allow-management

Mode

TCP

Description

Enable always allow SonicWALL management traffic (non-tcp floods).

Example

ddos always-allow-management

Syntax

no ddos always-allow-management

Mode

TCP

Description

Disable always allow SonicWALL management traffic (non-tcp floods).

Example

no ddos always-allow-management

Syntax

clear tcp statistics

Mode

TCP

Description

Clear TCP traffic statistics.

Example

clear tcp statistics

Syntax

no bandwidth-object <BANDWIDTH_RULE_NAME>

Mode

Config

Description

Delete a bandwidth object.

Options

<BANDWIDTH_RULE_NAME> Bandwidth object name.
Example: \"Corp High Priority\"

Example

no bandwidth-object "Corp High Priority"

Syntax

no bandwidth-objects

Mode

Config

Description

Delete all custom bandwidth objects.

Example

no bandwidth-objects

Syntax

bandwidth-object <BANDWIDTH_OBJ_NAME>

Mode

Config

Description

Add/edit a bandwidth object and enter its configuration mode.

Options

<BANDWIDTH_OBJ_NAME> Bandwidth object name.
Example: \"Corp High Priority\"

Example

bandwidth-object "Corp High Priority"

Syntax

name <BANDWIDTH_OBJ_NAME>

Mode

Bandwidth Object

Description

Set bandwidth object name.

Options

<BANDWIDTH_OBJ_NAME> Bandwidth object name.
Example: \"Corp High Priority\"

Example

name "Corp High Priority"

Syntax

guaranteed { kbps | mbps } <UINT32>

Mode

Bandwidth Object

Description

Set bandwidth object guaranteed bandwidth.

Options

 
kbpsKilobits per second.
 
mbpsMegabits per second.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

guaranteed mbps 50

Syntax

maximum { kbps | mbps } <UINT32>

Mode

Bandwidth Object

Description

Set bandwidth object maximum bandwidth.

Options

 
kbpsKilobits per second.
 
mbpsMegabits per second.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

maximum mbps 100

Syntax

priority { high | highest | low | lowest | medium | medium-high | medium-low | realtime }

Mode

Bandwidth Object

Description

Set the bandwidth object traffic priority.

Options

 
highHigh 2.
 
highestHighest 1.
 
lowLow 6.
 
lowestLowest 7.
 
mediumMedium 4.
 
medium-highMedium-high 3.
 
medium-lowMedium-low 5.
 
realtimeRealtime 0.

Example

priority medium-high

Syntax

action { delay | drop }

Mode

Bandwidth Object

Description

Set the bandwidth object violation action.

Options

 
delayDelay.
 
dropDrop.

Example

action delay

Syntax

comment <WORD>

Mode

Bandwidth Object

Description

Set comment for the bandwidth object.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

comment "Use to insure maximum bandwidth for high priority traffic"

Syntax

no comment

Mode

Bandwidth Object

Description

Clear a comment for the bandwidth object.

Example

no comment

Syntax

per-ip-management { kbps | mbps } <UINT32>

Mode

Bandwidth Object

Description

Enable per IP bandwidth management and set the maximum bandwidth.

Options

 
kbpsKilobits per second.
 
mbpsMegabits per second.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

per-ip-management kbps 800

Syntax

no per-ip-management

Mode

Bandwidth Object

Description

Disable per IP bandwidth management.

Example

no per-ip-management

Syntax

udp

Mode

Config

Description

Configure UDP settings.

Example

udp

Syntax

default-connection-timeout <UINT32>

Mode

UDP

Description

Set default UDP connection timeout in minutes.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

default-connection-timeout 15

Syntax

flood protection

Mode

UDP

Description

Enable UDP flood protection.

Example

flood protection

Syntax

no flood protection

Mode

UDP

Description

Disable UDP flood protection.

Example

no flood protection

Syntax

flood attack-threshold <UINT32>

Mode

UDP

Description

Set UDP flood attack threshold (UDP packets / sec).

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

flood attack-threshold 1000

Syntax

flood block-timeout <UINT8>

Mode

UDP

Description

Set UDP flood attack blocking time (sec).

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

flood block-timeout 2

Syntax

flood protected-dest-list { any | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_HOST_NETWORK_RANGE_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> }

Mode

UDP

Description

Set UDP flood attack protected destination list.

Options

 
anySet UDP flood attack protected destination list to any.
 
groupSet UDP flood attack protected destination list to named address group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostSet UDP flood attack protected destination list as host address.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameSet UDP flood attack protected destination list to named address object.
<ADDR_HOST_NETWORK_RANGE_NAME> Host/network/range address object name.
Example: Web Server
 
networkSet UDP flood attack protected destination list to network address.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeSet UDP flood attack protected destination list to range of addresses.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

flood protected-dest-list any

Syntax

icmp

Mode

Config

Description

Configure ICMP settings.

Example

icmp

Syntax

flood protection

Mode

ICMP

Description

Enable ICMP flood protection.

Example

flood protection

Syntax

no flood protection

Mode

ICMP

Description

Disable ICMP flood protection.

Example

no flood protection

Syntax

flood attack-threshold <UINT32>

Mode

ICMP

Description

Set ICMP flood attack threshold (ICMP packets / sec).

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

flood attack-threshold 1000

Syntax

flood block-timeout <UINT8>

Mode

ICMP

Description

Set ICMP flood attack blocking time (sec).

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

flood block-timeout 2

Syntax

flood protected-dest-list { any | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_HOST_NETWORK_RANGE_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> }

Mode

ICMP

Description

Set ICMP flood attack protected destination list.

Options

 
anySet ICMP flood attack protected destination list to any.
 
groupSet ICMP flood attack protected destination list to named address group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostSet ICMP flood attack protected destination list as host address.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameSet ICMP flood attack protected destination list to named address object.
<ADDR_HOST_NETWORK_RANGE_NAME> Host/network/range address object name.
Example: Web Server
 
networkSet ICMP flood attack protected destination list to network address.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeSet ICMP flood attack protected destination list to range of addresses.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

flood-protected-dest-list any

Syntax

qos-mapping reset

Mode

Config

Description

Reset QoS mapping settings.

Example

qos-mapping reset

Syntax

qos-mapping cos <UINT8> [ to-dscp <UINT8> ] [ from-dscp <UINT8> <UINT8> ]

Mode

Config

Description

Configure QoS mapping.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123
to-dscpSet the DSCP value to map to.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
from-dscpSet the from DSCP range.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

qos-mapping cos 0 to-dscp 1 from-dscp 1 6

Syntax

show firewall [ connection-status ]

Mode

All Modes

Description

Show firewall settings.

Options

connection-statusShow firewall connections status.

Example

show firewall

Syntax

show bandwidth-management [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show bandwidth management settings.

Options

 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show bandwidth-management

Syntax

show multicast [ { pending-config | with-pending-config } | state { entries | entry address <MULTICAST_GROUP_IPV4_HOST> interface <MULTICAST_INTERFACE> } ]

Mode

All Modes

Description

Show multicast configuration.

Options

 
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
stateShow multicast state.
 
entriesShow multicast state entries.
 
entryShow a specified multicast state entry.
addressMulticast group address.
<MULTICAST_GROUP_IPV4_HOST> Group address object name.
Example: Sales Group
interfaceInterface or vpn tunnel.
<MULTICAST_INTERFACE> Multicast interface name.
Example: X0

Example

show multicast

show multicast state entries
show multicast state entry address 192.168.168.10 interface X0

Syntax

show access-rule from <ACCESS_RULE_ZONE_NAME> to <ACCESS_RULE_ZONE_NAME> action { { allow | deny | discard } } [ source { [ address { { any | fqdn <ADDR_FQDN> | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | mac <ADDR_MAC> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] [ port { { any | group <SVC_GROUP_NAME> | name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ] } ] [ service { { any | group <SVC_GROUP_NAME> | name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ] [ destination { [ address { { any | fqdn <ADDR_FQDN> | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | mac <ADDR_MAC> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] } ] [ schedule { { always-on | days <SCHED_DAYS> time <SCHED_TIME_BEGIN> <SCHED_TIME_END> | name <SCHED_NAME> } } ] [ { pending-config | with-pending-config } ] [ json | validate | xml ]

Mode

All Modes

Description

Show an access rule.

Options

<ACCESS_RULE_ZONE_NAME> Zone object name.
Example: DMZ
toDestination zone.
<ACCESS_RULE_ZONE_NAME> Zone object name.
Example: DMZ
actionSet the action for this access rule.
 
allowAllow traffic matching the criteria.
 
denyDeny traffic matching the criteria.
 
discardDiscard traffic matching the criteria.
sourceSource.
addressSource address.
 
anyAny address.
 
fqdnAddress object full qualified domain name.
<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
macAddress object mac.
<ADDR_MAC> Address object MAC address in the form: HH:HH:HH:HH:HH:HH or HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
portSource port.
 
anyAny source service.
 
groupSource service Group name.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameSource service Object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolSource service Object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80
serviceDestination service.
 
anyAny destination service.
 
groupService group name.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolService object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80
destinationDestination.
addressDestination address.
 
anyAny address.
 
fqdnAddress object full qualified domain name.
<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
macAddress object mac.
<ADDR_MAC> Address object MAC address in the form: HH:HH:HH:HH:HH:HH or HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
scheduleSchedule.
 
always-onAlways on.
 
daysSchedule object days.
<SCHED_DAYS> Days of the week in the form: SU-M-T-W-TH-F-SA.
Example: SU-M-TH-SA
timeSchedule object beginning/ending time.
<SCHED_TIME_BEGIN> Time in the form: DD:DD.
Example: 12:00
<SCHED_TIME_END> Time in the form: DD:DD.
Example: 12:00
 
nameSchedule object name.
<SCHED_NAME> Schedule object name.
Example: Work Hours
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show access-rule from LAN to WLAN action allow

Syntax

show access-rule id <OBJECT_INDEX>

Mode

All Modes

Description

Show an access rule for associated id.

Options

<OBJECT_INDEX> Integer in the form: D OR 0xHHHHHHHH.
Example: 1

Example

show access-rule id 3

Syntax

show access-rules [ ipv4 | ipv6 ] [ from <ACCESS_RULE_ZONE_NAME> to <ACCESS_RULE_ZONE_NAME> | statistics | unused ] [ { pending-config | with-pending-config } ] [ json | validate | xml ]

Mode

All Modes

Description

Show all access rules.

Options

 
ipv4Show IPv4 access rules.
 
ipv6Show IPv6 access rules.
 
fromSource zone.
<ACCESS_RULE_ZONE_NAME> Zone object name.
Example: DMZ
toDestination zone.
<ACCESS_RULE_ZONE_NAME> Zone object name.
Example: DMZ
 
statisticsShow access rule statistics
 
unusedShow access rules assigned to a Zone that has not been assigned to an interface.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show access-rules

show access-rules from * to WAN
show access-rules from DMZ to WAN

Syntax

show access-rule ipv6 from <ACCESS_RULE_ZONE_NAME> to <ACCESS_RULE_ZONE_NAME> action { { allow | deny | discard } } [ source { [ address { { any | fqdn <ADDR_FQDN> | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | mac <ADDR_MAC> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] [ port { { any | group <SVC_GROUP_NAME> | name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ] } ] [ service { { any | group <SVC_GROUP_NAME> | name <SVC_NAME> | protocol <SVC_PROTOCOL> <SVC_PORT_BEGIN> <SVC_PORT_END> } } ] [ destination { [ address { { any | fqdn <ADDR_FQDN> | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | mac <ADDR_MAC> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } ] } ] [ schedule { { always-on | days <SCHED_DAYS> time <SCHED_TIME_BEGIN> <SCHED_TIME_END> | name <SCHED_NAME> } } ] [ { pending-config | with-pending-config } ] [ json | validate | xml ]

Mode

All Modes

Description

Show an access rule.

Options

<ACCESS_RULE_ZONE_NAME> Zone object name.
Example: DMZ
toDestination Zone.
<ACCESS_RULE_ZONE_NAME> Zone object name.
Example: DMZ
actionSet the action for this access rule.
 
allowAllow traffic matching the criteria.
 
denyDeny traffic matching the criteria.
 
discardDiscard traffic matching the criteria.
sourceSource.
addressSource address.
 
anyAny address.
 
fqdnAddress object full qualified domain name.
<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
macAddress object mac.
<ADDR_MAC> Address object MAC address in the form: HH:HH:HH:HH:HH:HH or HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
portSource port.
 
anyAny source service.
 
groupSource service Group name.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameSource service Object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolSource service Object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80
serviceDestination service.
 
anyAny destination service.
 
groupService group name.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS
 
protocolService object protocol.
<SVC_PROTOCOL> Service protocol.
Example: TCP
<SVC_PORT_BEGIN> Integer in the form: D OR 0xHHHH.
Example: 80
<SVC_PORT_END> Integer in the form: D OR 0xHHHH.
Example: 80
destinationDestination.
addressDestination address.
 
anyAny address.
 
fqdnAddress object full qualified domain name.
<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
groupAddress group name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
macAddress object mac.
<ADDR_MAC> Address object MAC address in the form: HH:HH:HH:HH:HH:HH or HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
scheduleSchedule.
 
always-onAlways on.
 
daysSchedule object days.
<SCHED_DAYS> Days of the week in the form: SU-M-T-W-TH-F-SA.
Example: SU-M-TH-SA
timeSchedule object beginning/ending time.
<SCHED_TIME_BEGIN> Time in the form: DD:DD.
Example: 12:00
<SCHED_TIME_END> Time in the form: DD:DD.
Example: 12:00
 
nameSchedule object name.
<SCHED_NAME> Schedule object name.
Example: Work Hours
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show access-rule ipv6 from LAN to WLAN action allow

Syntax

show access-rule ipv6 id <OBJECT_INDEX> [ { pending-config | with-pending-config } ] [ json | validate | xml ]

Mode

All Modes

Description

Show an IPv6 access rule for associated id.

Options

<OBJECT_INDEX> Integer in the form: D OR 0xHHHHHHHH.
Example: 1
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show access-rule ipv6 id 3

Syntax

show ssl-control [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show SSL control configuration.

Options

 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show ssl-control

Syntax

show tcp [ { pending-config | with-pending-config } | statistics ]

Mode

All Modes

Description

Show TCP configuration or traffic statistics.

Options

 
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
statisticsShow TCP statistics.

Example

show tcp

Syntax

show bandwidth-objects [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show all bandwidth objects.

Options

 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show bandwidth-objects

Syntax

show bandwidth-object <BANDWIDTH_OBJ_NAME> [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show a bandwidth object.

Options

<BANDWIDTH_OBJ_NAME> Bandwidth object name.
Example: \"Corp High Priority\"
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show bandwidth-object "Corp High Priority"

Syntax

show udp [ { pending-config | with-pending-config } | statistics ]

Mode

All Modes

Description

Show UDP configuration or traffic statistics.

Options

 
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
statisticsShow UDP statistics.

Example

show udp

Syntax

show icmp [ { pending-config | with-pending-config } | statistics ]

Mode

All Modes

Description

Show ICMP configuration or traffic statistics.

Options

 
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
statisticsShow ICMP statistics.

Example

show icmp

Syntax

show qos-mapping [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show QoS mapping.

Options

 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show qos-mapping

Syntax

administration

Mode

Config

Description

Administration settings.

Example

administration

Syntax

firewall-name <WORD>

Mode

Administration

Description

Set the name for the firewall.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

firewall-name "ACME Corporate Firewall"

Syntax

no firewall-name

Mode

Administration

Description

Clear the name for the firewall.

Example

no firewall-name

Syntax

firewall-domain-name <WORD>

Mode

Administration

Description

Set the domain name for the firewall.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

firewall-domain-name "ACME Corporate"

Syntax

no firewall-domain-name

Mode

Administration

Description

Clear the doamin name for the firewall.

Example

no firewall-domain-name

Syntax

language-override { chinese | chinese_traditional | english | french | german | italian | japanese | korean | portuguese | spanish }

Mode

Administration

Options

 
chineseChinese.
 
chinese_traditionalChinese (Traditional).
 
englishEnglish.
 
frenchFrench.
 
germanGerman.
 
italianItalian.
 
japaneseJapanese.
 
koreanKorean.
 
portuguesePortuguese.
 
spanishSpanish.

Example

language-override english

Syntax

no language-override

Mode

Administration

Example

no language-override

Syntax

admin-name <WORD>

Mode

Administration

Description

Set the name for the built in administrator.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

admin-name headhoncho

Syntax

admin-password old-password <WORD> new-password <WORD> confirm-password <WORD>

Mode

Administration

Description

Set the password for the built in administrator.

Options

old-passwordEnter the old password.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
new-passwordEnter the new password.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
confirm-passwordConfirm the new password.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

admin-password old-password passwd new-password smorgasbord confirm-password smorgasbord

Syntax

password aging [ duration <UINT16> ]

Mode

Administration

Description

Enable that password must be changed every set number of days and configure duration.

Options

durationSet the number of days before the password must be changed.
<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

password aging duration 90

Syntax

no password aging

Mode

Administration

Description

Disable that password must be changed every set number of days.

Example

no password aging

Syntax

password uniqueness [ count <UINT8> ]

Mode

Administration

Description

Enable barring of repeated passwords and configure.

Options

countSet the number of password changes before repeated password are allowed.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

password uniqueness count 5

Syntax

no password uniqueness

Mode

Administration

Description

Disable barring of repeated passwords.

Example

no password uniqueness

Syntax

password minimum-length <UINT8>

Mode

Administration

Description

Set the minimum password length to enforce.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

password minimum-length 8

Syntax

password complexity alpha-and-numeric-and-symbols

Mode

Administration

Description

Set the allowed complexity of the password.

Example

password complexity alpha-and-numeric-and-symbols

Syntax

password complexity alpha-and-numeric

Mode

Administration

Description

Set the allowed complexity of the password.

Example

password complexity alpha-and-numeric

Syntax

password complexity upper-case <UINT16>

Mode

Administration

Description

Set the upper-case complexity of the password.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

password complexity upper-case 1

Syntax

password complexity lower-case <UINT16>

Mode

Administration

Description

Set the lower-case complexity of the password.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

password complexity lower-case 1

Syntax

password complexity digital <UINT16>

Mode

Administration

Description

Set the digital complexity of the password.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

password complexity digital 1

Syntax

password complexity symbolic <UINT16>

Mode

Administration

Description

Set the symbolic complexity of the password.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

password complexity symbolic 1

Syntax

no password complexity [ digital | lower-case | symbolic | upper-case ]

Mode

Administration

Description

Clear password complexity.

Options

 
digitalSet minimum digital character number.
 
lower-caseSet minimum lower case character number.
 
symbolicSet minimum symbolic character number.
 
upper-caseSet minimum upper case character number.

Example

no password complexity

Syntax

password constraints-apply-to [ builtin-admin ] [ full-admins ] [ limited-admins ] [ local-users ] [ guest-admins ]

Mode

Administration

Description

Set whom to apply the password constraints to.

Options

builtin-adminBuilt in administrator.
full-adminsOther full administrators.
limited-adminsLimited administrators.
local-usersOther local users.
guest-adminsGuest admins.

Example

password constraints-apply-to builtin-admin full-admins

Syntax

no password constraints-apply-to [ builtin-admin ] [ full-admins ] [ limited-admins ] [ local-users ] [ guest-admins ]

Mode

Administration

Description

Remove setting of whom to apply the password constraints to.

Options

builtin-adminBuilt in administrator.
full-adminsOther full administrators.
limited-adminsLimited administrators.
local-usersOther local users.
guest-adminsGuest admins.

Example

no password constraints-apply-to builtin-admin full-admins

Syntax

idle-logout-time <UINT16>

Mode

Administration

Description

Set the allowed period of inactivity before administrators are logged out of the management interface.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

idle-logout-time 60

Syntax

user-lockout [ failures-per-minute <UINT8> ] [ lockout-duration <UINT8> ]

Mode

Administration

Description

Enable administrator / user lockout and set conditions.

Options

failures-per-minuteSet the failed login attempts per minute before lockout.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
lockout-durationSet number of minutes a user should be locked out.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

user-lockout failures-per-minute 5 lockout-duration 10

Syntax

no user-lockout

Mode

Administration

Description

Disable administrator / user lockout for set conditions.

Example

no user-lockout

Syntax

admin-preempt-action { goto-non-config | logout }

Mode

Administration

Description

Set action to do upon preemption by another administrator.

Options

 
goto-non-configDrop to non-config mode.
 
logoutLogout.

Example

admin-preempt-action logout

Syntax

admin-preempt-inactivity-timeout <UINT16>

Mode

Administration

Description

Allow preemption by a lower priority administrator after inactivity of (minutes).

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

admin-preempt-inactivity-timeout 10

Syntax

inter-admin-messaging <UINT8>

Mode

Administration

Description

Enable inter administrator messaging and set the messaging polling interval.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

inter-admin-messaging 10

Syntax

no inter-admin-messaging

Mode

Administration

Description

Disable inter-administrator messaging.

Example

no inter-admin-messaging

Syntax

web-management allow-http

Mode

Administration

Description

Allow HTTP management (it is less secure than using HTTPS).

Example

web-management allow-http

Syntax

no web-management allow-http

Mode

Administration

Description

Do not allow HTTP management (it is less secure than using HTTPS).

Example

no web-management allow-http

Syntax

web-management suite-b-in-https

Mode

Administration

Description

Enable suite B mode in HTTPS.

Example

web-management suite-B-in-https

Syntax

no web-management suite-b-in-https

Mode

Administration

Description

Disable suite B mode in HTTPS.

Example

no web-management suite-B-in-https

Syntax

web-management http-port <IPV4_PORT>

Mode

Administration

Description

Set the HTTP management port.

Options

<IPV4_PORT> Integer in the form: D OR 0xHHHH.
Example: 80

Example

web-management http-port 8080

Syntax

web-management https-port <IPV4_PORT>

Mode

Administration

Description

Set the HTTPS management port.

Options

<IPV4_PORT> Integer in the form: D OR 0xHHHH.
Example: 80

Example

web-management https-port 4433

Syntax

web-management certificate { name <CERT_NAME> | use-self-signed }

Mode

Administration

Description

Set the HTTPS management server certificate to use.

Options

 
nameSpecify certificate.
<CERT_NAME> Certificate name.
Example: my_cert
 
use-self-signedUse self signed certificate.

Example

web-management certificate name "ACME Inc."

Syntax

web-management cert-common-name <WORD>

Mode

Administration

Description

Set the self signed certificate common name.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

web-management cert-common-name www.acme.com

Syntax

no web-management cert-common-name

Mode

Administration

Description

Clear the self signed certificate common name.

Example

no web-management cert-common-name

Syntax

web-management client-certificate-check

Mode

Administration

Description

Enable client certificate check.

Example

web-management client-certificate-check

Syntax

no web-management client-certificate-check

Mode

Administration

Description

Disable client certificate check.

Example

no web-management client-certificate-check

Syntax

web-management client-certificate-issuer <CERT_ISSUER>

Mode

Administration

Description

Set client certificate issuer.

Options

<CERT_ISSUER> Certificate Issuer.
Example: Thawte Server CA

Example

web-management client-certificate-issuer "Thawte Premium Server CA"

Syntax

web-management ocsp-check <URL>

Mode

Administration

Description

Enable ocsp check.

Options

<URL> URL in the form: http://host/file.
Example: http://www.example.com/products/

Example

web-management ocsp-check http://www.example.com/products/

Syntax

no web-management ocsp-check

Mode

Administration

Description

Disable ocsp check.

Example

no web-management ocsp-check

Syntax

web-management default-table-size <UINT16>

Mode

Administration

Description

Set default size of tables within the Web Management User Interface.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

web-management default-table-size 50

Syntax

web-management refresh-interval <UINT16>

Mode

Administration

Description

Set auto-update refresh interval of tables within the web management user interface.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

web-management refresh-interval 15

Syntax

dashboard-as-starting-page

Mode

Administration

Description

Use dashboard as starting page.

Example

dashboard-as-starting-page

Syntax

no dashboard-as-starting-page

Mode

Administration

Description

Disable to use dashboard as starting page.

Example

no dashboard-as-starting-page

Syntax

web-management tooltip [ form-delay <UINT16> ] [ button-delay <UINT16> ] [ text-delay <UINT16> ]

Mode

Administration

Description

Enable tooltips in web management UI and configure.

Options

form-delaySet form tooltip delay.
<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123
button-delaySet button tooltip delay.
<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123
text-delaySet text tooltip delay.
<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

web-management tooltip form-delay 2000 button-delay 3000 text-delay 500

Syntax

no web-management tooltip

Mode

Administration

Description

Disable tooltips in web management UI and configure.

Example

no web-management tooltip

Syntax

lcd administrative-interface

Mode

Administration

Description

Enable front-Panel administrative interface.

Example

lcd administrative-interface

Syntax

no lcd administrative-interface

Mode

Administration

Description

Disable front-panel administrative interface.

Example

no lcd administrative-interface

Syntax

lcd configuration-menu

Mode

Administration

Description

Enable configuration menu.

Example

lcd configuration-menu

Syntax

no lcd configuration-menu

Mode

Administration

Description

Disable configuration menu.

Example

no lcd configuration-menu

Syntax

lcd pin <ENC_PIN_VALUE> confirm-pin <ENC_PIN_VALUE>

Mode

Administration

Description

Configure pin for configuration menu access.

Options

<ENC_PIN_VALUE> String contains 4-6 numeric (0-9) characters.
Example: 123456
confirm-pinConfirm pin value.
<ENC_PIN_VALUE> String contains 4-6 numeric (0-9) characters.
Example: 123456

Example

lcd pin 123456 confirm-pin 123456

Syntax

no lcd pin

Mode

Administration

Description

Disable pin for configuration menu access.

Example

no lcd pin

Syntax

ssh port <IPV4_PORT>

Mode

Administration

Description

Set the SSH management port.

Options

<IPV4_PORT> Integer in the form: D OR 0xHHHH.
Example: 80

Example

ssh port 4022

Syntax

override-sonicpointn-download url <WORD>

Mode

Administration

Description

Manually specify SonicPoint-N image URL (http://).

Options

urlSpecify URL.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

override-sonicpointn-download url my.webserver.local/applications/sonicpointn.img.bin

Syntax

no override-sonicpointn-download

Mode

Administration

Description

Disable manually specifying SonicPoint-N image URL.

Example

no override-sonicpointn-download

Syntax

override-sonicpointnv-download url <WORD>

Mode

Administration

Description

Manually specify SonicPoint-Nv image URL (http://).

Options

urlSpecify URL.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

override-sonicpointnv-download url my.webserver.local/applications/sonicpointnv.img.bin

Syntax

no override-sonicpointnv-download

Mode

Administration

Description

Disable manually specifying SonicPoint-Nv image URL.

Example

no override-sonicpointnv-download

Syntax

override-sonicpointndr-download url <WORD>

Mode

Administration

Description

Manually specify SonicPoint-NDR image URL (http://).

Options

urlSpecify URL.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

override-sonicpointndr-download url my.webserver.local/applications/sonicpointndr.img.bin

Syntax

no override-sonicpointndr-download

Mode

Administration

Description

Disable manually specifying SonicPoint-NDR image URL.

Example

no override-sonicpointndr-download

Syntax

gms-management { existing-tunnel | https | ipsec-tunnel }

Mode

Administration

Description

Enable GMS management and set the type of tunnel to use.

Options

 
existing-tunnelUse existing tunnel.
 
httpsUse HTTPS.
 
ipsec-tunnelUse IPSEC tunnel.

Example

gms-management ssl

Syntax

no gms-management

Mode

Administration

Description

Disable GMS Management.

Example

no gms-management

Syntax

host-name <HOSTNAME>

Mode

GMS IPSEC

GMS Existing Tunnel
GMS HTTPS

Description

Set the GMS server IP or hostname.

Options

<HOSTNAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com

Example

host-name 10.10.10.10

Syntax

syslog-server-port <IPV4_PORT>

Mode

GMS IPSEC

GMS Existing Tunnel
GMS HTTPS

Description

Set the syslog server port of the GMS server.

Options

<IPV4_PORT> Integer in the form: D OR 0xHHHH.
Example: 80

Example

syslog-server-port 514

Syntax

no syslog-server-port

Mode

GMS IPSEC

GMS Existing Tunnel
GMS HTTPS

Description

Clear syslog server port of the GMS server.

Example

no syslog-server-port

Syntax

heartbeat-status-only

Mode

GMS IPSEC

GMS Existing Tunnel
GMS HTTPS

Description

Enable Send Heartbeat Status Messages Only.

Example

heartbeat-status-only

Syntax

no heartbeat-status-only

Mode

GMS IPSEC

GMS Existing Tunnel
GMS HTTPS

Description

Disable Send Heartbeat Status Messages Only.

Example

no heartbeat-status-only

Syntax

behind-nat-device ip <IPV4_HOST>

Mode

GMS IPSEC

GMS Existing Tunnel
GMS HTTPS

Description

Enable Behind NAT Device indicator and configure IP.

Options

ipSet IP of NAT device.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

behind-nat-device ip 192.168.168.16

Syntax

no behind-nat-device

Mode

GMS IPSEC

GMS Existing Tunnel
GMS HTTPS

Description

Disable Behind NAT Device indicator.

Example

no behind-nat-device

Syntax

spi <WORD>

Mode

GMS IPSEC

Description

Set Incoming / Outgoing IPSEC SPI.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

spi C50F73F4

Syntax

encryption-type des-md5

Mode

GMS IPSEC

Description

Set IPSEC encryption type.

Options

des-md5DES-MD5.

Example

encryption-type des-md5

Syntax

encryption-key <HEX_STRING>

Mode

GMS IPSEC

Description

Set IPSEC Encryption Key.

Options

<HEX_STRING> String of hexadecimal digits.
Example: 0123456989abcdef

Example

encryption-key 9f8c6ae4fb897002

Syntax

authentication-key <HEX_STRING>

Mode

GMS IPSEC

Description

Set IPSEC authentication key.

Options

<HEX_STRING> String of hexadecimal digits.
Example: 0123456989abcdef

Example

ipsec-authentication-key bd5a1354f5a5a8e198974d4d997fac5e

Syntax

reporting-server [ ip <HOSTNAME> ] [ port <IPV4_PORT> ]

Mode

GMS HTTPS

Description

Enable Send Syslog Messages to a Distributed GMS Reporting Server and configure.

Options

ipSet distributed GMS reporting server IP address.
<HOSTNAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com
portSet distributed GMS reporting server port.
<IPV4_PORT> Integer in the form: D OR 0xHHHH.
Example: 80

Example

reporting-server ip 10.10.10.11 port 514

Syntax

no reporting-server [ ip | port ]

Mode

GMS HTTPS

Description

Disable Send Syslog Messages to a Distributed GMS Reporting Server.

Options

 
ipClear distributed GMS reporting server IP address.
 
portClear distributed GMS reporting server port.

Example

no reporting-server

Syntax

snmp

Mode

Config

Description

Enable SNMP and Enter SNMP configuration mode.

Example

snmp

Syntax

no snmp

Mode

Config

Description

Disable SNMP.

Example

no snmp

Syntax

system-name <WORD>

Mode

SNMP

Description

Set the SNMP system name.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

system-name "Corporate Gateway"

Syntax

no system-name

Mode

SNMP

Description

Remove the SNMP system name.

Example

no system-name

Syntax

system-contact <WORD>

Mode

SNMP

Description

Set the SNMP system contact.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

system-contact "John Doe"

Syntax

no system-contact

Mode

SNMP

Description

Remove the SNMP system contact.

Example

no system-contact

Syntax

system-location <WORD>

Mode

SNMP

Description

Set the SNMP system location.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

system-location "Corporate Site"

Syntax

no system-location

Mode

SNMP

Description

Remove the SNMP system location.

Example

no system-location

Syntax

asset-number <WORD>

Mode

SNMP

Description

Set the SNMP asset number.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

asset-number Unit001

Syntax

no asset-number

Mode

SNMP

Description

Remove the SNMP asset number.

Example

no asset-number

Syntax

get-community-name <WORD>

Mode

SNMP

Description

Set the SNMP get community name.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

get-community-name public

Syntax

no get-community-name

Mode

SNMP

Description

Remove the SNMP get community name.

Example

no get-community-name

Syntax

trap-community-name <WORD>

Mode

SNMP

Description

Set the SNMP trap community name.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

trap-community-name public

Syntax

no trap-community-name

Mode

SNMP

Description

Remove the SNMP trap community name.

Example

no trap-community-name

Syntax

host <UINT8> <HOSTNAME>

Mode

SNMP

Description

Set SNMP trap host.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123
<HOSTNAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com

Example

host 1 192.168.168.201

Syntax

no host <UINT8>

Mode

SNMP

Description

Remove SNMP Trap Host.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

no host 1

Syntax

snmp3 mandatory

Mode

SNMP

Description

Enable mandatory requirement for SNMP3.

Example

snmp3 mandatory

Syntax

no snmp3 mandatory

Mode

SNMP

Description

Disable mandatory requirement for SNMP3.

Example

no snmp3 mandatory

Syntax

snmp3 engine-id <WORD>

Mode

SNMP

Description

Set SNMP3 Engine ID.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

snmp3 engine-id 80002225030017C5696969

Syntax

snmp3 increase-subsystem-priority

Mode

SNMP

Description

Enable increase subsystem priority for SNMP3.

Example

snmp3 increase-subsystem-priority

Syntax

no snmp3 increase-subsystem-priority

Mode

SNMP

Description

Disable increase subsystem priority for SNMP3.

Example

no snmp3 increase-subsystem-priority

Syntax

view <SNMP_VIEW_NAME> oid <WORD>

Mode

SNMP

Description

Add/Edit an SNMP view OID list and enter its configuration mode.

Options

<SNMP_VIEW_NAME> Word in the form: WORD or \"QUOTED STRING\".
Example: ICMP
oidAdd an OID to the SNMP view list.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

view CorpSNMPViewList oid 1.3.6.1.2.1.32

Syntax

no view <SNMP_VIEW_NAME> [ oid <SNMP_OID_IN_VIEW> ]

Mode

SNMP

Description

Delete an SNMP view OID list.

Options

<SNMP_VIEW_NAME> Word in the form: WORD or \"QUOTED STRING\".
Example: ICMP
oidDelete an OID from the SNMP view list.
<SNMP_OID_IN_VIEW> SNMP view oid name.
Example: 1.3.5

Example

no view CorpSNMPViewList oid 1.3.6.1.2.1.32

Syntax

group <SNMP_GROUP_NAME>

Mode

SNMP

Description

Add an SNMP group.

Options

<SNMP_GROUP_NAME> Word in the form: WORD or \"QUOTED STRING\".
Example: Group1

Example

group CorpSNMPGroup

Syntax

no group <SNMP_GROUP_NAME>

Mode

SNMP

Description

Delete an SNMP group.

Options

<SNMP_GROUP_NAME> Word in the form: WORD or \"QUOTED STRING\".
Example: Group1

Example

no group CorpSNMPGroup

Syntax

user <SNMP_USER_NAME>

Mode

SNMP

Description

Add/Edit an SNMP user and enter its configuration mode.

Options

<SNMP_USER_NAME> Word in the form: WORD or \"QUOTED STRING\".
Example: Group1

Example

user snmp-admin1

Syntax

no user <SNMP_USER_NAME>

Mode

SNMP

Description

Delete an SNMP user.

Options

<SNMP_USER_NAME> Word in the form: WORD or \"QUOTED STRING\".
Example: Group1

Example

no user snmp-admin1

Syntax

name <WORD>

Mode

SNMP User

Description

Set an SNMP user name.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

name snmp-admin1

Syntax

security-level { authentication-and-privacy | authentication-only }

Mode

SNMP User

Description

Set a SNMP user security level.

Options

 
authentication-and-privacyUse authentication and encryption.
 
authentication-onlyUse authentication.

Example

security-level authentication-and-privacy

security-level authentication-only

Syntax

no security-level

Mode

SNMP User

Description

Disable authentication and encryption.

Example

no security-level

Syntax

authentication { md5 | sha1 } <ENC_PASSWORD>

Mode

SNMP User

Description

Set a SNMP user authentication type and key.

Options

 
md5MD5.
 
sha1SHA-1.
<ENC_PASSWORD> Password.
Example: secret

Example

authentication md5 bd5a1354f5a5a8e198974d4d997fac5e

Syntax

encryption { aes | des } <ENC_PASSWORD>

Mode

SNMP User

Description

Set a SNMP user encryption.

Options

 
aesAES.
 
desDES.
<ENC_PASSWORD> Password.
Example: secret

Example

encryption des 9f8c6ae4fb897002

Syntax

group <SNMP_GROUP_NAME>

Mode

SNMP User

Description

Assign an SNMP group.

Options

<SNMP_GROUP_NAME> Word in the form: WORD or \"QUOTED STRING\".
Example: Group1

Example

group CorpSNMPGroup

Syntax

no group

Mode

SNMP User

Description

Assign user to *No Group*.

Example

no group

Syntax

access <SNMP_ACCESS_NAME>

Mode

SNMP

Description

Add/Edit an SNMP access object and enter its configuration mode.

Options

<SNMP_ACCESS_NAME> Word in the form: WORD or \"QUOTED STRING\".
Example: Group1

Example

access SnmpAccessObject

Syntax

no access <SNMP_ACCESS_NAME>

Mode

SNMP

Description

Delete an SNMP access object.

Options

<SNMP_ACCESS_NAME> Word in the form: WORD or \"QUOTED STRING\".
Example: Group1

Example

no access SnmpAccessObject

Syntax

name <WORD>

Mode

SNMP Access

Description

Set an SNMP access object name.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

name SnmpAccessObject

Syntax

read-view <SNMP_VIEW_NAME>

Mode

SNMP Access

Description

Set the SNMP read view.

Options

<SNMP_VIEW_NAME> Word in the form: WORD or \"QUOTED STRING\".
Example: ICMP

Example

read-view interfaces

Syntax

master-group <SNMP_GROUP_NAME>

Mode

SNMP Access

Description

Assign a master SNMP3 master group.

Options

<SNMP_GROUP_NAME> Word in the form: WORD or \"QUOTED STRING\".
Example: Group1

Example

master-group CorpSNMPGroup

Syntax

security-level { authentication-and-privacy | authentication-only }

Mode

SNMP Access

Description

Set SNMP access security level.

Options

 
authentication-and-privacyUse authentication and encryption.
 
authentication-onlyUse authentication.

Example

security-level authentication-only

security-level authentication-and-privacy

Syntax

no security-level

Mode

SNMP Access

Description

Disable authentication and encryption.

Example

no security-level

Syntax

export current-config { cli | exp } { ftp <FTP_URL> | scp <SCP_URL> }

Mode

All Modes

Description

Export current configuration.

Options

 
cliExport configuration using the SonicOS E-CLI command format.
 
expExport configuration using the SonicOS WebUI (.exp) format.
 
ftpExport using the FTP protocol.
<FTP_URL> FTP URL in the form: ftp://username:password@hostname/\n Escape character: ':' -> '\\\\:', '@' -> '\\\\@', '/' -> '\\\\/', '\\' -> '\\\\\\\\'.
Example: ftp://username:password@hostname/\nftp://username@hostname/\nftp://hostname/
 
scpExport using the SCP protocol.
<SCP_URL> SCP URL in the form: scp://username@host/\n Escape character: ':' -> '\\\\:', '@' -> '\\\\@', '/' -> '\\\\/', '\\' -> '\\\\\\\\'.
Example: scp://username@host/\nscp://host/

Example

export current-config cli ftp ftp://user:password@servername/sw-prodname-buildversion-ecli.txt

export current-config cli scp scp://user@server/sw-prodname-buildversion-ecli.txt

Syntax

export pending-config { cli | exp } { ftp <FTP_URL> | scp <SCP_URL> }

Mode

All Modes (
excluding Top Level)

Description

Export pending configuration.

Options

 
cliExport configuration using the SonicOS E-CLI command format.
 
expExport configuration using the SonicOS WebUI (.exp) format.
 
ftpExport using the FTP protocol.
<FTP_URL> FTP URL in the form: ftp://username:password@hostname/\n Escape character: ':' -> '\\\\:', '@' -> '\\\\@', '/' -> '\\\\/', '\\' -> '\\\\\\\\'.
Example: ftp://username:password@hostname/\nftp://username@hostname/\nftp://hostname/
 
scpExport using the SCP protocol.
<SCP_URL> SCP URL in the form: scp://username@host/\n Escape character: ':' -> '\\\\:', '@' -> '\\\\@', '/' -> '\\\\/', '\\' -> '\\\\\\\\'.
Example: scp://username@host/\nscp://host/

Example

export pending-config cli ftp ftp://user:password@servername/sw-prodname-buildversion-ecli.txt

export pending-config cli scp scp://user@server/sw-prodname-buildversion-ecli.txt

Syntax

export firmware { current | system-backup | uploaded } { ftp <FTP_URL> | scp <SCP_URL> }

Mode

Config

Description

Export the current firmware image off of the appliance.

Options

 
currentCurrent Firmware.
 
system-backupDownload the system backup firmware image.
 
uploadedDownload the latest uploaded firmware image.
 
ftpExport using the FTP protocol.
<FTP_URL> FTP URL in the form: ftp://username:password@hostname/\n Escape character: ':' -> '\\\\:', '@' -> '\\\\@', '/' -> '\\\\/', '\\' -> '\\\\\\\\'.
Example: ftp://username:password@hostname/\nftp://username@hostname/\nftp://hostname/
 
scpExport using the SCP protocol.
<SCP_URL> SCP URL in the form: scp://username@host/\n Escape character: ':' -> '\\\\:', '@' -> '\\\\@', '/' -> '\\\\/', '\\' -> '\\\\\\\\'.
Example: scp://username@host/\nscp://host/

Example

export firmware current ftp ftp://user:password@servername/firmware.bin.sig

export firmware current scp scp://user@server/firmware.bin.sig

Syntax

export tech-support-report { ftp <FTP_URL> | scp <SCP_URL> }

Mode

Top Level

Config

Description

Export the technical support report.

Options

 
ftpExport using the FTP protocol.
<FTP_URL> FTP URL in the form: ftp://username:password@hostname/\n Escape character: ':' -> '\\\\:', '@' -> '\\\\@', '/' -> '\\\\/', '\\' -> '\\\\\\\\'.
Example: ftp://username:password@hostname/\nftp://username@hostname/\nftp://hostname/
 
scpExport using the SCP protocol.
<SCP_URL> SCP URL in the form: scp://username@host/\n Escape character: ':' -> '\\\\:', '@' -> '\\\\@', '/' -> '\\\\/', '\\' -> '\\\\\\\\'.
Example: scp://username@host/\nscp://host/

Example

export tech-support-report ftp ftp://user:password@servername/techSupport.wri

export tech-support-report scp scp://user@server/techSupport.wri

Syntax

firmware auto { download | update }

Mode

Config

Description

Enable periodic checking of SonicWALL site for firmware update.

Options

 
downloadEnable automatic downloading of firmware from SonicWALL software site.
 
updateEnable periodic checking of SonicWALL site for firmware update.

Example

firmware auto update

Syntax

no firmware auto { download | update }

Mode

Config

Description

Disable periodic checking of SonicWALL site for firmware update.

Options

 
downloadDisable automatic downloading of firmware from SonicWALL software site.
 
updateDisable periodic checking of SonicWALL site for firmware update.

Example

no firmware auto update

Syntax

firmware diagnostics

Mode

Config

Description

Enable booting of firmware with diagnostics mode enabled (if available).

Example

firmware diagnostics

Syntax

no firmware diagnostics

Mode

Config

Description

Disable booting of firmware with diagnostics.

Example

no firmware diagnostics

Syntax

firmware backup

Mode

Config

Description

Create Backup Settings.

Syntax

import firmware { ftp <FTP_URL> | scp <SCP_URL> }

Mode

Config

Description

Import firmware to the firewall.

Options

 
ftpImport using the FTP protocol.
<FTP_URL> FTP URL in the form: ftp://username:password@hostname/\n Escape character: ':' -> '\\\\:', '@' -> '\\\\@', '/' -> '\\\\/', '\\' -> '\\\\\\\\'.
Example: ftp://username:password@hostname/\nftp://username@hostname/\nftp://hostname/
 
scpExport using the SCP protocol.
<SCP_URL> SCP URL in the form: scp://username@host/\n Escape character: ':' -> '\\\\:', '@' -> '\\\\@', '/' -> '\\\\/', '\\' -> '\\\\\\\\'.
Example: scp://username@host/\nscp://host/

Example

import firmware ftp ftp://user:password@servername/firmware.bin.sig

import firmware scp scp://user@server/firmware.bin.sig

Syntax

restart [ at <TIME_YYYYMMDDHHMMSS> | in <UINT32> { days | hours | minutes } | now | time <UINT32> ]

Mode

Top Level

Description

Restart SonicOS - now or after an interval of time.

Options

 
atRestart at the time specified.
<TIME_YYYYMMDDHHMMSS> Timestamp in the form: YYYY:MM:DD:HH:MM:SS.
Example: 2010:06:30:23:30:59
 
inRestart after the specified interval.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123
 
daysSet in days.
 
hoursSet in hours.
 
minutesSet in minutes.
 
nowRestart immediately.
 
timeRestart after the specified number of seconds.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

restart

Syntax

safemode

Mode

Top Level

Description

Restart the device and enter safemode.

Example

safemode

Syntax

restore-defaults

Mode

Config

Description

Restore the device to factory default settings.

Example

restore-defaults

Syntax

boot { { { current | uploaded } [ backup | factory-default ] } | system-backup }

Mode

Config

Description

Boot current or uploaded firmware image with current or default settings or boot system backup.

Options

 
 
currentBoot current firmware image.
 
uploadedBoot the latest uploaded firmware image.
 
backupBoot firmware with backup settings.
 
factory-defaultBoot current firmware with default settings.
 
system-backupBoot system backup firmware.

Example

boot current factory-default

Syntax

time

Mode

Config

Description

Enter time configuration mode.

Example

time

Syntax

time <TIME_HHMMSS>

Mode

Time

Description

Specify time.

Options

<TIME_HHMMSS> Time in the form: DD:DD:DD.
Example: 12:00:00

Example

time 12:30:59

Syntax

date <DATE_YYYYMMDD>

Mode

Time

Description

Specify date.

Options

<DATE_YYYYMMDD> Date in the form: YYYY:MM:DD.
Example: 2010:06:30

Example

date 2010:06:31

Syntax

time-zone <TIME_ZONE>

Mode

Time

Description

Specify time zone.

Options

<TIME_ZONE> Time Zone.
Example: pacific-time

Example

time-zone pacific-time

time-zone atlantic-time
time-zone russia-gmt+7
time-zone china,philippines

Syntax

use-ntp

Mode

Time

Description

Enable use of NTP servers to obtain time.

Example

use-ntp

Syntax

no use-ntp

Mode

Time

Description

Disable use of NTP servers to obtain time.

Example

no use-ntp

Syntax

daylight-savings

Mode

Time

Description

Enable automatic adjustment of clock for daylight saving time.

Example

daylight-savings

Syntax

no daylight-savings

Mode

Time

Description

Disable automatic adjustment of clock for daylight saving time.

Example

no daylight-savings

Syntax

universal

Mode

Time

Description

Enable display of UTC in logs (instead of local time).

Example

universal

Syntax

no universal

Mode

Time

Description

Disable display of UTC in logs (instead of local time).

Example

no universal

Syntax

international-format

Mode

Time

Description

Enable display of date in international format.

Example

international-format

Syntax

no international-format

Mode

Time

Description

Disable display of date in international format.

Example

no international-format

Syntax

only-custom-ntp

Mode

Time

Description

Enable only use custom NTP servers.

Example

only-custom-ntp

Syntax

no only-custom-ntp

Mode

Time

Description

Disable only use custom NTP servers.

Example

no only-custom-ntp

Syntax

ntp-server <NTP_SERVER> [ md5 trust-key-no <UINT16> key-number <UINT16> password <WORD> | no-auth ]

Mode

Time

Description

Add a server to the NTP server list.

Options

<NTP_SERVER> Hostname in the form: hostname OR a.b.c.d.
Example: example.com
 
md5NTP server uses MD5 authentication.
trust-key-noTrust key.
<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123
key-numberKey number.
<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123
passwordPassword.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
no-authNTP server doesn't require authentication.

Example

ntp-server 192.168.168.160 no-auth

Syntax

no ntp-server <NTP_SERVER>

Mode

Time

Description

Remove a server from the NTP server list.

Options

<NTP_SERVER> Hostname in the form: hostname OR a.b.c.d.
Example: example.com

Example

no ntp-server 192.168.168.160

Syntax

no ntp-servers

Mode

Time

Description

Remove all servers from the NTP server list.

Example

no ntp-servers

Syntax

ntp-update-interval <UINT16>

Mode

Time

Description

Set the NTP Update Interval.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

ntp-update-interval 123

Syntax

license

Mode

Config

Description

License configuration.

Example

license

Syntax

synchronize

Mode

License

Description

Synchronize licenses with www.mysonicwall.com.

Example

synchronize

Syntax

upgrade { [ key <WORD> ] [ key-set <WORD> ] }

Mode

License

Description

Manual upgrade services.

Options

keyUpgrade by key.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
key-setUpgrade by key set.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

upgrade key CARZFDMR

Syntax

ssh client

Mode

Config

Syntax

server-key <WORD>

Mode

SSH Client

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Syntax

no server-key <WORD>

Mode

SSH Client

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Syntax

no server-keys

Mode

SSH Client

Syntax

fips

Mode

Config

Description

Enable FIPS mode.

Example

fips

Syntax

no fips

Mode

Config

Description

Disable FIPS mode.

Example

no fips

Syntax

ndpp

Mode

Config

Description

Enable NDPP mode.

Example

ndpp

Syntax

no ndpp

Mode

Config

Description

Disable NDPP mode.

Example

no ndpp

Syntax

show administration [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show Administration Configuration and Information.

Options

 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show administration

Syntax

show snmp [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show SNMP Configuration and Information.

Options

 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show snmp

Syntax

show firmware [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show Firmware configuration.

Options

 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show firmware

Syntax

show status

Mode

All Modes

Description

Show basic system status and information.

Example

show status

Syntax

show time [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show Time settings or NTP settings.

Options

 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show time

Syntax

show version

Mode

All Modes

Syntax

show license [ { pending-config | with-pending-config } | status ]

Mode

All Modes

Options

 
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
statusShow license status.

Syntax

show ssh client [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show SSH client configuration.

Options

 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show ssh client

Syntax

show fips [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show FIPS configuration.

Options

 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show fips

Syntax

show ndpp [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show NDPP configuration.

Options

 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show ndpp

Syntax

user authentication

Mode

Config

Description

Configure user authentication related settings.

Example

user authentication

Syntax

method { ldap | ldap+local | local | radius | radius+local }

Mode

User Authentication

Description

Set the user authentication method.

Options

 
ldapUse LDAP user authentication.
 
ldap+localUse both LDAP and local user authentication.
 
localUse local user authentication.
 
radiusUse RADIUS user authentication.
 
radius+localUse both RADIUS and local user authentication.

Example

method local

Syntax

case-sensitive-names

Mode

User Authentication

Description

Enable treating user names as case-sensitive.

Example

case-sensitive-names

Syntax

no case-sensitive-names

Mode

User Authentication

Description

Disable treating user names as case-sensitive.

Example

no case-sensitive-names

Syntax

login-uniqueness

Mode

User Authentication

Description

Enable enforcing a single login per user name.

Example

login-uniqueness

Syntax

no login-uniqueness

Mode

User Authentication

Description

Disable enforcing a single login per user name.

Example

no login-uniqueness

Syntax

relogin-after-password-change

Mode

User Authentication

Description

Enable enforcing relogin after password change.

Example

relogin-after-password-change

Syntax

no relogin-after-password-change

Mode

User Authentication

Description

Disable enforcing relogin after password change.

Example

no relogin-after-password-change

Syntax

one-time-password format { characters | mixed | numbers }

Mode

User Authentication

Description

Set one-time password format.

Options

 
charactersCharacters format.
 
mixedMixed format.
 
numbersNumbers format.

Example

one-time-password format characters

Syntax

one-time-password length { [ min <UINT8> ] [ max <UINT8> ] }

Mode

User Authentication

Description

Set one-time password length.

Options

minMinimum length.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
maxMaximum length.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

one-time-password length min 8 max 12

Syntax

one-time-password email-format { html | plain-text }

Mode

User Authentication

Description

Set one-time password e-mail format.

Options

 
htmlHtml format.
 
plain-textPlain-text format.

Example

one-time-password email-format html

Syntax

auth-page-timeout <UINT16>

Mode

User Authentication

Description

Set the timeout for showing the web login page.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

auth-page-timeout 2

Syntax

no auth-page-timeout

Mode

User Authentication

Description

Clear the timeout for showing the web login page.

Example

no auth-page-timeout

Syntax

browser-redirect-via { host-name | interface-ip | name-from-certificate | reverse-dns }

Mode

User Authentication

Description

Set the method for redirect the browser to this appliance.

Options

 
host-nameRedirect the browser via domain name configured for firewall.
 
interface-ipRedirect the browser via the interface ip address.
 
name-from-certificateRedirect the browser via name from the administration certificate.
 
reverse-dnsRedirect the browser via domain name from a reverse DNS lookup of the interface IP address.

Example

browser-redirect-via interface-ip

Syntax

http-redirect-after-login

Mode

User Authentication

Description

Enable redirect from HTTPS to HTTP after login.

Example

http-redirect-after-login

Syntax

no http-redirect-after-login

Mode

User Authentication

Description

Disable redirect from HTTPS to HTTP after login.

Example

no http-redirect-after-login

Syntax

radius-chap-http-login

Mode

User Authentication

Description

Enable allowing HTTP login with RADIUS CHAP mode when that is available rather than redirecting to HTTPS for web login.

Example

radius-chap-http-login

Syntax

no radius-chap-http-login

Mode

User Authentication

Description

Disable allowing HTTP login with RADIUS CHAP mode when that is available rather than redirecting to HTTPS for web login.

Example

no radius-chap-http-login

Syntax

inactivity-timeout <UINT32>

Mode

User Authentication

Description

Set the user inactivity timeout.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

inactivity-timeout 60

Syntax

inactive-user { login | timeout }

Mode

User Authentication

Description

Enable make user into an inactive state.

Options

 
loginEnable make the user initially inactive until they send traffic on being notified of a login.
 
timeoutEnable make all users inactive instead of logging out on inactivity timeout.

Example

inactive-user login

Syntax

no inactive-user { login | timeout }

Mode

User Authentication

Description

Disable make user into an inactive state.

Options

 
loginDisable make the user initially inactive until they send traffic on being notified of a login.
 
timeoutDisable make all users inactive instead of logging out on inactivity timeout.

Example

no inactive-user login

Syntax

age-out <UINT16>

Mode

User Authentication

Description

Set age out inactive users time (minutes).

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

age-out 60

Syntax

web-login-session-limit <UINT16>

Mode

User Authentication

Description

Set the maximum login session time for web users.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

web-login-session-limit 60

Syntax

no web-login-session-limit

Mode

User Authentication

Description

Set unlimited login session time for web users.

Example

no web-login-session-limit

Syntax

show-user-status-window

Mode

User Authentication

Description

Enable showing the login status window after web login.

Example

show-user-status-window

Syntax

no show-user-status-window

Mode

User Authentication

Description

Disable showing the login status window after web login.

Example

no show-user-status-window

Syntax

status-window-heartbeat { period <TEN_SEC_GRANULARITY_PERIOD> | timeout <UINT16> }

Mode

User Authentication

Description

Configure heartbeats sent from the user login status window.

Options

 
periodPeriod in seconds.
<TEN_SEC_GRANULARITY_PERIOD> A number of seconds that must be a multiple of 10.
Example: 20
 
timeoutTime in minutes.
<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

status-window-heartbeat period 60

Syntax

disconnected-user-detect

Mode

User Authentication

Description

Enable using the login status window heartbeat mechanism for detecting disconnected web users.

Example

disconnected-user-detect

Syntax

no disconnected-user-detect

Mode

User Authentication

Description

Disable using the login status window heartbeat mechanism for detecting disconnected web users.

Example

no disconnected-user-detect

Syntax

rule-auth-bypass-http-url <WORD>

Mode

User Authentication

Description

Add a destination URL to be allowed to bypass user authentication in access rules.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

rule-auth-bypass-http-url *.windowsupdate.com...

Syntax

no rule-auth-bypass-http-url <WORD>

Mode

User Authentication

Description

Delete a destination URL to be allowed to bypass user authentication in access rules.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

no rule-auth-bypass-http-url *.windowsupdate.com...

Syntax

acceptable-use-policy

Mode

User Authentication

Description

Set the acceptable use policy (AUP) displayed to users during login.

Example

acceptable-use-policy

Syntax

window-size <UINT32> <UINT32>

Mode

Acceptable Use Policy

Description

Set the acceptable use policy (AUP) window width and height.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

window-size 460 310

Syntax

scroll-bars

Mode

Acceptable Use Policy

Description

Enable scroll bars on the acceptable use policy (AUP) window.

Example

scroll-bars

Syntax

no scroll-bars

Mode

Acceptable Use Policy

Description

Disable scroll bars on the acceptable use policy (AUP) window.

Example

no scroll-bars

Syntax

content <ROL>

Mode

Acceptable Use Policy

Description

Set the content for the acceptable use policy (AUP).

Options

<ROL> Remaining command line input.
Example: line...

Example

content "example template"

Syntax

no content

Mode

Acceptable Use Policy

Description

Clear the content for the acceptable use policy (AUP).

Example

no content

Syntax

aup-on-zones { public | trusted | vpn | wan | wireless }

Mode

Acceptable Use Policy

Description

Enable the acceptable use policy (AUP) on login from zones of a given type.

Options

 
publicOn login from public zones.
 
trustedOn login from trusted zones.
 
vpnOn login from the VPN zone.
 
wanOn login from the WAN zone.
 
wirelessOn login from wireless zones.

Example

aup-on-zones trusted

Syntax

no aup-on-zones { public | trusted | vpn | wan | wireless }

Mode

Acceptable Use Policy

Description

Disable the acceptable use policy (AUP) on login from from zones of a given type.

Options

 
publicOn login from public zones.
 
trustedOn login from trusted zones.
 
vpnOn login from the VPN zone.
 
wanOn login from the WAN zone.
 
wirelessOn login from wireless zones.

Example

no aup-on-zones trusted

Syntax

customize-login-page { access-barred | access-down | access-unavailable | authentication | disallowed | full | guest-status | lockout | logged-out | message | password-update | preempt | redirect | sso-failure | status } <ROL>

Mode

User Authentication

Description

Customize login pages.

Options

 
access-barredCustomize policy access barred page.
 
access-downCustomize policy access down page.
 
access-unavailableCustomize policy access unavailable page.
 
authenticationCustomize login authentication page.
 
disallowedCustomize login disallowed page.
 
fullCustomize login full page.
 
guest-statusCustomize guest login status page.
 
lockoutCustomize login lockout page.
 
logged-outCustomize logged out page.
 
messageCustomize user login message page.
 
password-updateCustomize user password update page.
 
preemptCustomize admin preempt page.
 
redirectCustomize policy login redirect page.
 
sso-failureCustomize policy SSO probe failure page.
 
statusCustomize login status page.
<ROL> Remaining command line input.
Example: line...

Example

customize-login-page preempt "Preempt page"

Syntax

no customize-login-page { access-barred | access-down | access-unavailable | authentication | disallowed | full | guest-status | lockout | logged-out | message | password-update | preempt | redirect | sso-failure | status }

Mode

User Authentication

Description

Clear specified customized login page.

Options

 
access-barredCustomize policy access barred page.
 
access-downCustomize policy access down page.
 
access-unavailableCustomize policy access unavailable page.
 
authenticationCustomize login authentication page.
 
disallowedCustomize login disallowed page.
 
fullCustomize login full page.
 
guest-statusCustomize guest login status page.
 
lockoutCustomize login lockout page.
 
logged-outCustomize logged out page.
 
messageCustomize user login message page.
 
password-updateCustomize user password update page.
 
preemptCustomize admin preempt page.
 
redirectCustomize policy login redirect page.
 
sso-failureCustomize policy SSO probe failure page.
 
statusCustomize login status page.

Example

no customize-login-page preempt

Syntax

user local

Mode

Config

Description

Configure settings related to local users.

Example

user local

Syntax

apply-password-constraints

Mode

Local Users

Description

Enable apply password constraints (configured in administration_mode) to all local users (including administrative users, but not the built-in admin account). Note that this command is an alternative to the administration_mode command: constraints-apply-to full-admins limited-admins local-users.

Example

apply-password-constraints

Syntax

no apply-password-constraints

Mode

Local Users

Description

Disable apply password constraints (configured in administration_mode) for local users.

Example

no apply-password-constraints

Syntax

prune-on-expiry

Mode

Local Users

Description

Enable prune expired local user accounts if a limited lifetime is set.

Example

prune-on-expiry

Syntax

no prune-on-expiry

Mode

Local Users

Description

Disable prune expired local user accounts.

Example

no prune-on-expiry

Syntax

user <LOCAL_USER_NAME> [ password <ENC_PASSWORD> ] [ member-of <LOCAL_USER_GROUP_NAME> ]

Mode

Local Users

Description

Add or update a local user account.

Options

<LOCAL_USER_NAME> User object name.
Example: user1
passwordSet the user password.
<ENC_PASSWORD> Password.
Example: secret
member-ofAdd membership to a user group for this user.
<LOCAL_USER_GROUP_NAME> User group object name.
Example: Limited Administrators

Example

user johndoe

Syntax

no user <LOCAL_USER_NAME>

Mode

Local Users

Description

Delete a local user account.

Options

<LOCAL_USER_NAME> User object name.
Example: user1

Example

no user johndoe

Syntax

no users

Mode

Local Users

Description

Delete all local user accounts.

Example

no users

Syntax

group <LOCAL_USER_GROUP_NAME>

Mode

Local Users

Description

Add or update a local user group.

Options

<LOCAL_USER_GROUP_NAME> User group object name.
Example: Limited Administrators

Example

group "Special Users"

Syntax

no group <LOCAL_USER_GROUP_NAME>

Mode

Local Users

Description

Delete a local user group.

Options

<LOCAL_USER_GROUP_NAME> User group object name.
Example: Limited Administrators

Example

no group "Special Users"

Syntax

no groups

Mode

Local Users

Description

Delete all local user groups.

Example

no groups

Syntax

name <LOCAL_USER_NAME>

Mode

Local User

Description

Set the login name of the user account.

Options

<LOCAL_USER_NAME> User object name.
Example: user1

Example

name johndoe

Syntax

comment <WORD>

Mode

Local User

Description

Set a comment for the user account.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

comment "Added 7/26/2010"

Syntax

no comment

Mode

Local User

Description

Clear the comment for the user account.

Example

no comment

Syntax

password <ENC_PASSWORD>

Mode

Local User

Description

Set the user password.

Options

<ENC_PASSWORD> Password.
Example: secret

Example

password pwd1234

Syntax

no password

Mode

Local User

Description

Clear user password.

Syntax

force-password-change

Mode

Local User

Description

Force the user to change the password at the next login.

Example

force-password-change

Syntax

no force-password-change

Mode

Local User

Description

Disable make the user change the password at next login.

Example

no force-password-change

Syntax

expiration <DATE_YYYYMMDD> <TIME_HHMM>

Mode

Local User

Description

Set user's expiration time (absolute time).

Options

<DATE_YYYYMMDD> Date in the form: YYYY:MM:DD.
Example: 2010:06:30
<TIME_HHMM> Time in the form: DD:DD.
Example: 12:00

Example

expiration 2013:12:31 23:59

Syntax

account-lifetime <UINT16> { days | expired | hours | minutes }

Mode

Local User

Description

Set a limited lifetime for the user account.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123
 
daysSet the lifetime in days.
 
expiredExpired user.
 
hoursSet the lifetime in hours.
 
minutesSet the lifetime in minutes.

Example

account-lifetime 48 hours

Syntax

no account-lifetime

Mode

Local User

Description

Disable the user account to expire.

Example

no account-lifetime

Syntax

prune-on-expiry

Mode

Local User

Description

Delete the user account when it expires if a limited lifetime is set.

Example

prune-on-expiry

Syntax

no prune-on-expiry

Mode

Local User

Description

Disable prune account on expiration.

Example

no prune-on-expiry

Syntax

one-time-password

Mode

Local User

Description

Enable one-time password required for the user.

Example

one-time-password

Syntax

no one-time-password

Mode

Local User

Description

Disable one-time password required for the user.

Example

no one-time-password

Syntax

email-address <EMAIL>

Mode

Local User

Description

Set the user's e-mail address.

Options

<EMAIL> E-mail in the form: aaaaa@bbb.com.
Example: support@sonicwall.com

Example

email-address me@myplace.org

Syntax

no email-address

Mode

Local User

Description

Clear the user's e-mail address.

Example

no email-address

Syntax

vpn-client-access { group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> }

Mode

Local User

Description

Add a local network to which the user will be given access when connecting via VPN client.

Options

 
groupSelect an existing address group by name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostGive VPN client access to an IP address.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameSelect an existing address object by name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkGive VPN client access to a network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeGive VPN client access to an IP address range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

vpn-client-access name "LAN Subnets"

Syntax

no vpn-client-access { group <ADDR_GROUP_NAME> | name <ADDR_NAME> }

Mode

Local User

Description

Remove a local network from those to which the user gets access when connecting via VPN client.

Options

 
groupGroup address object name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server

Example

no vpn-client-access name "LAN Subnets"

Syntax

guest-login-uniqueness

Mode

Local User

Description

Enable enforcing a unique guest services login session.

Example

guest-login-uniqueness

Syntax

no guest-login-uniqueness

Mode

Local User

Description

Disable enforcing a unique guest services login session.

Example

no guest-login-uniqueness

Syntax

guest-idle-timeout <UINT32> { days | hours | minutes }

Mode

Local User

Description

Set the idle timeout for guest services.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123
 
daysSet the idle timeout in days.
 
hoursSet the idle timeout in hours.
 
minutesSet the idle timeout in minutes.

Example

guest-idle-timeout 20 minutes

Syntax

no guest-idle-timeout

Mode

Local User

Description

Clear the idle timeout for guest services.

Example

no guest-idle-timeout

Syntax

member-of <LOCAL_USER_GROUP_NAME>

Mode

Local User

Description

Add membership to a user group for this user.

Options

<LOCAL_USER_GROUP_NAME> User group object name.
Example: Limited Administrators

Example

member-of "SonicWALL Administrators"

Syntax

no member-of <LOCAL_USER_GROUP_NAME>

Mode

Local User

Description

Remove a user group membership for this user.

Options

<LOCAL_USER_GROUP_NAME> User group object name.
Example: Limited Administrators

Example

no member-of "SonicWALL Administrators"

Syntax

name <LOCAL_USER_GROUP_NAME>

Mode

Local Group

Description

Set the name of the user group.

Options

<LOCAL_USER_GROUP_NAME> User group object name.
Example: Limited Administrators

Example

name "Special Users"

Syntax

comment <WORD>

Mode

Local Group

Description

Set a comment for the user group.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

comment "Added 7/26/2010"

Syntax

no comment

Mode

Local Group

Description

Remove the comment for the user group.

Example

no comment

Syntax

ldap-location <WORD>

Mode

Local Group

Description

If memberships set by user's location in the LDAP directory is checked, this gives the location in the LDAP directory tree for that.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

ldap-location domain.com/users

Syntax

no ldap-location

Mode

Local Group

Description

Clear location in LDAP directory tree for the memberships that are set by user's location in the LDAP directory.

Example

no ldap-location

Syntax

memberships-by-ldap-location { at | under-or-at }

Mode

Local Group

Description

Enable memberships are set by user's location in the LDAP directory. For users, they can set the location at or under the given location which you can set by ldap-location command.

Options

 
atSet the location at the given LDAP location for users.
 
under-or-atSet the location under or at the given LDAP location for users.

Example

memberships-by-ldap-location at

memberships-by-ldap-location under-or-at

Syntax

no memberships-by-ldap-location

Mode

Local Group

Description

Disable memberships are set by user's location in the LDAP directory.

Example

no memberships-by-ldap-location

Syntax

refresh-from-ldap-server

Mode

Local Users

Description

Refresh from LDAP server.

Example

refresh-from-ldap-server

Syntax

one-time-password

Mode

Local Group

Description

Enable one-time password for members of the group.

Example

one-time-password

Syntax

no one-time-password

Mode

Local Group

Description

One-time password will not be required for members of the group.

Example

no one-time-password

Syntax

to-management-on-login

Mode

Local Group

Description

Members of the group with administrative privilege will go straight to the management UI on web login (only applies for user groups that give administrative privilege).

Example

to-management-on-login

Syntax

no to-management-on-login

Mode

Local Group

Description

Disable members of the group go straight to the management UI on web login (only applies for user groups that give administrative privilege).

Example

no to-management-on-login

Syntax

vpn-client-access { group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_NAME> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> }

Mode

Local Group

Description

Add a local network to which members of the group will be given access when connecting via VPN client.

Options

 
groupSelect an existing address group by name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostGive VPN client access to an IP address.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameSelect an existing address object by name.
<ADDR_NAME> Address object name.
Example: Web Server
 
networkGive VPN client access to a network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeGive VPN client access to an IP address range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

vpn-client-access name "LAN Subnets"

Syntax

no vpn-client-access { group <ADDR_GROUP_NAME> | name <ADDR_NAME> }

Mode

Local Group

Description

Remove a local network from those to which members of the group get access when connecting via VPN client.

Options

 
groupGroup address object name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
nameAddress object name.
<ADDR_NAME> Address object name.
Example: Web Server

Example

no vpn-client-access name "LAN Subnets"

Syntax

no content-filtering-policy

Mode

Local Group

Description

Disable the content filtering services (CFS) policy applied to members of the group.

Example

no content-filtering-policy

Syntax

content-filtering-policy <CFS_POLICY_NAME>

Mode

Local Group

Description

Set a content filtering services (CFS) policy to apply for members of the group.

Options

<CFS_POLICY_NAME> CFS policy name.

Example

content-filtering-policy Default

Syntax

member <LOCAL_USER_OR_GROUP_NAME>

Mode

Local Group

Description

Add membership to this group for the named user or user group.

Options

<LOCAL_USER_OR_GROUP_NAME> User or user group object name.
Example: Limited Administrators

Example

member "All LDAP Users"

Syntax

no member <LOCAL_USER_OR_GROUP_NAME>

Mode

Local Group

Description

Remove a member from the group.

Options

<LOCAL_USER_OR_GROUP_NAME> User or user group object name.
Example: Limited Administrators

Example

no member "All LDAP Users"

Syntax

kill-user name <USER_LOGIN_NAME>

Mode

Top Level

Description

Log out users.

Options

<USER_LOGIN_NAME> A connected user's login name.
Example: jdoe

Example

kill-user name guest1

Syntax

kill-user at <USER_IPV4_ADDR> [ user <UINT32> ]

Mode

Top Level

Description

Log out users.

Options

<USER_IPV4_ADDR> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
userFor Terminal Services users only, selects the user at the IP address.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

kill-user at 192.168.168.1

Syntax

unlock <USER_IPV4_ADDR>

Mode

Top Level

Description

Unlock an IP address that has been locked out due to too many failed login attempts.

Options

<USER_IPV4_ADDR> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

unlock 192.168.168.1

Syntax

user management

Mode

Config

Description

User management.

Example

user management

Syntax

include { inactive-users | unauthenticated-users }

Mode

User Management

Description

Enable show inactive or unauthenticated users' status.

Options

 
inactive-usersEnable show inactive users' status.
 
unauthenticated-usersEnable show unauthenticated users' status.

Example

include inactive-users

include unauthenticated-users

Syntax

no include { inactive-users | unauthenticated-users }

Mode

User Management

Description

Disable show inactive or unauthenticated users' status.

Options

 
inactive-usersDisable show inactive users' status.
 
unauthenticated-usersDisable show unauthenticated users' status.

Example

no include inactive-users

no include unauthenticated-users

Syntax

user radius

Mode

Config

Description

Configure RADIUS settings.

Example

user radius

Syntax

local-users-only

Mode

RADIUS

Description

Limit login to only RADIUS users with accounts in the local user database.

Example

local-users-only

Syntax

no local-users-only

Mode

RADIUS

Description

Don't limit login to only RADIUS users with accounts in the local user database.

Example

no local-users-only

Syntax

default-user-group <LOCAL_USER_GROUP_NAME>

Mode

RADIUS

Description

Select a user group to whom all users who are authenticated via RADIUS will be given membership by default (i.e. a group that can be used to set accesses etc. that will apply to all RADIUS users).

Options

<LOCAL_USER_GROUP_NAME> User group object name.
Example: Limited Administrators

Example

default-user-group "Radius Users"

Syntax

no default-user-group

Mode

RADIUS

Description

RADIUS will not be given membership to any user group by default.

Example

no default-user-group

Syntax

timeout <UINT32>

Mode

RADIUS

Description

Set the timeout for the RADIUS servers.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

timeout 10

Syntax

retries <UINT32>

Mode

RADIUS

Description

Set the number of retries for the RADIUS servers.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

retries 10

Syntax

user-group-mechanism { ldap | local-only | radius-attribute { filter-id | vendor-specific } }

Mode

RADIUS

Description

Set the mechanism to use to set user group memberships for users who are authenticated via RADIUS.

Options

 
ldapRead user groups via LDAP.
 
local-onlySet using local users that duplicate RADIUS users.
 
radius-attributeRead user groups via a RADIUS attribute.
 
filter-idUse the standard RADIUS filter-id attribute.
 
vendor-specificUse the SonicWALL vendor-specific RADIUS attribute.

Example

user-group-mechanism radius-attribute filter-id

Syntax

local-user-groups-apply

Mode

RADIUS

Description

User group memberships that are set locally for user accounts in the local user database should apply for users authenticated via RADIUS when the user names match.

Example

local-user-groups-apply

Syntax

no local-user-groups-apply

Mode

RADIUS

Description

User group memberships that are set locally for user accounts in the local user database should not apply for users authenticated via RADIUS when the user names match.

Example

no local-user-groups-apply

Syntax

server { primary | secondary }

Mode

RADIUS

Description

Configure a RADIUS server.

Options

 
primaryConfigure the primary RADIUS server.
 
secondaryConfigure the secondary RADIUS server.

Example

server primary

Syntax

no server { primary | secondary }

Mode

RADIUS

Description

Delete a RADIUS server.

Options

 
primaryDelete the primary RADIUS server.
 
secondaryDelete the secondary RADIUS server.

Example

no server primary

Syntax

host <RADIUS_SERVER_HOST_NAME>

Mode

RADIUS Server

Description

Set the RADIUS server's host name or IP address.

Options

<RADIUS_SERVER_HOST_NAME> Hostname in the form: hostname OR a.b.c.d.
Example: RADIUS-Server

Example

host 192.168.168.1

Syntax

no host

Mode

RADIUS Server

Description

Clear the RADIUS server's host name or IP address.

Example

no host

Syntax

port <IPV4_PORT>

Mode

RADIUS Server

Description

Set the RADIUS server's UDP port number.

Options

<IPV4_PORT> Integer in the form: D OR 0xHHHH.
Example: 80

Example

port 1812

Syntax

secret <ENC_PASSWORD>

Mode

RADIUS Server

Description

Set the RADIUS server's shared secret.

Options

<ENC_PASSWORD> Password.
Example: secret

Example

secret mysecret

Syntax

send-through-vpn-tunnel

Mode

RADIUS Server

Description

Enable enforce send packet through vpn tunnel.

Example

send-through-vpn-tunnel

Syntax

no send-through-vpn-tunnel

Mode

RADIUS Server

Description

Disable enforce send packet through vpn tunnel.

Example

no send-through-vpn-tunnel

Syntax

test <WORD> <WORD> [ { chap | mschap | mschapv2 } ]

Mode

RADIUS

RADIUS Server

Description

Run the RADIUS test with the given user name/password.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
chapRun the test with RADIUS in CHAP mode.
 
mschapRun the test with RADIUS in MSCHAP mode.
 
mschapv2Run the test with RADIUS in MSCHAPv2 mode.

Example

test user1 pwd1234

Syntax

user ldap

Mode

Config

Description

Configure LDAP settings.

Example

user ldap

Syntax

local-users-only

Mode

LDAP

Description

Limit login to only LDAP users with accounts in the local user database.

Example

local-users-only

Syntax

no local-users-only

Mode

LDAP

Description

Don't limit login to only LDAP users with accounts in the local user database.

Example

no local-users-only

Syntax

local-user-groups-apply

Mode

LDAP

Description

User group memberships that are set locally for user accounts in the local user database should apply for users authenticated via LDAP when the user names match.

Example

local-user-groups-apply

Syntax

no local-user-groups-apply

Mode

LDAP

Description

User group memberships that are set locally for user accounts in the local user database should not apply for users authenticated via LDAP when the user names match.

Example

no local-user-groups-apply

Syntax

default-user-group <LOCAL_USER_GROUP_NAME>

Mode

LDAP

Description

Select a user group to whom all users who are authenticated via LDAP will be given membership by default (i.e. a group that can be used to set accesses etc. that will apply to all LDAP users).

Options

<LOCAL_USER_GROUP_NAME> User group object name.
Example: Limited Administrators

Example

default-user-group "LDAP Users"

Syntax

no default-user-group

Mode

LDAP

Description

LDAP will not be given membership to any user group by default.

Example

no default-user-group

Syntax

mirror-user-groups [ all | have-members | refresh { now | period <UINT32> } ]

Mode

LDAP

Description

Enable/config mirror LDAP user groups locally.

Options

 
allMirror all user groups on the LDAP server.
 
have-membersOnly mirror groups that have member users or groups.
 
refreshRefresh mirrored LDAP user groups.
 
nowRefresh now.
 
periodSet refresh period.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

mirror-user-groups

Syntax

no mirror-user-groups

Mode

LDAP

Description

Disable mirror LDAP user groups locally.

Example

no mirror-user-groups

Syntax

exclude-tree <WORD>

Mode

LDAP

Description

Enable exclude user groups in the specified sub-tree from the mirroring.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

exclude-tree mydomain.com/groups

Syntax

no exclude-tree <WORD>

Mode

LDAP

Description

Disable exclude user groups in the specified sub-tree from the mirroring.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

no exclude-tree mydomain.com/groups

Syntax

timeout { operation <UINT32> | server <UINT32> }

Mode

LDAP

Description

Set the timeout for LDAP server.<br> The server timeout is the maximum time to wait for each response from the LDAP server over the network. The overall operation timeout is the maximum time to spend on an LDAP operation (including auto-configuration operations that can involve large numbers of requests sent to multiple LDAP servers).

Options

 
operationSet the overall timeout on an LDAP operation.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123
 
serverSet the server timeout which is the maximum time to wait for each response from the LDAP server over the network.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

operation-timeout 10

Syntax

use-tls

Mode

LDAP

Description

Enable use transport layer security (TLS) when log in to the LDAP server.

Example

use-tls

Syntax

no use-tls

Mode

LDAP

Description

Disable use transport layer security (TLS) when log in to the LDAP server.

Example

no use-tls

Syntax

send-start-tls-request

Mode

LDAP

Description

Enable send LDAP 'Start TLS' request. This is an LDAP feature that allows an LDAP server to operate in both TLS and non-TLS modes on the same TCP port. You only need check this if your LDAP server uses the same port number for both TLS and non-TLS.

Example

send-start-tls-request

Syntax

no send-start-tls-request

Mode

LDAP

Description

Disable send LDAP 'Start TLS' request.

Example

no send-start-tls-request

Syntax

require-valid-certificate

Mode

LDAP

Description

Enable validate the certificate presented by the server during the TLS exchange.

Example

require-valid-certificate

Syntax

no require-valid-certificate

Mode

LDAP

Description

Disable validate the certificate presented by the server during the TLS exchange.

Example

no require-valid-certificate

Syntax

local-tls-certificate <CERT_NAME>

Mode

LDAP

Description

Select a local certificate to use with LDAP if using TLS. This is not normally required but may be if the LDAP server is configured to require a valid certificate from the client (e.g. on a server that allows reading back passwords from user objects when bound as an administrator).

Options

<CERT_NAME> Certificate name.
Example: my_cert

Example

local-tls-certificate my_ldap_server

Syntax

no local-tls-certificate

Mode

LDAP

Description

Select no local certificate to use with LDAP if using TLS.

Example

no local-tls-certificate

Syntax

allow-referrals

Mode

LDAP

Description

Allow following referrals to other LDAP servers.

Example

allow-referrals

Syntax

no allow-referrals

Mode

LDAP

Description

Ignore referrals to other LDAP servers.

Example

no allow-referrals

Syntax

allow-references { auto-configuration | domain-search | other-search | user-authentication }

Mode

LDAP

Description

Allow following continuation references to look for more results on other LDAP servers.

Options

 
auto-configurationDon't follow references during auto-configuration.
 
domain-searchDon't follow references when searching for domains.
 
other-searchDon't follow references in other searches.
 
user-authenticationDon't follow references during user authentication.

Example

allow-references auto-configuration

Syntax

no allow-references { auto-configuration | domain-search | other-search | user-authentication }

Mode

LDAP

Description

Don't follow continuation references to look for more results on other LDAP servers when doing particular operations.

Options

 
auto-configurationDon't follow references during auto-configuration.
 
domain-searchDon't follow references when searching for domains.
 
other-searchDon't follow references in other searches.
 
user-authenticationDon't follow references during user authentication.

Example

no allow-references auto-configuration

Syntax

schema { custom | inet-org-person | microsoft-active-directory | network-information-service | novell-edirectory | samba-smb }

Mode

LDAP

Description

Configure the LDAP schema.

Options

 
customConfigure the schema manually.
 
inet-org-personUse the pre-configured RFC-2798 InetOrgPerson schema.
 
microsoft-active-directoryUse the pre-configured Microsoft Active Directory schema.
 
network-information-serviceUse the pre-configured RFC-2307 Network Information Service schema.
 
novell-edirectoryUse the pre-configured Novell eDirectory schema.
 
samba-smbUse the pre-configured Samba SMB schema.

Example

schema samba-smb

Syntax

directory

Mode

LDAP

Description

Configure the LDAP directory.

Example

directory

Syntax

relay

Mode

LDAP

Description

Configure the RADIUS to LDAP relay.

Example

relay

Syntax

server <LDAP_SERVER_HOST_NAME>

Mode

LDAP

Description

Configure an LDAP server.

Options

<LDAP_SERVER_HOST_NAME> Hostname in the form: hostname OR a.b.c.d.
Example: LDAP-Server

Example

server 192.168.168.1

Syntax

no server <LDAP_SERVER_HOST_NAME>

Mode

LDAP

Description

Delete an LDAP server.

Options

<LDAP_SERVER_HOST_NAME> Hostname in the form: hostname OR a.b.c.d.
Example: LDAP-Server

Example

no server 192.168.168.1

Syntax

read-from-server auto-configure

Mode

LDAP Schema

Description

Read the schema from the LDAP server and auto-configure the local schema to match.

Example

read-from-server auto-configure

Syntax

read-from-server display

Mode

LDAP Schema

Description

Read the schema from the LDAP server and display it.

Example

read-from-server display

Syntax

user-class <WORD>

Mode

LDAP Schema

Description

Set the class name of user objects.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

user-class user

Syntax

user-attribute { additional-group-id <WORD> | framed-ip-address <WORD> | group-membership <WORD> | logon-name <WORD> | qualified-logon-name <WORD> | use-additional-group-id }

Mode

LDAP Schema

Description

Define attributes of user objects.

Options

 
additional-group-idSet the additional user group ID attribute.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
framed-ip-addressSet the framed IP address attribute.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
group-membershipSet the user group membership attribute.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
logon-nameSet the user logon name attribute.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
qualified-logon-nameSet the qualified logon name attribute.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
use-additional-group-idUse the additional user group ID attribute.

Example

user-attribute logon-name uid

Syntax

no user-attribute { additional-group-id | framed-ip-address | group-membership | logon-name | qualified-logon-name | use-additional-group-id }

Mode

LDAP Schema

Description

Remove attributes of user objects.

Options

 
additional-group-idRemove the additional user group ID attribute.
 
framed-ip-addressRemove the framed IP address attribute.
 
group-membershipRemove the user group membership attribute.
 
logon-nameRemove the user logon name attribute.
 
qualified-logon-nameRemove the qualified logon name attribute.
 
use-additional-group-idDo not use the additional user group ID attribute.

Example

no user-attribute group-membership

Syntax

user-group-class <WORD>

Mode

LDAP Schema

Description

Set the class name of user group objects.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

user-group-class groupOfNames

Syntax

user-group-attribute { additional-group-match <WORD> | member { distinguished-name | user-id } <WORD> }

Mode

LDAP Schema

Description

Define attributes of user group objects.

Options

 
additional-group-matchSet the additional user group match attribute.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
memberSet the name/type of the member attribute.
 
distinguished-nameThe member attribute holds a distinguished name.
 
user-idThe member attribute holds a user ID (uid).
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

user-group-attribute member user-id memberUid

Syntax

no user-group-attribute { additional-group-match | member }

Mode

LDAP Schema

Description

Remove attributes of user group objects.

Options

 
additional-group-matchRemove the additional user group match attribute.
 
memberRemove the name of the member attribute.

Example

no user-group-attribute member

Syntax

read-trees-from-server [ domain <WORD> ] { append | replace }

Mode

LDAP Directory

Description

Read the directory trees containing users and user groups from the LDAP server.

Options

domainThe domain to search under.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
appendAppend to any current directory trees.
 
replaceReplace any current directory trees.

Example

read-trees-from-server append

Syntax

primary-domain <WORD>

Mode

LDAP Directory

Description

Set the primary LDAP domain.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

primary-domain mydomain.com

Syntax

users-tree <WORD> [ position <UINT32> ]

Mode

LDAP Directory

Description

Add or re-order a directory tree to search in when searching for user objects.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
positionPosition in the search order (1 = the first searched).
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

users-tree mydomain.com/users position 1

users-tree ou=users,dc=mydomain,dc=com position 1

Syntax

no users-tree <LDAP_DIRECTORY_NAME>

Mode

LDAP Directory

Description

Remove a directory tree to search in when searching for user objects.

Options

<LDAP_DIRECTORY_NAME> LDAP directory user or group name.
Example: abc

Example

no users-tree mydomain.com/users

no users-tree ou=users,dc=mydomain,dc=com

Syntax

user-groups-tree <WORD> [ position <UINT32> ]

Mode

LDAP Directory

Description

Add or re-order a directory tree to search in when searching for user group objects.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
positionPosition in the search order (1 = the first searched).
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

user-groups-tree mydomain.com/groups position 1

user-groups-tree ou=groups,dc=mydomain,dc=com position 1

Syntax

no user-groups-tree <LDAP_DIRECTORY_NAME>

Mode

LDAP Directory

Description

Remove a directory tree to search in when searching for user group objects.

Options

<LDAP_DIRECTORY_NAME> LDAP directory user or group name.
Example: abc

Example

no user-groups-tree mydomain.com/groups

no user-groups-tree ou=groups,dc=mydomain,dc=com

Syntax

host <HOSTNAME>

Mode

LDAP Server

Description

Set the LDAP server's host name or IP address.

Options

<HOSTNAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com

Example

host 192.168.168.1

Syntax

port <IPV4_PORT>

Mode

LDAP Server

Description

Set the LDAP server's UDP port number.

Options

<IPV4_PORT> Integer in the form: D OR 0xHHHH.
Example: 80

Example

port 389

Syntax

bind { anonymous | distinguished-name <WORD> | name <WORD> location <WORD> }

Mode

LDAP Server

Description

Set how to bind to the LDAP server, either selecting anonymous bind, giving the full distinguished name to use, or giving the account name to use and its location in the directory tree (the latter can be in either URL or DN format).

Options

 
anonymousBind anonymously.
 
distinguished-nameSet the full distinguished name to use.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
nameSet the account name to use.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
locationSet the account location in the directory tree.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

bind name administrator location builtin

bind distinguished-name "cn=name,ou=User,dc=mydomain,dc=com"
bind anonymous

Syntax

bind-password <ENC_PASSWORD>

Mode

LDAP Server

Description

Set the password for binding to the LDAP server.

Options

<ENC_PASSWORD> Password.
Example: secret

Example

bind-password mypassword

Syntax

protocol-version <UINT8>

Mode

LDAP Server

Description

Set protocol version the LDAP server.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

protocol-version 3

Syntax

enable

Mode

LDAP Relay

Description

Enable RADIUS to LDAP Relay.

Example

enable

Syntax

no enable

Mode

LDAP Relay

Description

Disable RADIUS to LDAP Relay.

Example

no enable

Syntax

clients-connect { public-zones | trusted-zones | vpn-zone | wan-zone | wireless-zones }

Mode

LDAP Relay

Description

Enable specified zone to allow incoming RADIUS requests.

Options

 
public-zonesAllow incoming RADIUS requests from public zones.
 
trusted-zonesAllow incoming RADIUS requests from trusted zones.
 
vpn-zoneAllow incoming RADIUS requests from vpn zone.
 
wan-zoneAllow incoming RADIUS requests from wan zone.
 
wireless-zonesAllow incoming RADIUS requests from wireless zones.

Example

clients-connect-via wan-zone

Syntax

no clients-connect { public-zones | trusted-zones | vpn-zone | wan-zone | wireless-zones }

Mode

LDAP Relay

Description

Disable specified zone to discard incoming RADIUS requests.

Options

 
public-zonesDiscard incoming RADIUS requests from public zones.
 
trusted-zonesDiscard incoming RADIUS requests from trusted zones.
 
vpn-zoneDiscard incoming RADIUS requests from vpn zone.
 
wan-zoneDiscard incoming RADIUS requests from wan zone.
 
wireless-zonesDiscard incoming RADIUS requests from wireless zones.

Example

no clients-connect-via wan-zone

Syntax

shared-secret <ENC_PASSWORD>

Mode

LDAP Relay

Description

Set RADIUS shared secret.

Options

<ENC_PASSWORD> Password.
Example: secret

Example

shared-secret 123abc

Syntax

no shared-secret

Mode

LDAP Relay

Description

Clear RADIUS shared secret.

Example

no shared-secret

Syntax

legacy-user-group { internet <WORD> | l2tp <WORD> | vpn <WORD> | vpn-client <WORD> }

Mode

LDAP Relay

Description

Set the user group that corresponds to the legacy access privileges. These settings allow inter-operation with remote SonicWALL running non-enhanced firmware that do not support user groups. When a user in one of the given user groups is authenticated, the remote SonicWALL will be informed that the user is to be given the relevant privilege.

Options

 
internetSet the user group for users with Internet access.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
l2tpSet the user group for L2TP users.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
vpnSet the user group for VPN users.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
vpn-clientSet the user group for VPN client users.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

user-groups-for-legacy-users vpn-users "VPN Services"

Syntax

no legacy-user-group { internet | l2tp | vpn | vpn-client }

Mode

LDAP Relay

Description

Clear the user group that corresponds to the legacy access privileges.

Options

 
internetClear the user group for users with Internet access.
 
l2tpClear the user group for L2TP users.
 
vpnClear the user group for VPN users.
 
vpn-clientClear the user group for VPN client users.

Example

no user-groups-for-legacy-users vpn-users

Syntax

test <WORD> <WORD> [ chap ]

Mode

LDAP

LDAP Schema
LDAP Directory
LDAP Relay
LDAP Server

Description

Run the LDAP test with the given user name/password.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
chapTest LDAP in a CHAP-compatible way.

Example

test user1 pwd1234

Syntax

user sso

Mode

Config

Description

Configure SSO settings.

Example

user sso

Syntax

clear user sso statistics [ agent <SSO_AGENT_HOST_NAME> | global | radius-accounting-client <SSO_RAD_ACCT_CLIENT_HOST_NAME> | terminal-services-agent <SSO_TS_AGENT_HOST_NAME> ]

Mode

All Modes (
excluding Top Level)

Description

Reset SSO statistics.

Options

 
agentReset SSO agent statistics.
<SSO_AGENT_HOST_NAME> Hostname in the form: hostname OR a.b.c.d.
Example: SSO-Agent
 
globalReset global (non-agent) SSO statistics.
 
radius-accounting-clientReset SSO RADIUS accounting client statistics.
<SSO_RAD_ACCT_CLIENT_HOST_NAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com
 
terminal-services-agentReset SSO terminal services agent statistics.
<SSO_TS_AGENT_HOST_NAME> Hostname in the form: hostname OR a.b.c.d.
Example: SSO-Terminal-Services-Agent

Example

clear user sso statistics

Syntax

method { [ browser-ntlm [ after-sso-agent-failed | before-sso-agent ] ] | radius-accouting | sso-agent | ts-agent }

Mode

SSO

Description

Enable the single-sign-on mechanism.

Options

 
browser-ntlmEnable browser NTLM authentication.
 
after-sso-agent-failedUse NTLM to authenticate HTTP traffic only if SSO via the agent fails.
 
before-sso-agentUse NTLM to authenticate HTTP traffic before attempting SSO via the agent.
 
radius-accoutingEnable RADIUS accounting authentication.
 
sso-agentEnable SSO agent authentication.
 
ts-agentEnable terminal services agent authentication.

Example

method sso-agent

Syntax

no method { browser-ntlm | radius-accouting | sso-agent | ts-agent }

Mode

SSO

Description

Disable the single-sign-on mechanism.

Options

 
browser-ntlmDisable browser NTLM authentication.
 
radius-accoutingDisable RADIUS accounting authentication.
 
sso-agentDisable SSO agent authentication.
 
ts-agentDisable terminal services agent authentication.

Example

no method sso-agent

Syntax

next-agent-on-no-name

Mode

SSO

Description

Enable try next agent on getting no name from NetAPI/WMI.

Example

next-agent-on-no-name

Syntax

no next-agent-on-no-name

Mode

SSO

Description

Disable try next agent on getting no name from NetAPI/WMI.

Example

no next-agent-on-no-name

Syntax

block-traffic

Mode

SSO

Description

Block user traffic while waiting for SSO.

Example

block-traffic

Syntax

no block-traffic

Mode

SSO

Description

Disable block user traffic while waiting for SSO.

Example

no block-traffic

Syntax

including-for-access-rules { all | selected }

Mode

SSO

Description

Allow through user traffic for all or selected access rules.

Options

 
allAllow through user traffic for all access rules.
 
selectedAllow through user traffic for all access rules.

Example

including-for-access-rules all

Syntax

no including-for-access-rules

Mode

SSO

Description

Block user traffic for all access rules.

Example

no including-for-access-rules

Syntax

local-users-only

Mode

SSO

Description

Limit login to only SSO users with accounts in the local user database.

Example

local-users-only

Syntax

no local-users-only

Mode

SSO

Description

Disable limit login to only SSO users with accounts in the local user database.

Example

no local-users-only

Syntax

simple-local-user-names

Mode

SSO

Description

Use just the simple user name versus the full user name with domain when looking up SSO users in the local user database.

Example

simple-local-user-names

Syntax

no simple-local-user-names

Mode

SSO

Description

Use the full user name with domain when looking up SSO users in the local user database.

Example

no simple-local-user-names

Syntax

non-domain-limited-access

Mode

SSO

Description

Allow limited access for users who are identified by SSO but reported by the agent as not logged into the domain. These users will not be given membership to the Trusted Users user group (even when set locally).

Example

non-domain-limited-access

Syntax

no non-domain-limited-access

Mode

SSO

Description

Disable allow any access for users who are reported by the agent as not logged into the domain.

Example

no non-domain-limited-access

Syntax

probe { netapi [ [ over-netbios | over-tcp ] ] | test-mode | timeout <UINT16> | wmi }

Mode

SSO

Description

Probe IP addresses to check if they respond to NetAPI or WMI before making an SSO attempt<br> Set timeout for probing IP addresses<br> Enable probe test-mode.

Options

 
netapiProbe for NetAPI, default over NetBIOS.
 
over-netbiosProbe for NetAPI over NetBIOS.
 
over-tcpProbe for NetAPI over TCP.
 
test-modeEnable probe test-mode. Probe test mode allows testing that SSO probes are functioning correctly during SSO without their interfering with the user authentications
 
timeoutSet timeout for probing IP addresses.
<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123
 
wmiProbe for WMI.

Example

probe netapi over-tcp

probe wmi
probe time-out 5
probe test-mode

Syntax

no probe [ test-mode ]

Mode

SSO

Description

Disable probe IP addresses to check if they respond to NetAPI or WMI before making an SSO attempt.

Options

test-modeDisable probe test-mode.

Example

no probe

Syntax

user-group-mechanism { ldap | local-only }

Mode

SSO

Description

Set the mechanism to use to set user group memberships for users who are authenticated via SSO.

Options

 
ldapRead user groups via LDAP.
 
local-onlySet using local users that duplicate SSO users.

Example

user-group-mechanism ldap

Syntax

poll-rate <UINT8>

Mode

SSO

Description

Set the polling rate for checking if logged in users who were identified via SSO are still logged in.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

poll-rate 10

Syntax

no poll-rate

Mode

SSO

Description

Clear the polling rate.

Example

no poll-rate

Syntax

poll-same-agent

Mode

SSO

Description

Enable poll the same agent that authenticated the user.

Example

poll-same-agent

Syntax

no poll-same-agent

Mode

SSO

Description

Disable poll the same agent that authenticated the user.

Example

no poll-same-agent

Syntax

hold-time-after-failure <UINT16>

Mode

SSO

Description

Set the time to hold off from trying again to identify the user at an IP address following an SSO failure for it.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

hold-time-after-failure 10

Syntax

hold-time-after-no-user <UINT16>

Mode

SSO

Description

Set the time to hold off from trying again to identify the user at an IP address following reporting no user for it.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

hold-time-after-no-user 10

Syntax

windows-service-user-name <WORD>

Mode

SSO

Description

Add a name to the list of user names known to be used by Windows services (and so to be ignored by the SSO agent).

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

windows-service-user-name someservice

Syntax

no windows-service-user-name <WINDOWS_SERVICE_USER_NAME>

Mode

SSO

Description

Remove a name from the list of user names known to be used by Windows services (and so to be ignored by the SSO agent).

Options

<WINDOWS_SERVICE_USER_NAME> The login name of a windows service.
Example: abc

Example

no windows-service-user-name someservice

Syntax

security-service-bypass-ip { group <ADDR_GROUP_NAME> | name <SECURITY_SERVICE_BYPASS_IP_NAME> }

Mode

SSO

Description

Select an address object giving IP addresses from which traffic will not initiate SSO to identify users for the security services.

Options

 
groupGroup address object name.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
nameAddress object name.
<SECURITY_SERVICE_BYPASS_IP_NAME> Security service bypass ip name.
Example: Web Server

Example

security-service-bypass-ip "Non-User Addresses"

Syntax

no security-service-bypass-ip

Mode

SSO

Description

De-select the address object giving IP addresses from which traffic will not initiate SSO to identify users for the security services.

Example

no security-service-bypass-ip

Syntax

security-service-bypass-service { group <SVC_GROUP_NAME> | name <SVC_NAME> }

Mode

SSO

Description

Select a service object giving services that will not initiate SSO to identify users for the security services.

Options

 
groupService group name.
<SVC_GROUP_NAME> Service object group name.
Example: VOIP
 
nameService object name.
<SVC_NAME> Service object name.
Example: HTTPS

Example

security-service-bypass-service "POP3"

Syntax

no security-service-bypass-service

Mode

SSO

Description

De-select the service object giving services that will not initiate SSO to identify users for the security services.

Example

no security-service-bypass-service

Syntax

enforce-on-zone <SSO_ZONE_NAME>

Mode

SSO

Description

Select to always enforce SSO on a zone.

Options

<SSO_ZONE_NAME> Zone object name.
Example: DMZ

Example

enforce-on-zone lan

Syntax

no enforce-on-zone <SSO_ZONE_NAME>

Mode

SSO

Description

Select to not always enforce SSO on a zone.

Options

<SSO_ZONE_NAME> Zone object name.
Example: DMZ

Example

no enforce-on-zone lan

Syntax

tsa-services-bypass

Mode

SSO

Description

Allow traffic from services on a terminal server running the TS agent to bypass user authentication in access rules.

Example

tsa-services-bypass

Syntax

no tsa-services-bypass

Mode

SSO

Description

Don't Allow traffic from services on a terminal server running the TS agent to bypass user authentication in access rules.

Example

no tsa-services-bypass

Syntax

authentication-domain { custom <WORD> | inherit-from-ldap }

Mode

SSO

Description

Set the authentication domain.

Options

 
customUser the custom domain.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
inherit-from-ldapUser the domain from the LDAP configuration.

Example

authentication-domain custom "www.mydomain.com"

Syntax

redirect-browser { certificate-name | domain-name { { configured | reverse-dns-look-up } } | ip-address }

Mode

SSO

Description

Set method of redirect browser to SonicWALL appliance's own web server.

Options

 
certificate-nameVia the name from the administration certificate
 
domain-nameVia the domain name
 
configuredVia its configured domain name
 
reverse-dns-look-upVia its domain name from a reverse DNS lookup of the interface IP address
 
ip-addressVia the interface IP address

Example

redirect-browser ip-address

Syntax

retries-on-failure <UINT16>

Mode

SSO

Description

Set maximum retries to allow on authentication failure.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

retries-on-failure 3

Syntax

poll { linux | macintosh | windows } { { agent | none-reauth | reauth-ntlm } }

Mode

SSO

Description

Set polling method for different system users.

Options

 
linuxSet polling method for linux users.
 
macintoshSet polling method for macintosh users.
 
windowsSet polling method for windows users.
 
agentPoll via the SSO agent.
 
none-reauthDon't re-authenticate.
 
reauth-ntlmRe-authenticate via NTLM.

Example

poll windows agent

Syntax

forward-lanman

Mode

SSO

Description

Enable forward legacy LanMan in NTLM.

Example

forward-lanman

Syntax

no forward-lanman

Mode

SSO

Description

Disable forward legacy LanMan in NTLM.

Example

no forward-lanman

Syntax

radius-accounting-port <IPV4_PORT>

Mode

SSO

Description

Set the RADIUS accounting's UDP port number.

Options

<IPV4_PORT> Integer in the form: D OR 0xHHHH.
Example: 80

Example

radius-accounting-port 1813

Syntax

agent <SSO_AGENT_HOST_NAME>

Mode

SSO

Description

Configure an SSO agent.

Options

<SSO_AGENT_HOST_NAME> Hostname in the form: hostname OR a.b.c.d.
Example: SSO-Agent

Example

agent 192.168.168.1

Syntax

no agent <SSO_AGENT_HOST_NAME>

Mode

SSO

Description

Delete an SSO agent.

Options

<SSO_AGENT_HOST_NAME> Hostname in the form: hostname OR a.b.c.d.
Example: SSO-Agent

Example

no agent 192.168.168.1

Syntax

no agents

Mode

SSO

Description

Delete all SSO agents.

Example

no agents

Syntax

host <HOSTNAME>

Mode

SSO Agent

Description

Set the SSO agent's host name or IP address.

Options

<HOSTNAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com

Example

host 192.168.168.1

Syntax

port <IPV4_PORT>

Mode

SSO Agent

Description

Set the SSO agent's UDP port number.

Options

<IPV4_PORT> Integer in the form: D OR 0xHHHH.
Example: 80

Example

port 389

Syntax

enable

Mode

SSO Agent

Description

Enable the SSO agent.

Example

enable

Syntax

no enable

Mode

SSO Agent

Description

Disable the SSO agent.

Example

no enable

Syntax

timeout <UINT16>

Mode

SSO Agent

Description

Set the timeout on replies from the agent.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

timeout 10

Syntax

retries <UINT16>

Mode

SSO Agent

Description

Set the maximum number of retries to make after timeouts waiting for replies from the agent.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

retries 10

Syntax

no shared-key

Mode

SSO Agent

Description

Clear the shared key for encrypting messages to/from the agent.

Example

no shared-key

Syntax

shared-key <ENC_HEX_STRING>

Mode

SSO Agent

Description

Set the hexadecimal value of the shared key for encrypting messages to/from the SSO agent.

Options

<ENC_HEX_STRING> String of hexadecimal digits.
Example: 0123456989abcdef

Example

shared-key 1234abcd

Syntax

max-requests <UINT16>

Mode

SSO Agent

Description

Set the maximum number of requests to send to the agent at a time.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

max-requests 10

Syntax

terminal-services-agent <SSO_TS_AGENT_HOST_NAME>

Mode

SSO

Description

Configure a terminal services agent.

Options

<SSO_TS_AGENT_HOST_NAME> Hostname in the form: hostname OR a.b.c.d.
Example: SSO-Terminal-Services-Agent

Example

terminal-services-agent 192.168.168.1

Syntax

no terminal-services-agent <SSO_TS_AGENT_HOST_NAME>

Mode

SSO

Description

Delete a terminal services agent.

Options

<SSO_TS_AGENT_HOST_NAME> Hostname in the form: hostname OR a.b.c.d.
Example: SSO-Terminal-Services-Agent

Example

no terminal-services-agent 192.168.168.1

Syntax

no terminal-services-agents

Mode

SSO

Description

Delete all terminal services agents.

Example

no terminal-services-agents

Syntax

host <HOSTNAME>

Mode

SSO Agent

Description

Set the agent's host name or IP address.

Options

<HOSTNAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com

Example

host 192.168.168.1

Syntax

port <IPV4_PORT>

Mode

SSO Agent

Description

Set the agent's UDP port number.

Options

<IPV4_PORT> Integer in the form: D OR 0xHHHH.
Example: 80

Example

port 389

Syntax

enable

Mode

SSO Agent

Description

Enable the terminal services agent.

Example

enable

Syntax

no enable

Mode

SSO Agent

Description

Disable the terminal services agent.

Example

no enable

Syntax

no shared-key

Mode

SSO Agent

Description

Clear the shared key for encrypting messages to/from the agent.

Example

no shared-key

Syntax

shared-key <ENC_HEX_STRING>

Mode

SSO Agent

Description

Set the hexadecimal value of the shared key for encrypting messages to/from the terminal services agent.

Options

<ENC_HEX_STRING> String of hexadecimal digits.
Example: 0123456989abcdef

Example

shared-key 1234abcd

Syntax

radius-accounting-client <SSO_RAD_ACCT_CLIENT_HOST_NAME>

Mode

SSO

Description

Configure a RADIUS accounting client.

Options

<SSO_RAD_ACCT_CLIENT_HOST_NAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com

Example

radius-accounting-client 192.168.168.11

Syntax

no radius-accounting-client <SSO_RAD_ACCT_CLIENT_HOST_NAME>

Mode

SSO

Description

Delete a RADIUS accounting client.

Options

<SSO_RAD_ACCT_CLIENT_HOST_NAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com

Example

no radius-accounting-client 192.168.168.11

Syntax

no radius-accounting-clients

Mode

SSO

Description

Delete all RADIUS accounting clients.

Example

no radius-accounting-clients

Syntax

shared-secret <ENC_PASSWORD>

Mode

SSO RADIUS Accounting Client

Description

Set the value of the shared secret for encrypting messages to/from the client.

Options

<ENC_PASSWORD> Password.
Example: secret

Example

shared-secret 1234abcd

Syntax

no shared-secret

Mode

SSO RADIUS Accounting Client

Description

Clear the shared secret for encrypting messages to/from the client.

Example

no shared-secret

Syntax

user-name-format { canonical | down-level-logon | sonicwall-aventail | user-name | user-principle }

Mode

SSO RADIUS Accounting Client

Description

Set user name attribute format.

Options

 
canonicalSet to pre-defined \"Domain/User-name\" format.
 
down-level-logonSet to pre-defined \"Domain\\User-name\" format.
 
sonicwall-aventailSet to pre-defined \"SonicWALL Aventail\" format.
 
user-nameSet to pre-defined \"User-name\" format.
 
user-principleSet to pre-defined \"User-name@Domain\" format.

Example

user-name-format user-name

Syntax

missing-domain { ldap-look-up | local-user }

Mode

SSO RADIUS Accounting Client

Description

Set approach if the domain component is missing in a RADIUS message.

Options

 
ldap-look-upLook up the user name via LDAP.
 
local-userAssume a non-domain user.

Example

missing-domain ldap-look-up

Syntax

log-user-out <UINT32>

Mode

SSO RADIUS Accounting Client

Description

Log user out if no accounting interim updates are received for the specified minutes.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

log-user-out 5

Syntax

no log-user-out

Mode

SSO RADIUS Accounting Client

Description

Disable log user out.

Example

no log-user-out

Syntax

server <SSO_RAD_ACCT_FORWARD_SERVER_ID> <SSO_RAD_ACCT_PROXY_FWD_SERVER_HOST_NAME> [ port <IPV4_PORT> ] [ shared-secret <ENC_PASSWORD> ]

Mode

SSO RADIUS Accounting Client

Description

Configure the server for receiving RADIUS accounting messages forwarded from this client.

Options

<SSO_RAD_ACCT_FORWARD_SERVER_ID> Integer in the form: D OR 0xHH.
Example: 1
<SSO_RAD_ACCT_PROXY_FWD_SERVER_HOST_NAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com
portSet the server's port number.
<IPV4_PORT> Integer in the form: D OR 0xHHHH.
Example: 80
shared-secretSet the shared secret.
<ENC_PASSWORD> Password.
Example: secret

Example

server 1 192.168.168.11 port 1813 shared-secret 123abc

Syntax

no server <SSO_RAD_ACCT_FORWARD_SERVER_ID> [ shared-secret ]

Mode

SSO RADIUS Accounting Client

Description

Clear a RADIUS accounting client forwarding server.

Options

<SSO_RAD_ACCT_FORWARD_SERVER_ID> Integer in the form: D OR 0xHH.
Example: 1
shared-secretClear the shared secret.

Example

no server 1

Syntax

proxy-forward-timeout <UINT16>

Mode

SSO RADIUS Accounting Client

Description

Set timeout for each forward.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

proxy-forward-timeout 5

Syntax

proxy-forward-retries <UINT16>

Mode

SSO RADIUS Accounting Client

Description

Set retries number for each accounting server.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

proxy-forward-retries 5

Syntax

proxy-forward-type { forward-to-all | try-next-on-timeout }

Mode

SSO RADIUS Accounting Client

Description

Set how to proxy forward to multiple accounting servers.

Options

 
forward-to-allProxy forword to all servers.
 
try-next-on-timeoutTry next server when timeout.

Example

proxy-forward-type try-next-on-timeout

Syntax

test [ [ agent <SSO_AGENT_HOST_NAME> ] [ user-ip <IPV4_HOST> ] | terminal-services-agent <SSO_TS_AGENT_HOST_NAME> ]

Mode

SSO

SSO Agent
SSO Agent
SSO RADIUS Accounting Client

Description

Run the SSO test with the given user name/password.

Options

 
agentSpecify an agent to test.
<SSO_AGENT_HOST_NAME> Hostname in the form: hostname OR a.b.c.d.
Example: SSO-Agent
user-ipThe IP address of a user to test.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
 
terminal-services-agentSpecify a terminal services agent to test.
<SSO_TS_AGENT_HOST_NAME> Hostname in the form: hostname OR a.b.c.d.
Example: SSO-Terminal-Services-Agent

Example

test agent 192.168.168.1 user-ip 192.168.168.99

Syntax

user guest

Mode

Config

Description

Configure settings related to guest users.

Example

user guest

Syntax

profile <GUEST_PROFILE_NAME>

Mode

Guest User

Description

Add or update a guest user profile.

Options

<GUEST_PROFILE_NAME> Guest profile name.
Example: profile1

Example

profile "Custom Profile"

Syntax

no profile <GUEST_PROFILE_NAME>

Mode

Guest User

Description

Delete a guest user profile.

Options

<GUEST_PROFILE_NAME> Guest profile name.
Example: profile1

Example

no profile "Custom Profile"

Syntax

guest [ name <GUEST_USER_NAME> ] [ profile <GUEST_PROFILE_NAME> ] [ { hide-password | password <ENC_PASSWORD> } ] [ generate <UINT32> ]

Mode

Guest User

Description

Add or update a guest user account.

Options

nameThe name of the guest account.
<GUEST_USER_NAME> Guest user name.
Example: guest1
profileApply the settings from a guest profile.
<GUEST_PROFILE_NAME> Guest profile name.
Example: profile1
 
hide-passwordDon't show the auto-generated password.
 
passwordSet the guest user password.
<ENC_PASSWORD> Password.
Example: secret
generateGenerate multiple guest accounts.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

guest name johndoe

Syntax

no password

Mode

Guest User

Description

Clear the guest account password.

Example

no password

Syntax

no guest <GUEST_USER_NAME>

Mode

Guest User

Description

Delete a guest user account.

Options

<GUEST_USER_NAME> Guest user name.
Example: guest1

Example

no guest johndoe

Syntax

no guests <WORD>

Mode

Guest User

Description

Delete all guest user accounts with a given name prefix.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

no guests temp-guest

Syntax

show-guest-status-window

Mode

Guest User

Description

Enable showing the login status window after guest login.

Example

show-guest-status-window

Syntax

no show-guest-status-window

Mode

Guest User

Description

Disable showing the login status window after guest login.

Example

no show-guest-status-window

Syntax

export guest-accounts { ftp <FTP_URL> | scp <SCP_URL> }

Mode

Guest User

Description

Export guest accounts' configurations.

Options

 
ftpExport using the FTP protocol.
<FTP_URL> FTP URL in the form: ftp://username:password@hostname/\n Escape character: ':' -> '\\\\:', '@' -> '\\\\@', '/' -> '\\\\/', '\\' -> '\\\\\\\\'.
Example: ftp://username:password@hostname/\nftp://username@hostname/\nftp://hostname/
 
scpExport using the SCP protocol.
<SCP_URL> SCP URL in the form: scp://username@host/\n Escape character: ':' -> '\\\\:', '@' -> '\\\\@', '/' -> '\\\\/', '\\' -> '\\\\\\\\'.
Example: scp://username@host/\nscp://host/

Example

export guest-accounts ftp ftp://user:password@servername/ guest-accounts.csv

Syntax

logout user at <GUEST_LOGIN_USER_BY_IP>

Mode

Guest User

Description

Logout guest user.

Options

atLogout a guest user by IP.
<GUEST_LOGIN_USER_BY_IP> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

logout user at 192.168.168.1

Syntax

logout users

Mode

Guest User

Description

Logout guest users.

Example

logout users

Syntax

name <WORD>

Mode

Guest Profile

Description

Set the name of the guest user profile.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

name profile1

Syntax

generate { name | password }

Mode

Guest Profile

Description

Auto generate names or passwords for guest accounts created with this profile.

Options

 
nameAuto-generate names for created guest accounts.
 
passwordAuto generate passwords for created guest accounts.

Example

generate name

generate password

Syntax

no generate { name | password }

Mode

Guest Profile

Description

Disable auto generate names or passwords for guest accounts created with this profile.

Options

 
nameDisable auto-generate names for created guest accounts.
 
passwordDisable auto generate passwords for created guest accounts.

Example

no generate name

no generate password

Syntax

name-prefix <WORD>

Mode

Guest Profile

Description

Set a prefix for auto generated names for guest accounts created with this profile.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

name-prefix guest

Syntax

comment <WORD>

Mode

Guest Profile

Description

Set comment for guest accounts created with this profile.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

comment "Added via profile1"

Syntax

no comment

Mode

Guest Profile

Description

Clear comment for guest accounts created with this profile.

Example

no comment

Syntax

enable

Mode

Guest Profile

Description

Enable guest accounts to be created.

Example

enable

Syntax

no enable

Mode

Guest Profile

Description

Disable guest accounts to be created.

Example

no enable

Syntax

activate-on-login

Mode

Guest Profile

Description

Enable activate account upon first login.

Example

activate-on-login

Syntax

no activate-on-login

Mode

Guest Profile

Description

Disable activate account upon first login.

Example

no activate-on-login

Syntax

login-uniqueness

Mode

Guest Profile

Description

Enable enforcing unique login sessions.

Example

login-uniqueness

Syntax

no login-uniqueness

Mode

Guest Profile

Description

Disable enforcing unique login sessions.

Example

no login-uniqueness

Syntax

prune-on-expiry

Mode

Guest Profile

Description

Enable to delete the guest accounts when they are expired if a limited lifetime is set.

Example

prune-on-expiry

Syntax

no prune-on-expiry

Mode

Guest Profile

Description

Disable to delete the guest accounts when they are expired.

Example

no prune-on-expiry

Syntax

account-lifetime <UINT32> { days | hours | minutes }

Mode

Guest Profile

Description

Set a limited lifetime for the guest accounts.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123
 
daysSet the lifetime in days.
 
hoursSet the lifetime in hours.
 
minutesSet the lifetime in minutes.

Example

account-lifetime 48 hours

Syntax

session-lifetime <UINT32> { days | hours | minutes }

Mode

Guest Profile

Description

Set a session time limit for the created guest accounts.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123
 
daysSet the session limit in days.
 
hoursSet the session limit in hours.
 
minutesSet the session limit in minutes.

Example

session-lifetime 48 hours

Syntax

idle-timeout <UINT32> { days | hours | minutes }

Mode

Guest Profile

Description

Set the session inactivity timeout for created guest accounts.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123
 
daysSet the idle timeout in days.
 
hoursSet the idle timeout in hours.
 
minutesSet the idle timeout in minutes.

Example

idle-timeout 20 minutes

Syntax

name <WORD>

Mode

Guest User

Description

Set the login name of the guest account.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

name johndoe

Syntax

name-prefix <WORD>

Mode

Guest User

Description

Set the name prefix for the guest accounts.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

name-prefix temp-guest

Syntax

generate { name | password [ hide ] }

Mode

Guest User

Description

Generate a login name or password for the guest account.

Options

 
nameGenerate a login name for the guest account.
 
passwordGenerate a password for the guest account.
hideDisable showing the generated password.

Example

generate name

generate password

Syntax

profile <GUEST_PROFILE_NAME> [ hide-password ]

Mode

Guest User

Description

Enable the settings from a guest profile.

Options

<GUEST_PROFILE_NAME> Guest profile name.
Example: profile1
hide-passwordDisable showing the auto-generated password.

Example

profile "Custom Profile"

Syntax

comment <WORD>

Mode

Guest User

Description

Set comment for the guest account.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

comment "Added 7/26/2010"

Syntax

no comment

Mode

Guest User

Description

Clear the comment for the guest account.

Example

no comment

Syntax

password <ENC_PASSWORD>

Mode

Guest User

Description

Set the guest account password.

Options

<ENC_PASSWORD> Password.
Example: secret

Example

password pwd1234

Syntax

no password

Mode

Guest User

Description

Clear the guest account password.

Example

no password

Syntax

enable

Mode

Guest User

Description

Enable the guest account.

Example

enable

Syntax

no enable

Mode

Guest User

Description

Disable the guest account.

Example

no enable

Syntax

activate-on-login

Mode

Guest User

Description

Enable activate account upon first login.

Example

activate-on-login

Syntax

no activate-on-login

Mode

Guest User

Description

Disable activate account upon first login.

Example

no activate-on-login

Syntax

login-uniqueness

Mode

Guest User

Description

Enable enforcing a unique login session with the guest account.

Example

login-uniqueness

Syntax

no login-uniqueness

Mode

Guest User

Description

Disable enforcing a unique login session with the guest account.

Example

no login-uniqueness

Syntax

prune-on-expiry

Mode

Guest User

Description

Enable delete the guest account when it is expired if a limited lifetime is set.

Example

prune-on-expiry

Syntax

no prune-on-expiry

Mode

Guest User

Description

Disable delete the guest account when it is expired.

Example

no prune-on-expiry

Syntax

account-lifetime <UINT32> { days | hours | minutes }

Mode

Guest User

Description

Set a limited lifetime for the guest account.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123
 
daysSet the lifetime in days.
 
hoursSet the lifetime in hours.
 
minutesSet the lifetime in minutes.

Example

account-lifetime 48 hours

Syntax

session-lifetime <UINT32> { days | hours | minutes }

Mode

Guest User

Description

Set a session time limit for the guest account.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123
 
daysSet the session limit in days.
 
hoursSet the session limit in hours.
 
minutesSet the session limit in minutes.

Example

session-lifetime 48 hours

Syntax

idle-timeout <UINT32> { days | hours | minutes }

Mode

Guest User

Description

Set the session inactivity timeout for the guest account.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123
 
daysSet the idle timeout in days.
 
hoursSet the idle timeout in hours.
 
minutesSet the idle timeout in minutes.

Example

idle-timeout 20 minutes

Syntax

show user authentication [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show user authentication related settings.

Options

 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show user authentication

Syntax

show user local [ group <LOCAL_USER_GROUP_NAME> | groups | user <LOCAL_USER_NAME> | users ] [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show settings for local users/groups.

Options

 
groupShow a local user group.
<LOCAL_USER_GROUP_NAME> User group object name.
Example: Limited Administrators
 
groupsShow all local user groups.
 
userShow a local user.
<LOCAL_USER_NAME> User object name.
Example: user1
 
usersShow all local users.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show user local

show user local users
show user local user jcool
show user local groups
show user local group "Special Users"

Syntax

show user status [ at <USER_IPV4_ADDR> [ user <UINT32> ] | inactive | name <USER_LOGIN_NAME> | unauthenticated ] [ pending ] [ logged-in ] [ locked-out ]

Mode

All Modes

Description

Show information on current users.

Options

 
atShow detail of a user at a given IP address.
<USER_IPV4_ADDR> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
userFor Terminal Services users only, select the user at the IP address.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123
 
inactiveShow information of inactive users.
 
nameShow information of the users with the given name
<USER_LOGIN_NAME> A connected user's login name.
Example: jdoe
 
unauthenticatedShow information of unauthenticated users.
pendingInclude users currently being authenticated.
logged-inInclude logged in users.
locked-outInclude locked out users.

Example

show user status

show user status at 192.168.168.1

Syntax

show user statistics

Mode

All Modes

Description

Show current user's statistics information.

Example

show user statistics

Syntax

show user management

Mode

All Modes

Description

Show user management configuration.

Example

show user management

Syntax

show user radius [ server { { primary | secondary } } | servers ] [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show RADIUS settings.

Options

 
serverShow RADIUS server settings.
 
primaryShow the primary RADIUS server.
 
secondaryShow the secondary RADIUS server.
 
serversShow settings for all RADIUS servers.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show user radius

show user radius servers
show user radius server primary

Syntax

show user ldap [ directory | relay | schema | server <LDAP_SERVER_HOST_NAME> ] [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show LDAP settings.

Options

 
directoryShow the LDAP directory configuration.
 
relayShow LDAP relay configuration.
 
schemaShow the LDAP schema.
 
serverShow LDAP server settings.
<LDAP_SERVER_HOST_NAME> Hostname in the form: hostname OR a.b.c.d.
Example: LDAP-Server
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show user ldap show user ldap schema

Syntax

show user sso [ agent <SSO_AGENT_HOST_NAME> | agents | radius-accounting-client <SSO_RAD_ACCT_CLIENT_HOST_NAME> | radius-accounting-clients | statistics [ { agent <SSO_AGENT_HOST_NAME> | all | radius-accounting-client <SSO_RAD_ACCT_CLIENT_HOST_NAME> | terminal-services-agent <SSO_TS_AGENT_HOST_NAME> } ] | status | terminal-services-agent <SSO_TS_AGENT_HOST_NAME> | terminal-services-agents ] [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show SSO settings, status or statistics.

Options

 
agentShow SSO agent settings.
<SSO_AGENT_HOST_NAME> Hostname in the form: hostname OR a.b.c.d.
Example: SSO-Agent
 
agentsShow settings for all SSO agents.
 
radius-accounting-clientShow SSO RADIUS accounting client settings.
<SSO_RAD_ACCT_CLIENT_HOST_NAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com
 
radius-accounting-clientsShow settings for all SSO RADIUS accounting clients.
 
statisticsShow SSO statistics.
 
agentShow statistics for an SSO agent.
<SSO_AGENT_HOST_NAME> Hostname in the form: hostname OR a.b.c.d.
Example: SSO-Agent
 
allShow all SSO statistics.
 
radius-accounting-clientShow statistics for an SSO RADIUS accounting client.
<SSO_RAD_ACCT_CLIENT_HOST_NAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com
 
terminal-services-agentShow statistics for an SSO terminal services agent.
<SSO_TS_AGENT_HOST_NAME> Hostname in the form: hostname OR a.b.c.d.
Example: SSO-Terminal-Services-Agent
 
statusShow SSO agent status.
 
terminal-services-agentShow SSO terminal services agent settings.
<SSO_TS_AGENT_HOST_NAME> Hostname in the form: hostname OR a.b.c.d.
Example: SSO-Terminal-Services-Agent
 
terminal-services-agentsShow settings for all SSO terminal services agents.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show user sso

show user sso agents
show user sso agent 192.168.168.1

Syntax

show user guest [ [ profile <GUEST_PROFILE_NAME> | profiles | user <GUEST_USER_NAME> | users ] [ { pending-config | with-pending-config } ] | [ statistic user <GUEST_LOGIN_USER_BY_IP> | status { user <GUEST_LOGIN_USER_BY_IP> | users } ] ]

Mode

All Modes

Description

Show settings for guest profiles/users.

Options

 
 
profileShow a guest user profile.
<GUEST_PROFILE_NAME> Guest profile name.
Example: profile1
 
profilesShow all guest user profiles.
 
userShow a guest user.
<GUEST_USER_NAME> Guest user name.
Example: guest1
 
usersShow all guest users.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
 
statisticShow the logged-in guest users' statistic.
userShow the logged-in guest user's statistic.
<GUEST_LOGIN_USER_BY_IP> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
 
statusShow the logged-in guest users' status.
 
userShow the logged-in guest user's status.
<GUEST_LOGIN_USER_BY_IP> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
 
usersShow the logged-in guest users' status.

Example

show user guest

show user guest users
show user guest user jcool

Syntax

appflow-server

Mode

Config

Description

Enter AppFlow Server Configuration Mode.

Example

appflow-server

Syntax

keep-alive

Mode

AppFlow Server

Description

Enable keep-alive with Appflow Server.

Example

keep-alive

Syntax

no keep-alive

Mode

AppFlow Server

Description

Disable keep-alive with Appflow Server.

Example

no keep-alive

Syntax

ip <IPV4_HOST>

Mode

AppFlow Server

Description

Set AppFlow Server IP address.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

ip 10.10.10.200

Syntax

vpn-source-ip <IPV4_HOST>

Mode

AppFlow Server

Description

Set source IP to use for AppFlow Server on a VPN tunnel.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

vpn-source-ip 10.10.10.110

Syntax

max-flows <UINT32>

Mode

AppFlow Server

Description

Set the AppFlow Server maximum flows.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

max-flows 500000

Syntax

communication-timeout <UINT8>

Mode

AppFlow Server

Description

Set the AppFlow Server communication timeout in seconds.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

communication-timeout 60

Syntax

firewall-name <WORD>

Mode

AppFlow Server

Description

Set the AppFlow Server firewall name.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

firewall-name "My Sonicwall"

Syntax

passphrase <ENC_PASSWORD>

Mode

AppFlow Server

Description

Set the connection passphrase.

Options

<ENC_PASSWORD> Password.
Example: secret

Example

passphrase reveal2noone

Syntax

auto-synchronize

Mode

AppFlow Server

Description

Enable auto-synchronize for AppFlow Server.

Example

auto-synchronize

Syntax

no auto-synchronize

Mode

AppFlow Server

Description

Disable auto-synchronize for AppFlow Server.

Example

no auto-synchronize

Syntax

synchronize

Mode

AppFlow Server

Description

Synchronize AppFlow Server.

Example

synchronize

Syntax

test-connectivity

Mode

AppFlow Server

Description

Test connectivity of AppFlow Server.

Example

test-connectivity

Syntax

flush server <IPV4_HOST>

Mode

AppFlow Server

Description

Flush specified AppFlow Server.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

flush server 192.168.168.166

Syntax

flush servers

Mode

AppFlow Server

Description

Flush all discovered AppFlow Servers.

Example

flush servers

Syntax

discover <ASSIGNED_INTERFACE>

Mode

AppFlow Server

Description

Discover AppFlow Servers.

Options

<ASSIGNED_INTERFACE> Interface name.
Example: X0

Example

discover interfaceId

Syntax

show appflow-server [ status ] [ discovered ] [ detail <IPV4_HOST> ]

Mode

All Modes

Description

Show AppFlow Server Configuration.

Options

statusShow AppFlow Server status.
discoveredShow discovered AppFlow servers.
detailShow detail of specified AppFlow server.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

show appflow-server

Syntax

certificates

Mode

Config

Description

Certificate configuration.

Example

certificates

Syntax

export signing-request <WORD> { ftp <FTP_URL> | zmodem }

Mode

Certificates

Description

Export Certificate Signing Request using Zmodem or FTP.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
ftpUse ftp.
<FTP_URL> FTP URL in the form: ftp://username:password@hostname/\n Escape character: ':' -> '\\\\:', '@' -> '\\\\@', '/' -> '\\\\/', '\\' -> '\\\\\\\\'.
Example: ftp://username:password@hostname/\nftp://username@hostname/\nftp://hostname/
 
zmodemUse zmodem.

Example

export signing-request "Corp VPN Cert" ftp ftp://ftp.myserver.local/cert.p10

Syntax

export cert-key-pair <WORD> password <WORD> { ftp <FTP_URL> | zmodem }

Mode

Certificates

Description

Export Certificate Signing Request or Certificate / Key pair using Zmodem or FTP.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
passwordPassword of the PKCS#12 (.p12 or .pfx) encoded file.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
ftpUse ftp.
<FTP_URL> FTP URL in the form: ftp://username:password@hostname/\n Escape character: ':' -> '\\\\:', '@' -> '\\\\@', '/' -> '\\\\/', '\\' -> '\\\\\\\\'.
Example: ftp://username:password@hostname/\nftp://username@hostname/\nftp://hostname/
 
zmodemUse zmodem.

Example

export cert-key-pair "Corp VPN Cert" ftp ftp://ftp.myserver.local/cert.p12

Syntax

import cert-key-pair <WORD> password <WORD> { ftp <FTP_URL> | zmodem }

Mode

Certificates

Description

Import Certificate / Key pair using Zmodem or FTP.

Options

cert-key-pairLocal end-user certificate with private key from a PKCS#12 (.p12 or .pfx) encoded file.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
passwordPassword of the PKCS#12 (.p12 or .pfx) encoded file.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
ftpUse ftp.
<FTP_URL> FTP URL in the form: ftp://username:password@hostname/\n Escape character: ':' -> '\\\\:', '@' -> '\\\\@', '/' -> '\\\\/', '\\' -> '\\\\\\\\'.
Example: ftp://username:password@hostname/\nftp://username@hostname/\nftp://hostname/
 
zmodemUse zmodem.

Example

import cert-key-pair "Corp VPN Cert" ftp ftp://ftp.myserver.local/cert.p12

Syntax

import ca-cert { ftp <FTP_URL> | zmodem }

Mode

Certificates

Description

Import CA Certificate using Zmodem or FTP.

Options

 
ftpUse ftp.
<FTP_URL> FTP URL in the form: ftp://username:password@hostname/\n Escape character: ':' -> '\\\\:', '@' -> '\\\\@', '/' -> '\\\\/', '\\' -> '\\\\\\\\'.
Example: ftp://username:password@hostname/\nftp://username@hostname/\nftp://hostname/
 
zmodemUse zmodem.

Example

import ca-cert "Corp VPN Cert" ftp ftp://ftp.myserver.local/cacert.crt

Syntax

import signed-cert <WORD> { ftp <FTP_URL> | zmodem }

Mode

Certificates

Description

Import CA Signed Certificate using Zmodem or FTP.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
ftpUse ftp.
<FTP_URL> FTP URL in the form: ftp://username:password@hostname/\n Escape character: ':' -> '\\\\:', '@' -> '\\\\@', '/' -> '\\\\/', '\\' -> '\\\\\\\\'.
Example: ftp://username:password@hostname/\nftp://username@hostname/\nftp://hostname/
 
zmodemUse zmodem.

Example

import signed-cert "Corp VPN Cert" ftp ftp://ftp.myserver.local/cert.crt

Syntax

import crl ca-name <WORD> [ disable-invalidate-certificates | invalidate-certificates ] [ directly { ftp <FTP_URL> | zmodem } | periodically <WEB_URL> ]

Mode

Certificates

Description

Import Certificate Revocation List using Zmodem or FTP or set the location to periodically download via HTTP.

Options

ca-nameCA certificate associated with CRL.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
disable-invalidate-certificatesDisable Invalidate Certificates and Security Associations if CRL import or processing fails.
 
invalidate-certificatesInvalidate Certificates and Security Associations if CRL import or processing fails.
 
directlyImport CRL directly from a PEM (.pem) or DER (.der or .crl) encoded file.
 
ftpUse ftp.
<FTP_URL> FTP URL in the form: ftp://username:password@hostname/\n Escape character: ':' -> '\\\\:', '@' -> '\\\\@', '/' -> '\\\\/', '\\' -> '\\\\\\\\'.
Example: ftp://username:password@hostname/\nftp://username@hostname/\nftp://hostname/
 
zmodemUse zmodem.
 
periodicallyPeriodically auto-import CRL via HTTP.
<WEB_URL> URL in the form: http://host/file.
Example: http://www.example.com/products/

Example

import crl ca-name "Corp CA Cert" directly ftp ftp://ftp.myserver.local/cert.crl

Syntax

no certificate <WORD>

Mode

Certificates

Description

Delete CA Certificate, Signing Request or Certificate / Key pair.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

no certificate "Corp VPN Cert"

Syntax

no certificates

Mode

Certificates

Description

Delete all imported CA Certificates, Signing Requests or Certificate / Key pairs.

Example

no certificates

Syntax

generate-signing-request

Mode

Certificates

Description

Enter Certificate Signing Request Configuration Mode.

Example

generate-signing-request

Syntax

scep

Mode

Certificates

Description

Enter SCEP Configuration Mode.

Example

scep

Syntax

alias <WORD>

Mode

Signing Request

Description

Configure Certificate Signing Request Alias.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

alias "MyCertAlias"

Syntax

distinguished-name element1 { country <WORD> | locality <WORD> | organization <WORD> | state <WORD> }

Mode

Signing Request

Description

Configure Certificate Signing Request Distinguished Name.

Options

 
countryCountry. Adds C=country-name to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
localityLocality, City, or County. Adds L=locality-name to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
organizationCompany or organization. Adds O=orgainization-name to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
stateState. Adds ST=state-name to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

distinguished-name element1 country US

Syntax

distinguished-name element2 { country <WORD> | department <WORD> | locality <WORD> | organization <WORD> | state <WORD> }

Mode

Signing Request

Description

Configure Certificate Signing Request Distinguished Name.

Options

 
countryCountry. Adds C=country-name to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
departmentDepartment. Adds OU=department-name to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
localityLocality, City, or County. Adds L=locality-name to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
organizationCompany or organization. Adds O=orgainization-name to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
stateState. Adds ST=state-name to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

distinguished-name element2 state CA

Syntax

distinguished-name element3 { department <WORD> | group <WORD> | locality <WORD> | organization <WORD> | team <WORD> }

Mode

Signing Request

Description

Configure Certificate Signing Request Distinguished Name.

Options

 
departmentDepartment. Adds OU=department-name to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
groupGroup. Adds OU=group-name to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
localityLocality, City, or County. Adds L=locality-name to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
organizationCompany or organization. Adds O=orgainization-name to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
teamTeam. Adds OU=team-name to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

distinguished-name element3 locality "San Jose"

Syntax

distinguished-name element4 { common-name <WORD> | department <WORD> | email <WORD> | group <WORD> | organization <WORD> | serial <WORD> | team <WORD> }

Mode

Signing Request

Description

Configure Certificate Signing Request Distinguished Name.

Options

 
common-nameCommon Name. Adds CN=common-name to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
departmentDepartment. Adds OU=department-name to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
emailE-mail Address. Adds Email=email-address to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
groupGroup. Adds OU=group-name to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
organizationCompany or organization. Adds O=orgainization-name to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
serialSerial Number. Adds SN=serial-number to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
teamTeam. Adds OU=team-name to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

distinguished-name element4 organization "My company"

Syntax

distinguished-name element5 { common-name <WORD> | department <WORD> | email <WORD> | group <WORD> | serial <WORD> | team <WORD> }

Mode

Signing Request

Description

Configure Certificate Signing Request Distinguished Name.

Options

 
common-nameCommon Name. Adds CN=common-name to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
departmentDepartment. Adds OU=department-name to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
emailE-mail Address. Adds Email=email-address to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
groupGroup. Adds OU=group-name to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
serialSerial Number. Adds SN=serial-number to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
teamTeam. Adds OU=team-name to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

distinguished-name element5 department "Department"

Syntax

distinguished-name element6 { common-name <WORD> | email <WORD> | group <WORD> | serial <WORD> | team <WORD> }

Mode

Signing Request

Description

Configure Certificate Signing Request Distinguished Name.

Options

 
common-nameCommon Name. Adds CN=common-name to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
emailE-mail Address. Adds Email=email-address to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
groupGroup. Adds OU=group-name to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
serialSerial Number. Adds SN=serial-number to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
teamTeam. Adds OU=team-name to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

distinguished-name element6 group "Group"

Syntax

distinguished-name element7 { common-name <WORD> | email <WORD> | serial <WORD> | team <WORD> }

Mode

Signing Request

Description

Configure Certificate Signing Request Distinguished Name.

Options

 
common-nameCommon Name. Adds CN=common-name to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
emailE-mail Address. Adds Email=email-address to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
serialSerial Number. Adds SN=serial-number to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
teamTeam. Adds OU=team-name to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

distinguished-name element7 team "Team"

Syntax

distinguished-name element8 { common-name <WORD> | email <WORD> | serial <WORD> }

Mode

Signing Request

Description

Configure Certificate Signing Request Distinguished Name.

Options

 
common-nameCommon Name. Adds CN=common-name to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
emailE-mail Address. Adds Email=email-address to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
serialSerial Number. Adds SN=serial-number to distinguished name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

distinguished-name element8 email admin@mycompany.local

Syntax

alternate-name { domain-name <HOSTNAME> | email-address <WORD> | ipv4-address <IPV4_HOST> }

Mode

Signing Request

Description

Configure Certificate Signing Request Alternate Name.

Options

 
domain-nameDomain Name.
<HOSTNAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com
 
email-addressE-mail Address.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
ipv4-addressIP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

alternate-name ipv4-address 10.10.10.10

Syntax

ca-url <WEB_URL>

Mode

SCEP

Description

Configure SCEP Certificate Authority URL.

Options

<WEB_URL> URL in the form: http://host/file.
Example: http://www.example.com/products/

Example

ca-url http://scep.mydomain.local

Syntax

challenge-password <WORD>

Mode

SCEP

Description

Configure SCEP Certificate Authority Challenge Password.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

challenge-password secret

Syntax

request-count <UINT16>

Mode

SCEP

Description

Configure SCEP Request Count.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

request-count 256

Syntax

polling-interval <UINT16>

Mode

SCEP

Description

Configure SCEP Polling Interval.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

polling-interval 30

Syntax

max-polling-time <UINT16>

Mode

SCEP

Description

Configure SCEP Max Polling Time.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

max-polling-time 28800

Syntax

high-availability

Mode

Config

Description

Enter high availability configuration mode.

Example

high-availability

Syntax

heartbeat-interval <UINT32>

Mode

High Availability

Description

Set heartbeat interval in milliseconds.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

heartbeat-interval 5000

Syntax

failover-trigger-level <UINT8>

Mode

High Availability

Description

Set failover trigger level (missed heartbeats).

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

failover-trigger-level 5

Syntax

probe interval <UINT8>

Mode

High Availability

Description

Set probe interval in seconds.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

probe interval 20

Syntax

probe count <UINT8>

Mode

High Availability

Description

Set probe count.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

probe count 3

Syntax

election-delay-time <UINT8>

Mode

High Availability

Description

Set election delay time in seconds.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

election-delay-time 3

Syntax

route-hold-down-time <UINT8>

Mode

High Availability

Description

Set dynamic route hold-down time in seconds.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

route-hold-down-time 3

Syntax

no route-hold-down-time

Mode

High Availability

Description

Clear dynamic route hold-down time.

Example

no route-hold-down-time

Syntax

failover-when-aggregate-down

Mode

High Availability

Description

Enable failover only when all aggregate links are down.

Example

failover-when-aggregate-down

Syntax

no failover-when-aggregate-down

Mode

High Availability

Description

Disable failover only when all aggregate links are down.

Example

no failover-when-aggregate-down

Syntax

enable node <VIRTUAL_GROUP_ID>

Mode

High Availability

Description

Enable specified ha cluster node.

Options

<VIRTUAL_GROUP_ID> Integer in the form: D OR 0xHH.
Example: 1

Example

enable node 2

Syntax

no enable node <VIRTUAL_GROUP_ID>

Mode

High Availability

Description

Disable specified ha cluster node.

Options

<VIRTUAL_GROUP_ID> Integer in the form: D OR 0xHH.
Example: 1

Example

no enable node 2

Syntax

include-certificates-keys

Mode

High Availability

Description

Enable include certificates and keys.

Example

include-certificates-keys

Syntax

no include-certificates-keys

Mode

High Availability

Description

Disable include certificates and keys.

Example

no include-certificates-keys

Syntax

synchronize settings

Mode

High Availability

Description

Synchronize settings.

Example

synchronize settings

Syntax

synchronize firmware

Mode

High Availability

Description

Synchronize firmware.

Example

synchronize firmware

Syntax

force-failover

Mode

High Availability

Description

Force HA active/standby failover.

Example

force-failover

Syntax

no mode

Mode

High Availability

Description

Disable high availability.

Example

no mode

Syntax

mode { active-active-clustering | active-active-clustering-dpi | active-active-dpi | active-standby }

Mode

High Availability

Description

Enable high availability and set high availability mode.

Options

 
active-active-clusteringActive-active clustering mode.
 
active-active-clustering-dpiActive-active clustering with DPI mode.
 
active-active-dpiActive-active DPI mode.
 
active-standbyActive-standby mode.

Example

mode active-standby

Syntax

primary-serial <MAC>

Mode

Active Standby

Active Active Dpi

Description

Set high availability primary serial number.

Options

<MAC> MAC address in the form: HH:HH:HH:HH:HH:HH OR HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD

Example

primary-serial 0017C5010203

Syntax

secondary-serial <MAC>

Mode

Active Standby

Active Active Dpi

Description

Set high availability secondary serial number.

Options

<MAC> MAC address in the form: HH:HH:HH:HH:HH:HH OR HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD

Example

secondary-serial 0017C5040506

Syntax

no secondary-serial

Mode

Active Standby

Active Active Dpi

Description

Clear high availability secondary serial number.

Example

no secondary-serial

Syntax

node-num <UINT8>

Mode

Active Active Clustering

Active Active Clustering Dpi

Description

Set active-active cluster node number (2-4).

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

node-num 3

Syntax

rank node <VIRTUAL_GROUP_ID> virtual-group <VIRTUAL_GROUP_ID> { none | owner | standby | standby2 | standby3 }

Mode

Active Active Clustering

Active Active Clustering Dpi

Description

Set the rank of ownership of virtual group for the node.

Options

<VIRTUAL_GROUP_ID> Integer in the form: D OR 0xHH.
Example: 1
virtual-groupVirtual group.
<VIRTUAL_GROUP_ID> Integer in the form: D OR 0xHH.
Example: 1
 
noneNo assignment.
 
ownerOwner.
 
standbyStandby.
 
standby2Standby2.
 
standby3Standby3.

Example

rank node 1 virtual-group 1 owner

Syntax

serial node <VIRTUAL_GROUP_ID> { primary | secondary } <MAC>

Mode

Active Active Clustering

Active Active Clustering Dpi

Description

Set active-active cluster node serial number..

Options

<VIRTUAL_GROUP_ID> Integer in the form: D OR 0xHH.
Example: 1
 
primaryPrimary serial number.
 
secondarySecondary serial number.
<MAC> MAC address in the form: HH:HH:HH:HH:HH:HH OR HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD

Example

serial node 2 primary 0017C5010203

Syntax

no serial node <VIRTUAL_GROUP_ID> { primary | secondary }

Mode

Active Active Clustering

Active Active Clustering Dpi

Description

Remove active-active cluster node serial number.

Options

<VIRTUAL_GROUP_ID> Integer in the form: D OR 0xHH.
Example: 1
 
primaryPrimary serial number.
 
secondarySecondary serial number.

Example

no serial node 2 primary

Syntax

stateful-synchronization

Mode

Active Standby

Active Active Clustering

Description

Enable stateful synchronization.

Example

stateful-synchronization

Syntax

no stateful-synchronization

Mode

Active Standby

Active Active Clustering

Description

Disable stateful synchronization.

Example

no stateful-synchronization

Syntax

dpi-interface <DPI_INTERFACE_ID> <HA_DATA_INTERFACE>

Mode

Active Active Dpi

Active Active Clustering Dpi

Description

Configure active/active DPI interface.

Options

<DPI_INTERFACE_ID> Integer in the form: D OR 0xHH.
Example: 1
<HA_DATA_INTERFACE> Interface name.
Example: X0

Example

dpi-interface 1 X5

Syntax

no dpi-interface <DPI_INTERFACE_ID>

Mode

Active Active Dpi

Active Active Clustering Dpi

Description

Clear active/active DPI interface.

Options

<DPI_INTERFACE_ID> Integer in the form: D OR 0xHH.
Example: 1

Example

no dpi-interface 1

Syntax

control-interface <HA_LINK_INTERFACE>

Mode

Active Standby

Active Active Dpi
Active Active Clustering
Active Active Clustering Dpi

Description

Configure HA control interface.

Options

<HA_LINK_INTERFACE> Interface name.
Example: X0

Example

control-interface X5

Syntax

no control-interface

Mode

Active Standby

Active Active Dpi
Active Active Clustering
Active Active Clustering Dpi

Description

Clear HA control interface.

Example

no control-interface

Syntax

data-interface <HA_DATA_INTERFACE>

Mode

Active Standby

Active Active Dpi
Active Active Clustering
Active Active Clustering Dpi

Description

Configure HA data interface.

Options

<HA_DATA_INTERFACE> Interface name.
Example: X0

Example

data-interface X5

Syntax

no data-interface

Mode

Active Standby

Active Active Dpi
Active Active Clustering
Active Active Clustering Dpi

Description

Clear HA data interface.

Example

no data-interface

Syntax

active-active-cluster-link <SVRRP_LINK> <HA_LINK_INTERFACE>

Mode

Active Active Clustering

Active Active Clustering Dpi

Description

Configure active/active cluster link.

Options

<SVRRP_LINK> Integer in the form: D OR 0xHH.
Example: 1
<HA_LINK_INTERFACE> Interface name.
Example: X0

Example

active-active-cluster-link X5

Syntax

no active-active-cluster-link <SVRRP_LINK>

Mode

Active Active Clustering

Active Active Clustering Dpi

Description

Clear active/active cluster link.

Options

<SVRRP_LINK> Integer in the form: D OR 0xHH.
Example: 1

Example

no active-active-cluster-link

Syntax

preempt

Mode

Active Standby

Active Active Dpi

Description

Enable preempt mode.

Example

preempt

Syntax

no preempt

Mode

Active Standby

Active Active Dpi

Description

Disable preempt mode.

Example

no preempt

Syntax

generate-backup-firmware

Mode

Active Standby

Active Active Dpi
Active Active Clustering
Active Active Clustering Dpi

Description

Enable generate/overwrite backup firmware and settings when upgrading firmware.

Example

generate-backup-firmware

Syntax

no generate-backup-firmware

Mode

Active Standby

Active Active Dpi
Active Active Clustering
Active Active Clustering Dpi

Description

Disable generate/overwrite backup firmware and settings when upgrading firmware.

Example

no generate-backup-firmware

Syntax

virtual-mac

Mode

Active Standby

Active Active Dpi

Description

Enable virtual MAC.

Example

virtual-mac

Syntax

no virtual-mac

Mode

Active Standby

Active Active Dpi

Description

Disable virtual MAC.

Example

no virtual-mac

Syntax

monitoring { [ ipv6 ] interface <HA_MONITOR_INTERFACE> | node <VIRTUAL_GROUP_ID> interface <HA_MONITOR_INTERFACE> }

Mode

High Availability

Description

Enter high availability monitoring configuration mode.

Options

 
ipv6High availability monitoring interface IPv6.
interfaceHigh availability monitoring interface.
<HA_MONITOR_INTERFACE> Physical interface name.
Example: X0
 
nodeSpecify the node.
<VIRTUAL_GROUP_ID> Integer in the form: D OR 0xHH.
Example: 1
interfaceHigh availability monitoring interface.
<HA_MONITOR_INTERFACE> Physical interface name.
Example: X0

Example

monitoring interface X1

Syntax

link-monitoring

Mode

High Availability Monitoring

High Availability Monitoring IPv6

Description

Enable physical/link monitoring.

Example

link-monitoring

Syntax

no link-monitoring

Mode

High Availability Monitoring

High Availability Monitoring IPv6

Description

Disable physical/link monitoring.

Example

no link-monitoring

Syntax

no primary

Mode

High Availability Monitoring

High Availability Monitoring IPv6

Description

Clear primary interface monitoring IP address.

Example

no primary

Syntax

primary <HOST_IP>

Mode

High Availability Monitoring

High Availability Monitoring IPv6

Description

Set primary interface monitoring IP address.

Options

<HOST_IP> IPV4: IPv4 host address in the form: D.D.D.D\nIPV6: IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n

Example

primary fe80::1001

primary 192.168.168.211

Syntax

no secondary

Mode

High Availability Monitoring

High Availability Monitoring IPv6

Description

Clear secondary interface monitoring IP address.

Example

no secondary

Syntax

secondary <HOST_IP>

Mode

High Availability Monitoring

High Availability Monitoring IPv6

Description

Set secondary interface monitoring IP address.

Options

<HOST_IP> IPV4: IPv4 host address in the form: D.D.D.D\nIPV6: IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n

Example

secondary fe80::1001

secondary 192.168.168.211

Syntax

allow-management

Mode

High Availability Monitoring

High Availability Monitoring IPv6

Description

Enable allow management on primary/secondary IP address.

Example

allow-management

Syntax

no allow-management

Mode

High Availability Monitoring

High Availability Monitoring IPv6

Description

Disable allow management on primary/secondary IP address.

Example

no allow-management

Syntax

logical-probe <HOST_IP>

Mode

High Availability Monitoring

High Availability Monitoring IPv6

Description

Enable logical/probe and set IP address.

Options

<HOST_IP> IPV4: IPv4 host address in the form: D.D.D.D\nIPV6: IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n

Example

logical-probe fe80::1001

logical-probe 192.168.168.211

Syntax

no logical-probe

Mode

High Availability Monitoring

High Availability Monitoring IPv6

Description

Disable logical/probe.

Example

no logical-probe

Syntax

override-virtual-mac <MAC>

Mode

High Availability Monitoring

High Availability Monitoring IPv6

Description

Enable override virtual MAC and set MAC.

Options

<MAC> MAC address in the form: HH:HH:HH:HH:HH:HH OR HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD

Example

override-virtual-mac 02:17:c5:01:02:03

Syntax

no override-virtual-mac

Mode

High Availability Monitoring

High Availability Monitoring IPv6

Description

Disable override virtual MAC.

Example

no override-virtual-mac

Syntax

link-monitoring

Mode

High Availability Clustering Monitoring

Description

Enable physical/link monitoring.

Example

link-monitoring

Syntax

no link-monitoring

Mode

High Availability Clustering Monitoring

Description

Disable physical/link monitoring.

Example

no link-monitoring

Syntax

no primary

Mode

High Availability Clustering Monitoring

Description

Clear primary interface monitoring IP address.

Example

no primary

Syntax

primary <IPV4_HOST>

Mode

High Availability Clustering Monitoring

Description

Set primary interface monitoring IP address.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

primary 192.168.168.211

Syntax

no secondary

Mode

High Availability Clustering Monitoring

Description

Clear secondary interface monitoring IP address.

Example

no secondary

Syntax

secondary <IPV4_HOST>

Mode

High Availability Clustering Monitoring

Description

Set secondary interface monitoring IP address.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

secondary 192.168.168.212

Syntax

allow-management

Mode

High Availability Clustering Monitoring

Description

Enable allow management on primary/secondary IP address.

Example

allow-management

Syntax

no allow-management

Mode

High Availability Clustering Monitoring

Description

Disable allow management on primary/secondary IP address.

Example

no allow-management

Syntax

logical-probe <IPV4_HOST>

Mode

High Availability Clustering Monitoring

Description

Enable logical/probe and set IP address.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

logical-probe 10.10.10.10

Syntax

no logical-probe

Mode

High Availability Clustering Monitoring

Description

Disable logical/probe.

Example

no logical-probe

Syntax

show high-availability [ monitoring [ ipv4 | ipv6 ] [ interface <HA_MONITOR_INTERFACE> ] | status ] [ { pending-config | with-pending-config } ] [ json | validate | xml ]

Mode

All Modes

Description

Show high availability configuration and status.

Options

 
monitoringShow high availability monitoring interface.
 
ipv4Show only IPv4 high availability monitoring interface.
 
ipv6Show only IPv6 high availability monitoring interface.
interfaceShow high availability monitoring interface.
<HA_MONITOR_INTERFACE> Physical interface name.
Example: X0
 
statusShow high availability status.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show high-availability

Syntax

export log { csv | txt } { ftp <FTP_URL> | zmodem }

Mode

Top Level

Description

Export log from the device using zmodem or FTP.

Options

 
csvCSV format.
 
txtText format.
 
ftpUse ftp.
<FTP_URL> FTP URL in the form: ftp://username:password@hostname/\n Escape character: ':' -> '\\\\:', '@' -> '\\\\@', '/' -> '\\\\/', '\\' -> '\\\\\\\\'.
Example: ftp://username:password@hostname/\nftp://username@hostname/\nftp://hostname/
 
zmodemUse zmodem.

Example

export log ftp ftp://ftp.myserver.local/log.wri

Syntax

clear log

Mode

All Modes (
excluding Top Level)

Description

Clear all log entries.

Example

clear log

Syntax

send log email

Mode

Config

Description

Send log to configured e-mail address.

Example

send log email

Syntax

log events-since { all-entries | last <UINT8> { days | hours | minutes } }

Mode

Config

Description

Configure events since for showing log view in CLI based current time.

Options

 
all-entriesAll entries.
 
lastLast time range.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
 
daysDays.
 
hoursHours.
 
minutesMinutes.

Example

log events-since last 5 minutes

Syntax

log event-id <LOG_EVENT_ID_FOR_ATTRIBUTES>

Mode

Config

Description

Enter log event configuration mode with specified event ID.

Options

<LOG_EVENT_ID_FOR_ATTRIBUTES> Event ID for showing the attributes.
Example: 123

Example

log event-id 440

Syntax

log category <LOG_CATEGORY_NAME> [ group <LOG_GROUP_NAME> [ event <LOG_EVENT_NAME> ] ]

Mode

Config

Description

Enter log category configuration mode.

Options

<LOG_CATEGORY_NAME> Log category name.
Example: Firewall
groupGroup configuration.
<LOG_GROUP_NAME> Group name.
Example: Firewall Event
eventEvent configuration.
<LOG_EVENT_NAME> Event name.
Example: Activate Firewall

Example

log category VPN

log category "Admin System" group GMS
log category Firewall group "Firewall Rule" event "Firewall Add"

Syntax

log categories

Mode

Config

Description

Enter log categories configuration mode.

Example

log categories

Syntax

log syslog

Mode

Config

Description

Enter syslog configuration mode.

Example

log syslog

Syntax

log automation

Mode

Config

Description

Enter log automation configuration mode.

Example

log automation

Syntax

log name-resolution

Mode

Config

Description

Enter log name resolution configuration mode.

Example

log name-resolution

Syntax

log reports

Mode

Config

Description

Enter log reports configuration mode.

Example

log reports

Syntax

log viewpoint

Mode

Config

Description

Enter viewpoint configuration mode.

Example

log viewpoint

Syntax

log analyzer

Mode

Config

Description

Enter analyzer configuration mode.

Example

log analyzer

Syntax

save-template <WORD>

Mode

Log Categories

Description

Save current log event settings in custom template.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

save-template "Current event log company specific default settings"

Syntax

import-template { analyzer-viewpoint-gms | custom | default | minimal }

Mode

Log Categories

Description

Set log event settings to what is specified in the template.

Options

 
analyzer-viewpoint-gmsSet event log settings to work well with analyzer / viewpoint / GMS server.
 
customSet event log settings to previously saved settings.
 
defaultRestore all event log settings to default values.
 
minimalSet event log settings so that a minimal amount of logs are created.

Example

import-template default

Syntax

reset event-count { all | category <LOG_CATEGORY_NAME> [ group <LOG_GROUP_NAME> [ event <LOG_EVENT_NAME> ] ] | event-id <LOG_EVENT_ID_FOR_ATTRIBUTES> }

Mode

Log Categories

Description

Reset the event counters for specified category.

Options

 
allAll categories.
 
categorySpecify category.
<LOG_CATEGORY_NAME> Log category name.
Example: Firewall
groupSpecify group.
<LOG_GROUP_NAME> Group name.
Example: Firewall Event
eventSpecify event.
<LOG_EVENT_NAME> Event name.
Example: Activate Firewall
 
event-idSpecify event ID.
<LOG_EVENT_ID_FOR_ATTRIBUTES> Event ID for showing the attributes.
Example: 123

Example

reset event-count all

reset event-count category VPN

Syntax

logging-level { alert | critical | debug | emergency | error | inform | notice | warning }

Mode

Log Categories

Description

Set global logging level.

Options

 
alertAlert.
 
criticalCritical.
 
debugDebug.
 
emergencyEmergency.
 
errorError.
 
informInform.
 
noticeNotice.
 
warningWarning.

Example

logging-level critical

Syntax

global-category-attribute

Mode

Log Categories

Description

Enter global category attributes configuration mode.

Example

global-category-attribute

Syntax

priority-level { alert | critical | debug | emergency | error | inform | mixed | notice | warning }

Mode

Log Categories Global Attributes

Description

Set priority level.

Options

 
alertAlert.
 
criticalCritical.
 
debugDebug.
 
emergencyEmergency.
 
errorError.
 
informInform.
 
mixedMixed.
 
noticeNotice.
 
warningWarning.

Example

priority-level critical

Syntax

gui [ mixed ] [ keep-original-redundancy-interval | redundancy-interval <UINT32> ]

Mode

Log Categories Global Attributes

Description

Enable display in GUI of categories and optionally set redundancy filter.

Options

mixedMixed.
 
keep-original-redundancy-intervalKeep original redundancy filter interval.
 
redundancy-intervalSet the redundancy interval in seconds.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

gui redundancy-interval 60

Syntax

no gui

Mode

Log Categories Global Attributes

Description

Disable display in GUI of categories.

Example

no gui

Syntax

alert [ mixed ] [ keep-original-redundancy-interval | redundancy-interval <UINT32> ]

Mode

Log Categories Global Attributes

Description

Enable alert of categories and optionally set redundancy filter.

Options

mixedMixed.
 
keep-original-redundancy-intervalKeep original redundancy filter interval.
 
redundancy-intervalSet the redundancy interval in seconds.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

alert redundancy-interval 60

Syntax

no alert

Mode

Log Categories Global Attributes

Description

Disable alert of categories.

Example

no alert

Syntax

syslog [ mixed ] [ keep-original-redundancy-interval | redundancy-interval <UINT32> ]

Mode

Log Categories Global Attributes

Description

Enable syslog of categories and optionally set redundancy filter.

Options

mixedMixed.
 
keep-original-redundancy-intervalKeep original redundancy filter interval.
 
redundancy-intervalSet the redundancy interval in seconds.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

syslog redundancy-interval 60

Syntax

no syslog

Mode

Log Categories Global Attributes

Description

Disable syslog of categories.

Example

no syslog

Syntax

email [ mixed ]

Mode

Log Categories Global Attributes

Description

Enable e-mail of categories.

Options

mixedMixed.

Example

email

Syntax

no email

Mode

Log Categories Global Attributes

Description

Disable e-mail of categories.

Example

no email

Syntax

color { black | blue | green | hex <HEX_UINT32> | keep-original | orange | purple | red | rgb <UINT8> <UINT8> <UINT8> | yellow }

Mode

Log Categories Global Attributes

Description

Set the color of the category to be displayed in the GUI.

Options

 
blackBlack.
 
blueBlue.
 
greenGreen.
 
hexHex representation.
<HEX_UINT32> Hexadecimal integer in the form: 0xHHHHHHHH.
Example: 0xaa55aa55
 
keep-originalKeep original color.
 
orangeOrange.
 
purplePurple.
 
redRed.
 
rgbRed, green, blue scale.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
 
yellowYellow.

Example

color black

color hex 0x00111333
color rgb 3 5 7

Syntax

default-log-email <EMAIL>

Mode

Log Categories Global Attributes

Description

Set global default e-mail address to send log to.

Options

<EMAIL> E-mail in the form: aaaaa@bbb.com.
Example: support@sonicwall.com

Example

default-log-email categoriesadmin@utm.local

Syntax

no default-log-email

Mode

Log Categories Global Attributes

Description

Clear global default e-mail address to send log to.

Example

no default-log-email

Syntax

send-to-email-address { keep-original | use-default }

Mode

Log Categories Global Attributes

Description

Keep original log e-mail address or use the default.

Options

 
keep-originalKeep original log e-mail address.
 
use-defaultUse the default log e-mail address.

Example

send-to-email-address keep-original

Syntax

default-alert-email <EMAIL>

Mode

Log Categories Global Attributes

Description

Set global default alert e-mail address to send alert to.

Options

<EMAIL> E-mail in the form: aaaaa@bbb.com.
Example: support@sonicwall.com

Example

alert-email address categoriesadmin@utm.local

Syntax

no default-alert-email

Mode

Log Categories Global Attributes

Description

Delete global default alert e-mail address to send alert to.

Example

no default-alert-email

Syntax

alert-email-address { keep-original | use-default }

Mode

Log Categories Global Attributes

Description

Keep original alert e-mail address or use the default.

Options

 
keep-originalKeep original alert e-mail address.
 
use-defaultUse the default alert e-mail address.

Example

alert-email-address keep-original

Syntax

priority-level { alert | critical | debug | emergency | error | inform | mixed | notice | warning }

Mode

Log Category

Description

Set priority level.

Options

 
alertAlert.
 
criticalCritical.
 
debugDebug.
 
emergencyEmergency.
 
errorError.
 
informInform.
 
mixedMixed.
 
noticeNotice.
 
warningWarning.

Example

priority-level critical

Syntax

gui [ mixed ] [ redundancy-interval <UINT32> ]

Mode

Log Category

Description

Enable display in GUI of category and optionally set redundancy filter.

Options

mixedCategories under this are of mixed settings.
redundancy-intervalSet the redundancy interval in seconds.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

gui redundancy-interval 60

gui mixed redundancy-interval 90
gui mixed

Syntax

no gui

Mode

Log Category

Description

Disable display in GUI of category.

Example

no gui

Syntax

alert [ mixed ] [ redundancy-interval <UINT32> ]

Mode

Log Category

Description

Enable alert of category and optionally set redundancy filter.

Options

mixedCategories under this are of mixed settings.
redundancy-intervalSet the redundancy interval in seconds.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

alert redundancy-interval 60

Syntax

no alert

Mode

Log Category

Description

Disable alert of category.

Example

no alert

Syntax

syslog [ mixed ] [ redundancy-interval <UINT32> ]

Mode

Log Category

Description

Enable syslog of category and optionally set redundancy filter.

Options

mixedCategories under this are of mixed settings.
redundancy-intervalSet the redundancy interval in seconds.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

syslog redundancy-interval 60

Syntax

no syslog

Mode

Log Category

Description

Disable syslog of category.

Example

no syslog

Syntax

email [ mixed ]

Mode

Log Category

Description

Enable e-mail of category.

Options

mixedCategories under this are of mixed settings.

Example

email

Syntax

no email

Mode

Log Category

Description

Disable e-mail of category.

Example

no email

Syntax

color { black | blue | green | hex <HEX_UINT32> | keep-original | orange | purple | red | rgb <UINT8> <UINT8> <UINT8> | yellow }

Mode

Log Category

Description

Set the color of the category to be displayed in the GUI.

Options

 
blackBlack.
 
blueBlue.
 
greenGreen.
 
hexHex representation.
<HEX_UINT32> Hexadecimal integer in the form: 0xHHHHHHHH.
Example: 0xaa55aa55
 
keep-originalKeep original.
 
orangeOrange.
 
purplePurple.
 
redRed.
 
rgbRed, green, blue scale.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
 
yellowYellow.

Example

color black

color keep-original
color hex 0x00111333
color rgb 3 5 7

Syntax

log-email <EMAIL>

Mode

Log Category

Description

Set e-mail address to send log of this category to.

Options

<EMAIL> E-mail in the form: aaaaa@bbb.com.
Example: support@sonicwall.com

Example

log-email categoryadmin@utm.local

Syntax

no log-email

Mode

Log Category

Description

Clear e-mail address to send log of this category to.

Example

no log-email

Syntax

alert-email { address <EMAIL> | keep-original }

Mode

Log Category

Description

Set alert e-mail address to send category to.

Options

 
addressSpecify the alert e-mail address.
<EMAIL> E-mail in the form: aaaaa@bbb.com.
Example: support@sonicwall.com
 
keep-originalKeep the original setting for children categories.

Example

alert-email address categoryadmin@utm.local

Syntax

no alert-email

Mode

Log Category

Description

Clear e-mail address to send alert of this category to.

Example

no alert-email

Syntax

priority-level { alert | critical | debug | emergency | error | inform | mixed | notice | warning }

Mode

Log Group

Description

Set priority level.

Options

 
alertAlert.
 
criticalCritical.
 
debugDebug.
 
emergencyEmergency.
 
errorError.
 
informInform.
 
mixedMixed.
 
noticeNotice.
 
warningWarning.

Example

priority-level critical

Syntax

gui [ mixed ] [ redundancy-interval <UINT32> ]

Mode

Log Group

Description

Enable display in GUI of group and optionally set redundancy filter.

Options

mixedCategories under this are of mixed settings.
redundancy-intervalSet the redundancy interval in seconds.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

gui redundancy-interval 60

gui mixed redundancy-interval 90
gui mixed

Syntax

no gui

Mode

Log Group

Description

Disable display in GUI of group.

Example

no gui

Syntax

alert [ mixed ] [ redundancy-interval <UINT32> ]

Mode

Log Group

Description

Enable alert of group and optionally set redundancy filter.

Options

mixedCategories under this are of mixed settings.
redundancy-intervalSet the redundancy interval in seconds.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

alert redundancy-interval 60

Syntax

no alert

Mode

Log Group

Description

Disable alert of group.

Example

no alert

Syntax

syslog [ mixed ] [ redundancy-interval <UINT32> ]

Mode

Log Group

Description

Enable syslog of group and optionally set redundancy filter.

Options

mixedCategories under this are of mixed settings.
redundancy-intervalSet the redundancy interval in seconds.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

syslog redundancy-interval 60

Syntax

no syslog

Mode

Log Group

Description

Disable syslog of group.

Example

no syslog

Syntax

email [ mixed ]

Mode

Log Group

Description

Enable e-mail of group.

Options

mixedCategories under this are of mixed settings.

Example

email

Syntax

no email

Mode

Log Group

Description

Disable e-mail of group.

Example

no email

Syntax

color { black | blue | green | hex <HEX_UINT32> | keep-original | orange | purple | red | rgb <UINT8> <UINT8> <UINT8> | yellow }

Mode

Log Group

Description

Set the color of the group to be displayed in the GUI.

Options

 
blackBlack.
 
blueBlue.
 
greenGreen.
 
hexHex representation.
<HEX_UINT32> Hexadecimal integer in the form: 0xHHHHHHHH.
Example: 0xaa55aa55
 
keep-originalKeep original.
 
orangeOrange.
 
purplePurple.
 
redRed.
 
rgbRed, green, blue scale.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
 
yellowYellow.

Example

color black

color hex 0x00111333
color rgb 3 5 7

Syntax

alert-email { address <EMAIL> | keep-original }

Mode

Log Group

Description

Set alert e-mail address to send group to.

Options

 
addressSpecify the alert e-mail address.
<EMAIL> E-mail in the form: aaaaa@bbb.com.
Example: support@sonicwall.com
 
keep-originalKeep the original setting for children categories.

Example

alert-email address groupadmin@utm.local

Syntax

no alert-email

Mode

Log Group

Description

Clear e-mail address to send alert of this group to.

Example

no alert-email

Syntax

priority-level { alert | critical | debug | emergency | error | inform | notice | warning }

Mode

Log Event

Description

Set priority level.

Options

 
alertAlert.
 
criticalCritical.
 
debugDebug.
 
emergencyEmergency.
 
errorError.
 
informInform.
 
noticeNotice.
 
warningWarning.

Example

priority-level critical

Syntax

gui [ redundancy-interval <UINT32> ]

Mode

Log Event

Description

Enable display in GUI of event and optionally set redundancy filter.

Options

redundancy-intervalSet the redundancy interval in seconds.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

gui redundancy-interval 60

gui

Syntax

no gui

Mode

Log Event

Description

Disable display in GUI of event.

Example

no gui

Syntax

alert [ redundancy-interval <UINT32> ]

Mode

Log Event

Description

Enable alert of event and optionally set redundancy filter.

Options

redundancy-intervalSet the redundancy interval in seconds.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

alert redundancy-interval 60

Syntax

no alert

Mode

Log Event

Description

Disable alert of event.

Example

no alert

Syntax

syslog [ redundancy-interval <UINT32> ]

Mode

Log Event

Description

Enable syslog of event and optionally set redundancy filter.

Options

redundancy-intervalSet the redundancy interval in seconds.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

syslog redundancy-interval 60

Syntax

no syslog

Mode

Log Event

Description

Disable syslog of event.

Example

no syslog

Syntax

email

Mode

Log Event

Description

Enable e-mail of event.

Example

email

Syntax

no email

Mode

Log Event

Description

Disable e-mail of event.

Example

no email

Syntax

color { black | blue | green | hex <HEX_UINT32> | orange | purple | red | rgb <UINT8> <UINT8> <UINT8> | yellow }

Mode

Log Event

Description

Set the color of the event to be displayed in the GUI.

Options

 
blackBlack.
 
blueBlue.
 
greenGreen.
 
hexHex representation.
<HEX_UINT32> Hexadecimal integer in the form: 0xHHHHHHHH.
Example: 0xaa55aa55
 
orangeOrange.
 
purplePurple.
 
redRed.
 
rgbRed, green, blue scale.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
 
yellowYellow.

Example

color black

color hex 0x00111333
color rgb 3 5 7

Syntax

alert-email address <EMAIL>

Mode

Log Event

Description

Set alert e-mail address to send event to.

Options

addressSpecify the alert e-mail address.
<EMAIL> E-mail in the form: aaaaa@bbb.com.
Example: support@sonicwall.com

Example

alert-email address eventadmin@utm.local

Syntax

no alert-email

Mode

Log Event

Description

Clear e-mail address to send alert of this event to.

Example

no alert-email

Syntax

facility { authpriv-messages | clock-daemon-linux-bsd | clock-daemon-solaris | ftp-daemon | generated-internally | kernel | line-printer-subsystem | local-use0 | local-use1 | local-use2 | local-use3 | local-use4 | local-use5 | local-use6 | local-use7 | log-alert | log-audit | mail-system | network-news-subsystem | ntp-subsystem | security-authorization-messages | system-daemons | user-level-messages | uucp-subsystem }

Mode

Syslog

Description

Set syslog facility.

Options

 
authpriv-messagesAUTHPRIV security/authorization messages.
 
clock-daemon-linux-bsdClock daemon (BSP,Linux).
 
clock-daemon-solarisClock daemon (solaris).
 
ftp-daemonFTP daemon.
 
generated-internallyMessages generated internally by syslogd.
 
kernelKernel.
 
line-printer-subsystemLine printer subsystem.
 
local-use0Local use 0.
 
local-use1Local use 1.
 
local-use2Local use 2.
 
local-use3Local use 3.
 
local-use4Local use 4.
 
local-use5Local use 5.
 
local-use6Local use 6.
 
local-use7Local use 7.
 
log-alertLog alert.
 
log-auditLog audit.
 
mail-systemMail system.
 
network-news-subsystemNetwork news subsystem.
 
ntp-subsystemNTP subsystem.
 
security-authorization-messagesSecurity/authorization messages.
 
system-daemonsSystem daemons.
 
user-level-messagesUser-level messages.
 
uucp-subsystemUUCP subsystem.

Example

log-level critical

Syntax

override

Mode

Syslog

Description

Enable override of syslog settings with analyzer/viewpoint settings.

Example

override

Syntax

no override

Mode

Syslog

Description

Disable override syslog settings with analyzer/viewpoint settings.

Example

no override

Syntax

format { arcSight | default | enhanced-syslog | webtrends }

Mode

Syslog

Description

Set syslog format.

Options

 
arcSightArcsight format.
 
defaultDefault format.
 
enhanced-syslogEnhanced syslog format.
 
webtrendsWebtrends format.

Example

format default

Syntax

event-rate-limiting <UINT16>

Mode

Syslog

Description

Enable syslog event rate limiting and set maximum events per second.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

event-rate-limiting 1000

Syntax

no event-rate-limiting

Mode

Syslog

Description

Disable syslog event rate limiting and set maximum events per second.

Example

no event-rate-limiting

Syntax

data-rate-limiting <UINT32>

Mode

Syslog

Description

Enable syslog data rate limiting and set maximum events per second.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

data-rate-limiting 100000000

Syntax

no data-rate-limiting

Mode

Syslog

Description

Disable syslog data rate limiting and set maximum events per second.

Example

no data-rate-limiting

Syntax

ndpp

Mode

Syslog

Description

Enable NDPP enforcement for syslog server.

Example

ndpp

Syntax

no ndpp

Mode

Syslog

Description

Disable NDPP enforcement for syslog server.

Example

no ndpp

Syntax

server { fqdn <ADDR_FQDN> | host <ADDR_HOST> | name <ADDR_FQDNHOST_ADDR> } port <UINT32> [ outbound-interface <VPN_SITE_TUNNEL_POLICY_NAME> [ local-interface <SYSLOG_SERVER_LOCAL_INTERFACE> ] ]

Mode

Syslog

Analyzer
Viewpoint

Description

Add/edit syslog server.

Options

 
fqdnAddress object full qualified domain name (FQDN).
<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
hostAddress object host
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name
<ADDR_FQDNHOST_ADDR> FQDN/host address object name.
Example: Web Server
portserver port.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123
outbound-interfaceOutbound interface.
<VPN_SITE_TUNNEL_POLICY_NAME> Site-to-site or tunnel interface VPN policy name.
Example: Remote Office
local-interfaceLocal interface.
<SYSLOG_SERVER_LOCAL_INTERFACE> Syslog server local interface name.
Example: X1

Example

server name "Syslog Server Public" port 514

server host 10.10.10.10 port 514
server host 10.10.10.10 port 514 outbound-interface "Remote Office"
server host 10.10.10.10 port 514 outbound-interface "Remote Office" local-interface X1

Syntax

no server <SYSLOG_SERVER> port <SYSLOG_SERVER_PORT>

Mode

Syslog

Analyzer
Viewpoint

Description

Delete syslog server.

Options

<SYSLOG_SERVER> Syslog custom server in the form: hostname OR a.b.c.d.
Example: example.com
portserver port.
<SYSLOG_SERVER_PORT> Syslog custom server port.
Example: 80

Example

no server 10.10.10.10 port 514

Syntax

no servers

Mode

Syslog

Analyzer
Viewpoint

Description

Delete all syslog servers.

Example

no servers

Syntax

server { fqdn <ADDR_FQDN> | host <ADDR_HOST> | name <ADDR_FQDNHOST_ADDR> }

Mode

Syslog Server

Description

configure the syslog server name.

Options

 
fqdnAddress object full qualified domain name (FQDN).
<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
hostAddress object host
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name
<ADDR_FQDNHOST_ADDR> FQDN/host address object name.
Example: Web Server

Example

server name "Syslog Server Public"

server host 10.10.10.10
server fqdn "*.example.com"

Syntax

port <UINT32>

Mode

Syslog Server

Description

configure the syslog server port.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

port 514

Syntax

outbound-interface <VPN_SITE_TUNNEL_POLICY_NAME>

Mode

Syslog Server

Description

Set the outbound interface.

Options

<VPN_SITE_TUNNEL_POLICY_NAME> Site-to-site or tunnel interface VPN policy name.
Example: Remote Office

Example

outbound-interface "Remote Office"

Syntax

no outbound-interface

Mode

Syslog Server

Description

Clear the outbound interface.

Example

no outbound-interface

Syntax

local-interface <SYSLOG_SERVER_LOCAL_INTERFACE>

Mode

Syslog Server

Description

Set the local interface.

Options

<SYSLOG_SERVER_LOCAL_INTERFACE> Syslog server local interface name.
Example: X1

Example

local-interface X2

Syntax

no local-interface

Mode

Syslog Server

Description

Clear the local interface.

Example

no local-interface

Syntax

log-email-address <EMAIL>

Mode

Log Automation

Description

Set E-mail address to send log to.

Options

<EMAIL> E-mail in the form: aaaaa@bbb.com.
Example: support@sonicwall.com

Example

log-email-address admin@somedomain.com

Syntax

no log-email-address

Mode

Log Automation

Description

Clear E-mail address to send log to.

Example

no log-email-address

Syntax

alert-email-address <EMAIL>

Mode

Log Automation

Description

Set E-mail address to send alert to.

Options

<EMAIL> E-mail in the form: aaaaa@bbb.com.
Example: support@sonicwall.com

Example

alert-email-address admin@somedomain.com

Syntax

no alert-email-address

Mode

Log Automation

Description

Clear E-mail address to send alert to.

Example

no alert-email-address

Syntax

send-log { { daily hour <UINT8> minute <UINT8> | weekly { fri | mon | sat | sun | thu | tue | wed } hour <UINT8> minute <UINT8> | when-full } }

Mode

Log Automation

Description

Specify when to send log.

Options

 
dailyDaily.
hourHour.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
minuteMinute.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
 
weeklyWeekly.
 
friDay of the week.
 
monDay of the week.
 
satDay of the week.
 
sunDay of the week.
 
thuDay of the week.
 
tueDay of the week.
 
wedDay of the week.
hourHour.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
minuteMinute.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
 
when-fullWhen full.

Example

send-log weekly mon hour 07 minute 30

Syntax

email-format { attachment csv | html | plain-text }

Mode

Log Automation

Description

Specify e-mail format.

Options

 
attachmentAttachment.
csvCSV.
 
htmlHTML.
 
plain-textPlain text.

Example

email-format plain-text

Syntax

include-all-log-information

Mode

Log Automation

Description

Include all log information.

Example

include-all-log-information

Syntax

no include-all-log-information

Mode

Log Automation

Description

Include default log information.

Example

no include-all-log-information

Syntax

health-check-email { address <EMAIL> | body <WORD> | schedule { days <SCHED_DAYS> time <SCHED_TIME_BEGIN> <SCHED_TIME_END> | name <SCHED_NAME> } | subject <WORD> }

Mode

Log Automation

Description

Edit health check E-mail settings.

Options

 
addressSet the health check E-mail address.
<EMAIL> E-mail in the form: aaaaa@bbb.com.
Example: support@sonicwall.com
 
bodySet the health check E-mail body.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
scheduleEnable E-mail health check and select a schedule.
 
daysSchedule object days.
<SCHED_DAYS> Days of the week in the form: SU-M-T-W-TH-F-SA.
Example: SU-M-TH-SA
timeSchedule object beginning/ending time.
<SCHED_TIME_BEGIN> Time in the form: DD:DD.
Example: 12:00
<SCHED_TIME_END> Time in the form: DD:DD.
Example: 12:00
 
nameSchedule object name.
<SCHED_NAME> Schedule object name.
Example: Work Hours
 
subjectSet the health check E-mail subject.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

health-check-email schedule name "Work Hours"

Syntax

no health-check-email { address | body | schedule | subject }

Mode

Log Automation

Description

Clear health check E-mail settings.

Options

 
addressClear the health check E-mail address.
 
bodyClear the health check E-mail body.
 
scheduleDisable E-mail health check.
 
subjectClear the health check E-mail subject.

Example

no health-check-email schedule

Syntax

mail-server <HOSTNAME>

Mode

Log Automation

Description

Set mail server IP address or hostname.

Options

<HOSTNAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com

Example

mail-server 192.168.168.204

Syntax

no mail-server

Mode

Log Automation

Description

Clear mail server IP address or hostname.

Example

no mail-server

Syntax

mail-from <EMAIL>

Mode

Log Automation

Description

Set E-mail address to mail from.

Options

<EMAIL> E-mail in the form: aaaaa@bbb.com.
Example: support@sonicwall.com

Example

mail-from admin@nsa5000

Syntax

no mail-from

Mode

Log Automation

Description

Clear E-mail address to mail from.

Example

no mail-from

Syntax

authentication-method { { none | pop-before-smtp } }

Mode

Log Automation

Description

Specify e-mail server authentication method.

Options

 
noneNo authentication.
 
pop-before-smtpPop before SMTP.

Example

authentication-method pop-before-smtp

Syntax

pop3-server <HOSTNAME>

Mode

Log Automation

Description

POP3 server IP address or hostname.

Options

<HOSTNAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com

Example

pop3-server 2.2.2.2

Syntax

no pop3-server

Mode

Log Automation

Description

Clear POP3 server IP address or hostname.

Example

no pop3-server

Syntax

pop3-user-name <WORD>

Mode

Log Automation

Description

Specify username for authentication.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

pop3-user-name user

Syntax

no pop3-user-name

Mode

Log Automation

Description

Clear specify username for authentication.

Example

no pop3-user-name

Syntax

pop3-password <ENC_PASSWORD>

Mode

Log Automation

Description

Specify password for authentication.

Options

<ENC_PASSWORD> Password.
Example: secret

Example

pop3-password 123

Syntax

no pop3-password

Mode

Log Automation

Description

Clear specify password for authentication.

Example

no pop3-password

Syntax

mail-server-advanced

Mode

Log Automation

Description

Enter mail server advanced mode.

Example

mail-server-advanced

Syntax

smtp-port <IPV4_PORT>

Mode

Mail Server Advanced

Description

Set E-mail server SMTP TCP port.

Options

<IPV4_PORT> Integer in the form: D OR 0xHHHH.
Example: 80

Example

smtp-port 4025

Syntax

connection-security-method { ssl-tls | start-tls }

Mode

Mail Server Advanced

Description

Select a connection security method.

Options

 
ssl-tlsSSL/TLS.
 
start-tlsSTARTTLS.

Example

connection-security-method ssl-tls

Syntax

no connection-security-method

Mode

Mail Server Advanced

Description

Disable connection security method.

Example

no connection-security-method

Syntax

smtp-authentication

Mode

Mail Server Advanced

Description

Enable SMTP authentication.

Example

smtp-authentication

Syntax

no smtp-authentication

Mode

Mail Server Advanced

Description

Disable SMTP authentication.

Example

no smtp-authentication

Syntax

user-name <WORD>

Mode

Mail Server Advanced

Description

Specify username for authentication.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

user-name mailadmin

Syntax

no user-name

Mode

Mail Server Advanced

Description

Clear username for authentication.

Example

no user-name

Syntax

password <ENC_PASSWORD>

Mode

Mail Server Advanced

Description

Specify password for authentication.

Options

<ENC_PASSWORD> Password.
Example: secret

Example

password mailadmin

Syntax

no password

Mode

Mail Server Advanced

Description

Clear password for authentication.

Example

no password

Syntax

solera server { fqdn <ADDR_FQDN> | host <ADDR_HOST> | name <ADDR_FQDNHOST_ADDR> }

Mode

Log Automation

Description

Enable solera capture stack integration,enter configuration mode and set solera server.

Options

 
fqdnSet the solera server to fqdn address.
<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
hostSet the solera server to host address.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameSet the solera server as named address object.
<ADDR_FQDNHOST_ADDR> FQDN/host address object name.
Example: Web Server

Example

solera server host 192.168.168.198

Syntax

no solera

Mode

Log Automation

Description

Disable solera capture stack integration and enter configuration mode.

Example

no solera

Syntax

protocol { http | https }

Mode

Solera

Description

Set solera server protocol.

Options

 
httpHTTP.
 
httpsHTTPS.

Example

protocol https

Syntax

port <IPV4_PORT>

Mode

Solera

Description

Set solera port.

Options

<IPV4_PORT> Integer in the form: D OR 0xHHHH.
Example: 80

Example

port 54443

Syntax

user <WORD>

Mode

Solera

Description

Set solera user.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

user mysolerauser

Syntax

password <ENC_PASSWORD> confirm-password <ENC_PASSWORD>

Mode

Solera

Description

Set solera password.

Options

<ENC_PASSWORD> Password.
Example: secret
confirm-passwordConfirm solera password.
<ENC_PASSWORD> Password.
Example: secret

Example

password mysolerapassword

Syntax

deepsee-base-url <URL>

Mode

Solera

Description

Set deepsee base URL.

Options

<URL> URL in the form: http://host/file.
Example: http://www.example.com/products/

Example

deepsee-base-url https://$host:$port/ws/pcap?user=$usr&password=$pwd&method=deepsee&start=$start&stop=$stop&ipproto=$ipproto&srcip=$srcip&dstip=$dstip&srcport=$srcport&dstport=$dstport

Syntax

pcap-base-url <URL>

Mode

Solera

Description

Set PCAP base URL.

Options

<URL> URL in the form: http://host/file.
Example: http://www.example.com/products/

Example

pcap-base-url https://$host:$port/ws/pcap?user=$usr&password=$pwd&method=filename&start=$start&stop=$stop&ipproto=$ipproto&srcip=$srcip&dstip=$dstip&srcport=$srcport&dstport=$dstport

Syntax

address-to-link { lan | wan }

Mode

Solera

Description

Set default zone for address to link from email alerts.

Options

 
lanDefault LAN
 
wanDefault WAN

Example

address-to-link wan

Syntax

method { dns | dns-then-netbios | netbios | none }

Mode

Log Name Resolution

Description

Set name resolution method.

Options

 
dnsDNS.
 
dns-then-netbiosDNS then NetBIOS.
 
netbiosNetBIOS.
 
noneNone.

Example

method dns

Syntax

dns { inherit | primary <IPV4_HOST> | secondary <IPV4_HOST> | tertiary <IPV4_HOST> }

Mode

Log Name Resolution

Description

Set whether DNS is inherited or set manually with the associated DNS server IP addresses.

Options

 
inheritInherit DNS servers.
 
primarySpecify primary DNS server IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
 
secondarySpecify secondary DNS server IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
 
tertiarySpecify tertiary DNS server IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

dns primary 192.168.168.165

Syntax

no dns { primary | secondary | tertiary }

Mode

Log Name Resolution

Description

Manually clear DNS server IP address.

Options

 
primaryClear primary DNS server IP address.
 
secondaryClear secondary DNS server IP address.
 
tertiaryClear tertiary DNS server IP address.

Example

no dns primary

Syntax

start

Mode

Log Reports

Description

Start data collection.

Example

start

Syntax

stop

Mode

Log Reports

Description

Stop data collection.

Example

stop

Syntax

report-view { bandwidth-usage-by-ip | bandwidth-usage-by-service | web-site-hits }

Mode

Log Reports

Description

Set reports view.

Options

 
bandwidth-usage-by-ipBandwidth usage by IP address.
 
bandwidth-usage-by-serviceBandwidth usage by service.
 
web-site-hitsWeb site hits.

Example

report-view web-site-hits

Syntax

show report

Mode

Log Reports

Description

Show log report.

Options

reportShow log report.

Example

show report

Syntax

enable

Mode

Viewpoint

Description

Enable viewpoint settings.

Example

enable

Syntax

no enable

Mode

Viewpoint

Description

Disable viewpoint settings.

Example

no enable

Syntax

enable

Mode

Analyzer

Description

Enable analyzer settings.

Example

enable

Syntax

no enable

Mode

Analyzer

Description

Disable analyzer settings.

Example

no enable

Syntax

show log [ analyzer | automation | categories [ [ attributes [ [ category <LOG_CATEGORY_NAME> [ group <LOG_GROUP_NAME> [ event <LOG_EVENT_NAME> ] ] | event-id <LOG_EVENT_ID_FOR_ATTRIBUTES> ] ] | global-category-attributes | statistics [ category-level <LOG_CATEGORY_BRANCH_LEVEL> ] [ id <INT32> ] [ name <WORD> ] ] ] | events-since | name-resolution | syslog | view [ id <LOG_EVENT_ID_FOR_ATTRIBUTES> ] [ category <LOG_CATEGORY_NAME> ] [ priority <LOG_EVENT_PRIORITY> ] [ source-interface <LOG_INTERFACE_NAME> ] [ destination-interface <LOG_INTERFACE_NAME> ] [ source-ip <IP_V4V6_HOST> ] [ source-port <UINT16> ] [ destination-ip <IP_V4V6_HOST> ] [ destination-port <UINT16> ] [ ip-protocol <WORD> ] [ user-name <WORD> ] [ application <WORD> ] | view-status | viewpoint ] [ { pending-config | with-pending-config } ] [ json | validate | xml ]

Mode

All Modes

Description

Show device log and configuration.

Options

 
analyzerShow analyzer settings.
 
automationShow log automation settings.
 
categoriesShow log categories configuration.
 
attributesShow log categories event attributes which have been changed.
 
categoryShow log attributes with specified category name.
<LOG_CATEGORY_NAME> Log category name.
Example: Firewall
groupShow log attributes with specified group name.
<LOG_GROUP_NAME> Group name.
Example: Firewall Event
eventShow log attributes with specified event name.
<LOG_EVENT_NAME> Event name.
Example: Activate Firewall
 
event-idShow log event attributes with specified ID.
<LOG_EVENT_ID_FOR_ATTRIBUTES> Event ID for showing the attributes.
Example: 123
 
global-category-attributesShow global category attributes.
 
statisticsShow log categories event statistics.
category-levelShow event statistics of specified category level: category, group or event.
<LOG_CATEGORY_BRANCH_LEVEL> Log category branch level.
Example: Category
idShow event statistics by event ID.
<INT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123
nameShow statistics by the name of a category, group or event.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
events-sinceShow events time range for showing log view in CLI based current time.
 
name-resolutionShow name resolution settings.
 
syslogShow syslog settings.
 
viewShow system log.
idShow log with specified ID.
<LOG_EVENT_ID_FOR_ATTRIBUTES> Event ID for showing the attributes.
Example: 123
categoryShow log with specified category.
<LOG_CATEGORY_NAME> Log category name.
Example: Firewall
priorityShow log with specified priority.
<LOG_EVENT_PRIORITY> Event priority.
Example: Notice
source-interfaceShow log with specified source interface.
<LOG_INTERFACE_NAME> Interface name.
Example: X0
destination-interfaceShow log with specified destination interface.
<LOG_INTERFACE_NAME> Interface name.
Example: X0
source-ipShow log with specified source-ip.
<IP_V4V6_HOST> IPV4: address in the form: D.D.D.D\nIPV6: address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: 2001:cdba:0000:0000:0000:0000:3257:9652
source-portShow log with specified source-port.
<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123
destination-ipShow log with specified destination-ip.
<IP_V4V6_HOST> IPV4: address in the form: D.D.D.D\nIPV6: address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: 2001:cdba:0000:0000:0000:0000:3257:9652
destination-portShow log with specified destination-port.
<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123
ip-protocolShow log with specified IP protocol.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
user-nameShow log with specified user name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
applicationShow log with specified application.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
view-statusShow system log status.
 
viewpointShow viewpoint settings.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show log

show log view
show log categories
show log categories statistics category-level Category
show log syslog

Syntax

voip

Mode

Config

Description

Enter VoIP configuration mode.

Example

voip

Syntax

flush-all

Mode

VoIP

Description

Flush all VoIP call entry.

Example

flush-all

Syntax

consistent-nat

Mode

VoIP

Description

Enable consistent nat.

Example

consistent-nat

Syntax

no consistent-nat

Mode

VoIP

Description

Disable consistent nat.

Example

no consistent-nat

Syntax

sip

Mode

VoIP

Description

Enable SIP transformations and enter its configuration mode.

Example

sip

Syntax

no sip

Mode

VoIP

Description

Disable SIP transformations.

Example

no sip

Syntax

h323

Mode

VoIP

Description

Enable H.323 transformations and enter its configuration mode.

Example

h323

Syntax

no h323

Mode

VoIP

Description

Disable H.323 transformations.

Example

no h323

Syntax

non-sip-packets

Mode

SIP

Description

Enable permit non-SIP packets on signaling port.

Example

non-sip-packets

Syntax

no non-sip-packets

Mode

SIP

Description

Disable permit non-SIP packets on signaling port.

Example

no non-sip-packets

Syntax

b2bua-support

Mode

SIP

Description

Enable SIP back-to-back user agent (B2BUA) support.

Example

b2bua-support

Syntax

no b2bua-support

Mode

SIP

Description

Disable SIP back-to-back user agent (B2BUA) support.

Example

no b2bua-support

Syntax

signaling-timeout <UINT32>

Mode

SIP

Description

Set SIP signaling inactivity time out (seconds).

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

signaling-timeout 1800

Syntax

media-timeout <UINT16>

Mode

SIP

Description

Set SIP media inactivity time out (seconds).

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

media-timeout 120

Syntax

no signaling-port

Mode

SIP

Description

Clear additional SIP signaling port (UDP) for transformations (optional).

Example

no signaling-port

Syntax

signaling-port <UINT16>

Mode

SIP

Description

Set additional SIP signaling port (UDP) for transformations (optional).

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

signaling-port 45060

Syntax

only-gatekeeper-calls

Mode

H323

Description

Enable only accept incoming calls from gatekeeper.

Example

only-gatekeeper-calls

Syntax

no only-gatekeeper-calls

Mode

H323

Description

Disable only accept incoming calls from gatekeeper.

Example

no only-gatekeeper-calls

Syntax

inactivity-timeout <UINT32>

Mode

H323

Description

Set H.323 signaling/media inactivity time out (seconds).

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

inactivity-timeout 300

Syntax

no gatekeeper-ip

Mode

H323

Description

Clear default wan/dmz gatekeeper IP address.

Example

no gatekeeper-ip

Syntax

gatekeeper-ip <IPV4_HOST>

Mode

H323

Description

Set default wan/dmz gatekeeper IP address.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

gatekeeper-ip 172.16.10.10

Syntax

show voip [ { pending-config | with-pending-config } | call-status ] [ json | validate | xml ]

Mode

All Modes

Description

Show VoIP status or configuration.

Options

 
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
call-statusShow VoIP call status.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show voip

Syntax

security-services

Mode

Config

Description

Enter security services configuration mode.

Example

security-services

Syntax

synchronize

Mode

Security Services

Description

Synchronize licenses with www.mysonicwall.com.

Example

synchronize-license

Syntax

security { maximum | performance-optimized }

Mode

Security Services

Description

Set global security services setting.

Options

 
maximumUse maximum security (recommended).
 
performance-optimizedUse performance optimized.

Example

security maximum

Syntax

reduce-isdn-antivirus-traffic

Mode

Security Services

Description

Enable reduce Anti-Virus traffic for ISDN connections.

Example

reduce-isdn-antivirus-traffic

Syntax

no reduce-isdn-antivirus-traffic

Mode

Security Services

Description

Disable reduce Anti-Virus traffic for ISDN connections.

Example

no reduce-isdn-antivirus-traffic

Syntax

drop-packets-at-reload

Mode

Security Services

Description

Enable drop all packets while IPS, GAV and Anti-Spyware database is reloading.

Example

drop-packets-at-reload

Syntax

no drop-packets-at-reload

Mode

Security Services

Description

Disable drop all packets while IPS, GAV and Anti-Spyware database is reloading.

Example

no drop-packets-at-reload

Syntax

http-clientless-notification-timeout <UINT32>

Mode

Security Services

Description

Set HTTP clientless notification timeout for gateway AntiVirus and AntiSpyware.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

http-clientless-notification-timeout 86400

Syntax

proxy-server

Mode

Security Services

Description

Enable download signature through a proxy server and enter proxy server configure mode.

Example

proxy-server

Syntax

no proxy-server

Mode

Security Services

Description

Disable download signature through a proxy server.

Example

no proxy-server

Syntax

host <HOSTNAME>

Mode

Security Services Proxy Server

Description

Set hostname or IP address for proxy server.

Options

<HOSTNAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com

Example

host 10.10.10.10

Syntax

no host

Mode

Security Services Proxy Server

Description

Clear hostname or IP address for proxy server.

Example

no host

Syntax

port <IPV4_PORT>

Mode

Security Services Proxy Server

Description

Set proxy server TCP port.

Options

<IPV4_PORT> Integer in the form: D OR 0xHHHH.
Example: 80

Example

port 8080

Syntax

no port

Mode

Security Services Proxy Server

Description

Clear proxy server TCP port.

Example

no port

Syntax

authentication [ user-name <WORD> ] [ password <ENC_PASSWORD> ]

Mode

Security Services Proxy Server

Description

Configure proxy server authentication.

Options

user-nameSet proxy server username.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
passwordSet proxy server password.
<ENC_PASSWORD> Password.
Example: secret

Example

authentication user-name proxyUser password proxyPass

Syntax

no authentication [ password | user-name ]

Mode

Security Services Proxy Server

Description

Disable proxy server authentication.

Options

 
passwordClear proxy server authentication password.
 
user-nameClear proxy server authentication username.

Example

no authentication

no authentication user-name
no authentication password

Syntax

portal [ user-name <WORD> ] [ password <ENC_PASSWORD> ]

Mode

Security Services Proxy Server

Description

Configure proxy server portal username and password.

Options

user-nameSet proxy server portal username.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
passwordSet proxy server portal password.
<ENC_PASSWORD> Password.
Example: secret

Example

portal user-name portalUser

Syntax

no portal { password | user-name }

Mode

Security Services Proxy Server

Description

Clear proxy server portal username or password.

Options

 
passwordClear proxy server portal password.
 
user-nameClear proxy server portal username.

Example

no portal user-name

Syntax

intrusion-prevention

Mode

Config

Description

Enter Intrusion Prevention Configuration Mode.

Example

intrusion-prevention

Syntax

update-signatures

Mode

IPS

Description

Update signature database.

Example

update-signatures

Syntax

enable

Mode

IPS

Description

Enable Intrusion Prevention.

Example

enable

Syntax

no enable

Mode

IPS

Description

Disable Intrusion Prevention.

Example

no enable

Syntax

signature-group high-priority { detect-all | log-redundancy <UINT32> | prevent-all }

Mode

IPS

Description

Enable signature group high priority detection and log redundancy.

Options

 
detect-allDetect All.
 
log-redundancySet Log Redundancy in seconds.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123
 
prevent-allPrevent All.

Example

signature-group high-priority prevent-all

signature-group high-priority log-redundancy 60

Syntax

signature-group medium-priority { detect-all | log-redundancy <UINT32> | prevent-all }

Mode

IPS

Description

Enable signature group medium priority detection and log redundancy.

Options

 
detect-allDetect All.
 
log-redundancySet Log Redundancy in seconds.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123
 
prevent-allPrevent All.

Example

signature-group medium-priority prevent-all

signature-group medium-priority log-redundancy 60

Syntax

signature-group low-priority { detect-all | log-redundancy <UINT32> | prevent-all }

Mode

IPS

Description

Enable signature group low priority detection and log redundancy.

Options

 
detect-allDetect All.
 
log-redundancySet Log Redundancy in seconds.
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123
 
prevent-allPrevent All.

Example

signature-group low-priority prevent-all

signature-group low-priority log-redundancy 60

Syntax

no signature-group high-priority { detect-all | log-redundancy | prevent-all }

Mode

IPS

Description

Disable signature group high priority detection and log redundancy.

Options

 
detect-allDetect All.
 
log-redundancyClear Log Redundancy.
 
prevent-allPrevent All.

Example

no signature-group high-priority prevent-all

no signature-group high-priority log-redundancy

Syntax

no signature-group medium-priority { detect-all | log-redundancy | prevent-all }

Mode

IPS

Description

Disable signature group medium priority detection and log redundancy.

Options

 
detect-allDetect All.
 
log-redundancyClear Log Redundancy.
 
prevent-allPrevent All.

Example

no signature-group medium-priority prevent-all

no signature-group medium-priority log-redundancy

Syntax

no signature-group low-priority { detect-all | log-redundancy | prevent-all }

Mode

IPS

Description

Disable signature group low priority detection and log redundancy.

Options

 
detect-allDetect All.
 
log-redundancyClear Log Redundancy.
 
prevent-allPrevent All.

Example

no signature-group low-priority prevent-all

no signature-group low-priority log-redundancy

Syntax

reset-settings

Mode

IPS

Description

Reset Intrusion Prevention Settings to default.

Example

reset-settings

Syntax

category { id <IPS_CATEGORY_ID> | name <IPS_CATEGORY_NAME> }

Mode

IPS

Description

Enter configuration mode for the specified IPS Category.

Options

 
idCategory ID.
<IPS_CATEGORY_ID> Category ID.
Example: 1234
 
nameCategory name.
<IPS_CATEGORY_NAME> Category name.
Example: ACTIVEX

Example

category name "BACKDOOR"

Syntax

exclusion { { [ ipv6 ] { host <ADDR_HOST> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } | entry <IPS_EXCLUSION_BEGIN_IPV4_HOST> <IPS_EXCLUSION_END_IPV4_HOST> | group <ADDR_GROUP_NAME_MIXED> | list | name <ADDR_NAME_MIXED> }

Mode

IPS

Description

Configure IPS exclusion list.

Options

 
ipv6Excluded IPv6 addresses.
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
 
entryIPS exclusion list entry.
<IPS_EXCLUSION_BEGIN_IPV4_HOST> IPS Exclusion List entry begin IPV4 in the form: D.D.D.D.
Example: 192.168.168.168
<IPS_EXCLUSION_END_IPV4_HOST> IPS Exclusion List entry end IPV4 in the form: D.D.D.D.
Example: 192.168.168.168
 
groupAddress object group
<ADDR_GROUP_NAME_MIXED> Group address object name.
Example: Sales Group
 
listEnable IPS exclusion list.
 
nameAddress object name
<ADDR_NAME_MIXED> Address object name.
Example: Web Server

Example

exclusion list

exclusion name "WLAN Subnets"
exclusion entry 10.10.10.1 10.10.10.10

Syntax

no exclusion { entries | entry <IPS_EXCLUSION_BEGIN_IPV4_HOST> <IPS_EXCLUSION_END_IPV4_HOST> | list }

Mode

IPS

Description

Disable IPS exclusion list.

Options

 
entriesDelete all IPS exclusion list entries.
 
entryDelete one IPS exclusion list entry.
<IPS_EXCLUSION_BEGIN_IPV4_HOST> IPS Exclusion List entry begin IPV4 in the form: D.D.D.D.
Example: 192.168.168.168
<IPS_EXCLUSION_END_IPV4_HOST> IPS Exclusion List entry end IPV4 in the form: D.D.D.D.
Example: 192.168.168.168
 
listDisable IPS exclusion list.

Example

no exclusion list

no exclusion entries
no exclusion entry 10.10.10.1 10.10.10.10

Syntax

policy category { id <IPS_CATEGORY_ID> | name <IPS_CATEGORY_NAME> } signature { id <IPS_POLICY_ID> | name <IPS_POLICY_NAME> }

Mode

IPS

Description

Enter configuration mode for the specified IPS Policy.

Options

categoryCategory.
 
idCategory ID.
<IPS_CATEGORY_ID> Category ID.
Example: 1234
 
nameCategory name.
<IPS_CATEGORY_NAME> Category name.
Example: ACTIVEX
signatureSignature.
 
idSignature ID.
<IPS_POLICY_ID> Policy ID.
Example: 1234
 
nameSignature name.
<IPS_POLICY_NAME> Policy name.
Example: ActivePDF WebGrabber ActiveX Instantiation

Example

policy category name "ActivePDF WebGrabber ActiveX Instantiation"

Syntax

name <WORD>

Mode

IPS Category

IPS Policy

Description

Category name.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

name ACTIVEX

Syntax

id <UINT32>

Mode

IPS Category

IPS Policy

Description

Category ID.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

id 8

Syntax

prevention { disable | enable | global-setting }

Mode

IPS Category

Description

Set Prevention for IPS Category.

Options

 
disableDisable.
 
enableEnable.
 
global-settingUse Global Setting.

Example

prevention enable

Syntax

detection { disable | enable | global-setting }

Mode

IPS Category

Description

Set Detection for IPS Category.

Options

 
disableEnable.
 
enableEnable.
 
global-settingUse Global Setting.

Example

detection enable

Syntax

included users { administrator | all | group <LOCAL_USER_GROUP_NAME> | guests | name <LOCAL_USER_NAME> }

Mode

IPS Category

Description

Set Included Users/Groups.

Options

 
administratorBuilt-in administrator.
 
allAll.
 
groupSpecify local user group.
<LOCAL_USER_GROUP_NAME> User group object name.
Example: Limited Administrators
 
guestsGuests.
 
nameSpecify local user.
<LOCAL_USER_NAME> User object name.
Example: user1

Example

included users all

Syntax

excluded users { administrator | group <LOCAL_USER_GROUP_NAME> | guests | name <LOCAL_USER_NAME> }

Mode

IPS Category

Description

Set Excluded Users/Groups.

Options

 
administratorBuilt-in administrator.
 
groupSpecify local user group.
<LOCAL_USER_GROUP_NAME> User group object name.
Example: Limited Administrators
 
guestsGuests.
 
nameSpecify local user.
<LOCAL_USER_NAME> User object name.
Example: user1

Example

excluded users guests

Syntax

included ip { { [ ipv6 ] { host <ADDR_HOST> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } | all | group <ADDR_GROUP_NAME_MIXED> | name <ADDR_NAME_MIXED> }

Mode

IPS Category

Description

Set Included IP address Range.

Options

 
ipv6Included IPv6 addresses.
 
hostAddress Object Host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
networkAddress Object Network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeSpecify IP Range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
 
allAll.
 
groupAddress Object Group.
<ADDR_GROUP_NAME_MIXED> Group address object name.
Example: Sales Group
 
nameSpecify name of Range Address Object.
<ADDR_NAME_MIXED> Address object name.
Example: Web Server

Example

included ip range 10.10.10.1 10.10.10.10

Syntax

excluded ip { { [ ipv6 ] { host <ADDR_HOST> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } | group <ADDR_GROUP_NAME_MIXED> | name <ADDR_NAME_MIXED> }

Mode

IPS Category

Description

Set Excluded IP address Range.

Options

 
ipv6Excluded IPv6 addresses.
 
hostAddress Object Host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
networkAddress Object Network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeSpecify IP Range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
 
groupAddress Object Group.
<ADDR_GROUP_NAME_MIXED> Group address object name.
Example: Sales Group
 
nameSpecify name of Range Address Object.
<ADDR_NAME_MIXED> Address object name.
Example: Web Server

Example

excluded ip range 10.10.10.1 10.10.10.10

Syntax

no excluded { ip | users }

Mode

IPS Category

Description

Don't excluded any users/groups or IP addresses.

Options

 
ipDon't excluded any IP addresses.
 
usersDon't excluded any users/groups.

Example

no excluded users

no excluded ip

Syntax

schedule { always-on | days <SCHED_DAYS> time <SCHED_TIME_BEGIN> <SCHED_TIME_END> | name <SCHED_NAME> }

Mode

IPS Category

Description

Set IPS category schedule.

Options

 
always-onAlways on.
 
daysSchedule Object days.
<SCHED_DAYS> Days of the week in the form: SU-M-T-W-TH-F-SA.
Example: SU-M-TH-SA
timeSchedule Object beginning/ending time.
<SCHED_TIME_BEGIN> Time in the form: DD:DD.
Example: 12:00
<SCHED_TIME_END> Time in the form: DD:DD.
Example: 12:00
 
nameSchedule Object name.
<SCHED_NAME> Schedule object name.
Example: Work Hours

Example

schedule always-on

Syntax

log-redundancy { filter <UINT16> | global-setting }

Mode

IPS Category

Description

Set IPS category log redundancy filter.

Options

 
filterSet log redundancy filter in seconds.
<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123
 
global-settingUse Global Setting.

Example

log-redundancy filter 45

Syntax

prevention { category-setting | disable | enable }

Mode

IPS Policy

Description

Set Prevention for IPS Policy.

Options

 
category-settingUse Category Setting.
 
disableEnable.
 
enableEnable.

Example

prevention enable

Syntax

detection { category-setting | disable | enable }

Mode

IPS Policy

Description

Set Detection for IPS Policy.

Options

 
category-settingUse Category Setting.
 
disableEnable.
 
enableEnable.

Example

detection enable

Syntax

included users { administrator | all | category-setting | group <LOCAL_USER_GROUP_NAME> | guests | name <LOCAL_USER_NAME> }

Mode

IPS Policy

Description

Set Included Users/Groups.

Options

 
administratorBuilt-in administrator.
 
allAll.
 
category-settingUse Category Setting.
 
groupSpecify local user group.
<LOCAL_USER_GROUP_NAME> User group object name.
Example: Limited Administrators
 
guestsGuests.
 
nameSpecify local user.
<LOCAL_USER_NAME> User object name.
Example: user1

Example

included users all

Syntax

excluded users { administrator | category-setting | group <LOCAL_USER_GROUP_NAME> | guests | name <LOCAL_USER_NAME> }

Mode

IPS Policy

Description

Set Excluded Users/Groups.

Options

 
administratorBuilt-in administrator.
 
category-settingUse Category Setting.
 
groupSpecify local user group.
<LOCAL_USER_GROUP_NAME> User group object name.
Example: Limited Administrators
 
guestsGuests.
 
nameSpecify local user.
<LOCAL_USER_NAME> User object name.
Example: user1

Example

excluded users guests

Syntax

included ip { { [ ipv6 ] { host <ADDR_HOST> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } | all | category-setting | group <ADDR_GROUP_NAME_MIXED> | name <ADDR_NAME_MIXED> }

Mode

IPS Policy

Description

Set Included IP address Range.

Options

 
ipv6Included IPv6 addresses.
 
hostAddress Object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
networkAddress Object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress Object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
 
allAll.
 
category-settingUse Category Setting.
 
groupAddress Object Group.
<ADDR_GROUP_NAME_MIXED> Group address object name.
Example: Sales Group
 
nameAddress Object name.
<ADDR_NAME_MIXED> Address object name.
Example: Web Server

Example

included ip range 10.10.10.1 10.10.10.10

Syntax

excluded ip { { [ ipv6 ] { host <ADDR_HOST> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } | category-setting | group <ADDR_GROUP_NAME_MIXED> | name <ADDR_NAME_MIXED> }

Mode

IPS Policy

Description

Set Excluded IP address Range.

Options

 
ipv6Excluded IPv6 addresses.
 
hostAddress Object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
networkAddress Object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress Object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
 
category-settingUse Category Setting.
 
groupAddress Object Group.
<ADDR_GROUP_NAME_MIXED> Group address object name.
Example: Sales Group
 
nameAddress Object name.
<ADDR_NAME_MIXED> Address object name.
Example: Web Server

Example

excluded ip range 10.10.10.1 10.10.10.10

Syntax

no excluded { ip | users }

Mode

IPS Policy

Description

Don't excluded any users/groups or IP addresses.

Options

 
ipDon't excluded any IP addresses.
 
usersDon't excluded any users/groups.

Example

no excluded users

no excluded ip

Syntax

schedule { always-on | category-setting | days <SCHED_DAYS> time <SCHED_TIME_BEGIN> <SCHED_TIME_END> | name <SCHED_NAME> }

Mode

IPS Policy

Description

Set IPS policy schedule.

Options

 
always-onAlways on.
 
category-settingUse Category Setting.
 
daysSchedule Object days.
<SCHED_DAYS> Days of the week in the form: SU-M-T-W-TH-F-SA.
Example: SU-M-TH-SA
timeSchedule Object beginning/ending time.
<SCHED_TIME_BEGIN> Time in the form: DD:DD.
Example: 12:00
<SCHED_TIME_END> Time in the form: DD:DD.
Example: 12:00
 
nameSchedule Object name.
<SCHED_NAME> Schedule object name.
Example: Work Hours

Example

schedule always-on

Syntax

log-redundancy { category-setting | filter <UINT16> }

Mode

IPS Policy

Description

Set IPS policy log redundancy filter.

Options

 
category-settingUse Category Setting.
 
filterSet log redundancy filter in seconds.
<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

log-redundancy filter 45

Syntax

priority { high | low | medium }

Mode

IPS Policy

Description

Set IPS policy priority.

Options

 
highHigh priority.
 
lowLow priority.
 
mediumMedium priority.

Example

priority high

Syntax

direction { both | incoming | outgoing } [ to-client | to-server ]

Mode

IPS Policy

Description

Set IPS policy direction.

Options

 
bothBoth.
 
incomingIncoming.
 
outgoingOutgoing.
 
to-clientTo client.
 
to-serverTo server.

Example

direction both

Syntax

gateway-antivirus

Mode

Config

Description

Enter Gateway Anti-Virus Configuration Mode.

Example

gateway-antivirus

Syntax

update-signatures

Mode

Gateway Anti-Virus

Description

Update signature database.

Example

update-signatures

Syntax

enable

Mode

Gateway Anti-Virus

Description

Enable Gateway Anti-Virus service.

Example

enable

Syntax

no enable

Mode

Gateway Anti-Virus

Description

Disable Gateway Anti-Virus service.

Example

no enable

Syntax

signature { id <GAV_SIG_ID> | name <GAV_SIG_NAME> }

Mode

Gateway Anti-Virus

Description

Enable signature.

Options

 
idSignature ID.
<GAV_SIG_ID> Signature ID.
Example: 1234
 
nameSignature name.
<GAV_SIG_NAME> Signature name.
Example: 007SpySoft.G (Trojan)

Example

signature name "180Solutions_6 (Adware)"

Syntax

no signature { id <GAV_SIG_ID> | name <GAV_SIG_NAME> }

Mode

Gateway Anti-Virus

Description

Disable signature.

Options

 
idSignature ID.
<GAV_SIG_ID> Signature ID.
Example: 1234
 
nameSignature name.
<GAV_SIG_NAME> Signature name.
Example: 007SpySoft.G (Trojan)

Example

no signature name "180Solutions_6 (Adware)"

Syntax

inbound-inspection { cifs-netbios | ftp | http | imap | pop3 | smtp | tcp-stream }

Mode

Gateway Anti-Virus

Description

Enable inbound inspection for the specified protocols.

Options

 
cifs-netbiosCIFS/NetBIOS.
 
ftpFTP.
 
httpHTTP.
 
imapIMAP.
 
pop3POP3.
 
smtpSMTP.
 
tcp-streamTCP Stream.

Example

inbound-inspection http

Syntax

no inbound-inspection { cifs-netbios | ftp | http | imap | pop3 | smtp | tcp-stream }

Mode

Gateway Anti-Virus

Description

Disable inbound inspection for the specified protocols.

Options

 
cifs-netbiosCIFS/NetBIOS.
 
ftpFTP.
 
httpHTTP.
 
imapIMAP.
 
pop3POP3.
 
smtpSMTP.
 
tcp-streamTCP Stream.

Example

no inbound-inspection http

Syntax

outbound-inspection { ftp | http | smtp | tcp-stream }

Mode

Gateway Anti-Virus

Description

Enable outbound inspection for the specified protocols.

Options

 
ftpFTP.
 
httpHTTP.
 
smtpSMTP.
 
tcp-streamTCP Stream.

Example

outbound-inspection http

Syntax

no outbound-inspection { ftp | http | smtp | tcp-stream }

Mode

Gateway Anti-Virus

Description

Disable outbound inspection for the specified protocols.

Options

 
ftpFTP.
 
httpHTTP.
 
smtpSMTP.
 
tcp-streamTCP Stream.

Example

no outbound-inspection http

Syntax

restrict password-protected-zip { cifs-netbios | ftp | http | imap | pop3 | smtp }

Mode

Gateway Anti-Virus

Description

Enable restricting transfer of password-protected ZIP files for the specified protocols.

Options

 
cifs-netbiosCIFS/NetBIOS.
 
ftpFTP.
 
httpHTTP.
 
imapIMAP.
 
pop3POP3.
 
smtpSMTP.

Example

restrict password-protected-zip http

Syntax

no restrict password-protected-zip { cifs-netbios | ftp | http | imap | pop3 | smtp }

Mode

Gateway Anti-Virus

Description

Disable restricting transfer of password-protected ZIP files for the specified protocols.

Options

 
cifs-netbiosCIFS/NetBIOS.
 
ftpFTP.
 
httpHTTP.
 
imapIMAP.
 
pop3POP3.
 
smtpSMTP.

Example

no restrict password-protected-zip http

Syntax

restrict ms-office-macros { cifs-netbios | ftp | http | imap | pop3 | smtp }

Mode

Gateway Anti-Virus

Description

Enable restricting transfer of MS-Office type files containing macros (VBA 5 and above).

Options

 
cifs-netbiosCIFS/NetBIOS.
 
ftpFTP.
 
httpHTTP.
 
imapIMAP.
 
pop3POP3.
 
smtpSMTP.

Example

restrict ms-office-macros http

Syntax

no restrict ms-office-macros { cifs-netbios | ftp | http | imap | pop3 | smtp }

Mode

Gateway Anti-Virus

Description

Disable restricting transfer of MS-Office type files containing macros (VBA 5 and above) for the specified protocols.

Options

 
cifs-netbiosCIFS/NetBIOS.
 
ftpFTP.
 
httpHTTP.
 
imapIMAP.
 
pop3POP3.
 
smtpSMTP.

Example

no restrict ms-office-macros http

Syntax

restrict packed-executables { cifs-netbios | ftp | http | imap | pop3 | smtp }

Mode

Gateway Anti-Virus

Description

Enable restricting transfer of packed executable files (UPX, FSG, etc.) for the specified protocols.

Options

 
cifs-netbiosCIFS/NetBIOS.
 
ftpFTP.
 
httpHTTP.
 
imapIMAP.
 
pop3POP3.
 
smtpSMTP.

Example

restrict packed-executables http

Syntax

no restrict packed-executables { cifs-netbios | ftp | http | imap | pop3 | smtp }

Mode

Gateway Anti-Virus

Description

Disable restricting transfer of packed executable files (UPX, FSG, etc.) for the specified protocols.

Options

 
cifs-netbiosCIFS/NetBIOS.
 
ftpFTP.
 
httpHTTP.
 
imapIMAP.
 
pop3POP3.
 
smtpSMTP.

Example

no restrict packed-executables http

Syntax

reset-settings

Mode

Gateway Anti-Virus

Description

Reset Gateway Anti-Virus Settings to default.

Example

reset-settings

Syntax

cloud anti-virus-database

Mode

Gateway Anti-Virus

Description

Enable Cloud Anti-Virus Database.

Example

cloud anti-virus-database

Syntax

no cloud anti-virus-database

Mode

Gateway Anti-Virus

Description

Disable Cloud Anti-Virus Database.

Example

no cloud anti-virus-database

Syntax

cloud exclusion { id <GAV_SIG_ID> | name <GAV_SIG_NAME> }

Mode

Gateway Anti-Virus

Description

Add a Cloud Anti-Virus Database exclusion.

Options

 
idSignature ID.
<GAV_SIG_ID> Signature ID.
Example: 1234
 
nameSignature name.
<GAV_SIG_NAME> Signature name.
Example: 007SpySoft.G (Trojan)

Example

cloud exclusion id 1345342

Syntax

no cloud exclusion { id <GAV_SIG_ID> | name <GAV_SIG_NAME> }

Mode

Gateway Anti-Virus

Description

Remove a Cloud Anti-Virus Database exclusion.

Options

 
idSignature ID.
<GAV_SIG_ID> Signature ID.
Example: 1234
 
nameSignature name.
<GAV_SIG_NAME> Signature name.
Example: 007SpySoft.G (Trojan)

Example

no cloud exclusion id 1345342

Syntax

no cloud exclusions

Mode

Gateway Anti-Virus

Description

Delete all Cloud Anti-Virus Database exclusions.

Example

no cloud exclusions

Syntax

smtp-responses

Mode

Gateway Anti-Virus

Description

Enable SMTP responses.

Example

smtp-responses

Syntax

no smtp-responses

Mode

Gateway Anti-Virus

Description

Disable SMTP responses.

Example

no smtp-responses

Syntax

eicar-detection

Mode

Gateway Anti-Virus

Description

Enable detection of EICAR test virus.

Example

eicar-detection

Syntax

no eicar-detection

Mode

Gateway Anti-Virus

Description

Disable detection of EICAR test virus.

Example

no eicar-detection

Syntax

http-byte-range

Mode

Gateway Anti-Virus

Description

Enable HTTP Byte-Range requests with Gateway AV.

Example

http-byte-range

Syntax

no http-byte-range

Mode

Gateway Anti-Virus

Description

Disable HTTP Byte-Range requests with Gateway AV.

Example

no http-byte-range

Syntax

ftp-rest

Mode

Gateway Anti-Virus

Description

Enable FTP 'REST' requests with Gateway AV.

Example

ftp-rest

Syntax

no ftp-rest

Mode

Gateway Anti-Virus

Description

Disable FTP 'REST' requests with Gateway AV.

Example

no ftp-rest

Syntax

scan-high-compression

Mode

Gateway Anti-Virus

Description

Scan parts of files with high compression ratios.

Example

scan-high-compression

Syntax

no scan-high-compression

Mode

Gateway Anti-Virus

Description

Do not scan parts of files with high compression ratios.

Example

no scan-high-compression

Syntax

http-clientless-notification

Mode

Gateway Anti-Virus

Description

Enable HTTP Clientless Notification Alerts.

Example

http-clientless-notification

Syntax

no http-clientless-notification

Mode

Gateway Anti-Virus

Description

Disable HTTP Clientless Notification Alerts.

Example

no http-clientless-notification

Syntax

no notification-message

Mode

Gateway Anti-Virus

Description

Clear HTTP Clientless Notification Message to display when blocking.

Example

no notification-message

Syntax

notification-message <WORD>

Mode

Gateway Anti-Virus

Description

Set HTTP Clientless Notification Message to display when blocking.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

notification-message "This request is blocked by the SonicWALL Gateway Anti-Virus Service."

Syntax

exclusion { { [ ipv6 ] { host <ADDR_HOST> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } } | entry <GAV_EXCLUSION_BEGIN_IPV4_HOST> <GAV_EXCLUSION_END_IPV4_HOST> | group <ADDR_GROUP_NAME_MIXED> | list | name <ADDR_NAME_MIXED> }

Mode

Gateway Anti-Virus

Description

Configure gateway AV exclusion list.

Options

 
ipv6Excluded IPv6 addresses.
 
hostAddress object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
networkAddress object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
 
entryGateway AV exclusion list entry.
<GAV_EXCLUSION_BEGIN_IPV4_HOST> Gateway AV Exclusion List entry begin IPV4 in the form: D.D.D.D.
Example: 192.168.168.168
<GAV_EXCLUSION_END_IPV4_HOST> Gateway AV Exclusion List entry end IPV4 in the form: D.D.D.D.
Example: 192.168.168.168
 
groupAddress object group
<ADDR_GROUP_NAME_MIXED> Group address object name.
Example: Sales Group
 
listEnable gateway AV exclusion list.
 
nameAddress object name
<ADDR_NAME_MIXED> Address object name.
Example: Web Server

Example

exclusion list

exclusion name "WLAN Subnets"
exclusion entry 10.10.10.1 10.10.10.10

Syntax

no exclusion { entries | entry <GAV_EXCLUSION_BEGIN_IPV4_HOST> <GAV_EXCLUSION_END_IPV4_HOST> | list }

Mode

Gateway Anti-Virus

Description

Disable gateway AV exclusion list.

Options

 
entriesDelete all gateway AV exclusion list entries.
 
entryDelete gateway AV exclusion list entry.
<GAV_EXCLUSION_BEGIN_IPV4_HOST> Gateway AV Exclusion List entry begin IPV4 in the form: D.D.D.D.
Example: 192.168.168.168
<GAV_EXCLUSION_END_IPV4_HOST> Gateway AV Exclusion List entry end IPV4 in the form: D.D.D.D.
Example: 192.168.168.168
 
listDisable gateway AV exclusion list.

Example

no exclusion list

no exclusion entry 10.10.10.1 10.10.10.10

Syntax

no match-object <MATCH_OBJ_NAME>

Mode

Config

Description

Delete a match object.

Options

<MATCH_OBJ_NAME> Match object name.
Example: Match FTP

Example

no match-object "myMatchObject"

Syntax

no match-objects

Mode

Config

Description

Delete all match objects.

Example

no match-objects

Syntax

match-object <MATCH_OBJ_NAME>

Mode

Config

Description

Add/edit match object and enter configuration mode.

Options

<MATCH_OBJ_NAME> Match object name.
Example: Match FTP

Example

match-object "Denied File Extensions"

Syntax

no type

Mode

Match Object

Example

no type

Syntax

type { activex-class-id | application-category-list | application-list | application-signature-list | cfs-allow-forbidden-list | cfs-category-list | custom | email-body | email-cc | email-from | email-size | email-subject | email-to | file-content | file-extension | file-name | ftp-command | ftp-command-value | http-cookie | http-host | http-referer | http-request-custom-header | http-response-custom-header | http-set-cookie | http-uri-content | http-url | http-user-agent | ips-signature-category-list | ips-signature-list | log-email-user | mime-custom-header | web-browser }

Mode

Match Object

Description

Match object type.

Options

 
activex-class-idActive X class ID.
 
application-category-listApplication category list.
 
application-listApplication list.
 
application-signature-listApplication signature list.
 
cfs-allow-forbidden-listCFS allow/forbidden list.
 
cfs-category-listCFS category list.
 
customCustom object.
 
email-bodyE-mail body.
 
email-ccE-mail CC.
 
email-fromE-mail from.
 
email-sizeE-mail size.
 
email-subjectE-mail subject.
 
email-toE-mail to.
 
file-contentFile content.
 
file-extensionFile extension.
 
file-nameFile name.
 
ftp-commandFTP command.
 
ftp-command-valueFTP command and value.
 
http-cookieHTTP cookie.
 
http-hostHttp host.
 
http-refererHTTP referer.
 
http-request-custom-headerHTTP request custom header.
 
http-response-custom-headerHTTP response custom header.
 
http-set-cookieHTTP set cookie.
 
http-uri-contentHTTP URI content.
 
http-urlHTTP URL.
 
http-user-agentHttp user agent.
 
ips-signature-category-listIPS signature category list.
 
ips-signature-listIPS signature list.
 
log-email-userLog e-mail user.
 
mime-custom-headerMIME custom header.
 
web-browserWeb browser.

Example

type email-body

Syntax

name <MATCH_OBJ_NAME>

Mode

Match Object

Description

Set match object name.

Options

<MATCH_OBJ_NAME> Match object name.
Example: Match FTP

Example

name "Denied File Extensions "

Syntax

match-type { exact | partial | prefix | regex | suffix }

Mode

Match Object

Description

Set match object match type.

Options

 
exactExact match.
 
partialPartial match.
 
prefixPrefix match.
 
regexRegular expression match.
 
suffixSuffix match.

Example

match-type exact

Syntax

no match-type

Mode

Match Object

Description

Clear match object match type.

Example

no match-type

Syntax

enable

Mode

Match Object

Description

Enable custom settings.

Example

enable

Syntax

no enable

Mode

Match Object

Description

Disable custom settings.

Example

no enable

Syntax

offset <UINT32>

Mode

Match Object

Description

Set offset.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

offset 1

Syntax

no offset

Mode

Match Object

Description

Clear offset.

Example

no offset

Syntax

depth <UINT32>

Mode

Match Object

Description

Set depth.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

depth 1

Syntax

no depth

Mode

Match Object

Description

Clear depth.

Example

no depth

Syntax

min-size <UINT32>

Mode

Match Object

Description

Set min size.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

min-size 1

Syntax

no min-size

Mode

Match Object

Description

Clear min size.

Example

no min-size

Syntax

max-size <UINT32>

Mode

Match Object

Description

Set max size.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

max-size 1

Syntax

no max-size

Mode

Match Object

Description

Clear max size.

Example

no max-size

Syntax

negative-matching

Mode

Match Object

Description

Enable negative matching.

Example

negative-matching

Syntax

no negative-matching

Mode

Match Object

Description

Disable negative matching.

Example

no negative-matching

Syntax

input-representation { alphanumeric | hexadecimal }

Mode

Match Object

Description

Set match object input representation.

Options

 
alphanumericAlphanumeric.
 
hexadecimalHexadecimal.

Example

input-representation alphanumeric

Syntax

content-entry <WORD>

Mode

Match Object

Description

Add match object content.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

content-entry mpg

Syntax

no content-entry <MATCH_OBJ_CONTENT_ENTRY>

Mode

Match Object

Description

Delete match object content.

Options

<MATCH_OBJ_CONTENT_ENTRY> Match object content.
Example: mpg

Example

no content-entry mpg

Syntax

no content-entries

Mode

Match Object

Description

Delete all match object content.

Example

no content-entries

Syntax

browser { chrome | firefox | msie | netscape | safari }

Mode

Match Object

Description

Add match object browser.

Options

 
chromeChrome.
 
firefoxFirefox.
 
msieInternet explorer.
 
netscapeNetscape.
 
safariSafari.

Example

browser safari

Syntax

no browser { chrome | firefox | msie | netscape | safari }

Mode

Match Object

Description

Delete match object browser.

Options

 
chromeChrome.
 
firefoxFirefox.
 
msieInternet explorer.
 
netscapeNetscape.
 
safariSafari.

Example

no browser safari

Syntax

no browsers

Mode

Match Object

Description

Delete all match object browsers.

Example

no browsers

Syntax

custom-header <WORD>

Mode

Match Object

Description

Set custom header name.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

custom-header "TBD "

Syntax

no custom-header

Mode

Match Object

Description

Clear custom header name.

Example

no custom-header

Syntax

email-size <UINT32>

Mode

Match Object

Description

Specify e-mail size in bytes.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

email-size 1000000

Syntax

no email-size

Mode

Match Object

Description

Clear e-mail size.

Example

no email-size

Syntax

ftp-command { abort | account | allocate | append | ascii | binary | cd | cdup | delete | get | help | ls | mkdir | mode | modified-time | nlist | noop | passive | password | port | put | pwd | quit | reinitialize | rename-from | rename-to | restart | rmdir | site | size | status | structure | structure-mount | structure-unique | system | type | user }

Mode

Match Object

Description

Add match object FTP command.

Options

 
abortABORT.
 
accountACCOUNT.
 
allocateALLOCATE.
 
appendAPPEND.
 
asciiASCII.
 
binaryBINARY.
 
cdCD.
 
cdupCDUP.
 
deleteDELETE.
 
getGET.
 
helpHELP.
 
lsLS.
 
mkdirMKDIR.
 
modeMODE.
 
modified-timeMODIFIED_TIME.
 
nlistNLIST.
 
noopNOOP.
 
passivePASSIVE.
 
passwordPASSWORD.
 
portPORT.
 
putPUT.
 
pwdPWD.
 
quitQUIT.
 
reinitializeREINITIALIZE.
 
rename-fromRENAME_FROM.
 
rename-toRENAME_TO.
 
restartRESTART.
 
rmdirRMDIR.
 
siteSITE.
 
sizeSIZE.
 
statusSTATUS.
 
structureSTRUCTURE.
 
structure-mountSTRUCTURE_MOUNT.
 
structure-uniqueSTRUCTURE_UNIQUE.
 
systemSYSTEM.
 
typeTYPE.
 
userUSER.

Example

ftp-command put

Syntax

no ftp-command { abort | account | allocate | append | ascii | binary | cd | cdup | delete | get | help | ls | mkdir | mode | modified-time | nlist | noop | passive | password | port | put | pwd | quit | reinitialize | rename-from | rename-to | restart | rmdir | site | size | status | structure | structure-mount | structure-unique | system | type | user }

Mode

Match Object

Description

Delete match object FTP command.

Options

 
abortABORT.
 
accountACCOUNT.
 
allocateALLOCATE.
 
appendAPPEND.
 
asciiASCII.
 
binaryBINARY.
 
cdCD.
 
cdupCDUP.
 
deleteDELETE.
 
getGET.
 
helpHELP.
 
lsLS.
 
mkdirMKDIR.
 
modeMODE.
 
modified-timeMODIFIED_TIME.
 
nlistNLIST.
 
noopNOOP.
 
passivePASSIVE.
 
passwordPASSWORD.
 
portPORT.
 
putPUT.
 
pwdPWD.
 
quitQUIT.
 
reinitializeREINITIALIZE.
 
rename-fromRENAME_FROM.
 
rename-toRENAME_TO.
 
restartRESTART.
 
rmdirRMDIR.
 
siteSITE.
 
sizeSIZE.
 
statusSTATUS.
 
structureSTRUCTURE.
 
structure-mountSTRUCTURE_MOUNT.
 
structure-uniqueSTRUCTURE_UNIQUE.
 
systemSYSTEM.
 
typeTYPE.
 
userUSER.

Example

no ftp-command put

Syntax

no ftp-commands

Mode

Match Object

Description

Delete all match object FTP commands.

Example

no ftp-commands

Syntax

argument <WORD>

Mode

Match Object

Description

Add FTP command argument.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

argument file1

Syntax

no argument <MATCH_OBJ_CONTENT_ENTRY>

Mode

Match Object

Description

Delete FTP command argument.

Options

<MATCH_OBJ_CONTENT_ENTRY> Match object content.
Example: mpg

Example

no argument file1

Syntax

no arguments

Mode

Match Object

Description

Delete all FTP command arguments.

Example

no arguments

Syntax

ips category { id <IPS_CATEGORY_ID> | name <IPS_CATEGORY_NAME> }

Mode

Match Object

Description

Add an IPS category.

Options

 
idCategory ID.
<IPS_CATEGORY_ID> Category ID.
Example: 1234
 
nameCategory name.
<IPS_CATEGORY_NAME> Category name.
Example: ACTIVEX

Example

ips category name ACTIVEX

Syntax

no ips category { id <IPS_CATEGORY_ID> | name <IPS_CATEGORY_NAME> }

Mode

Match Object

Description

Delete an IPS category.

Options

 
idCategory ID.
<IPS_CATEGORY_ID> Category ID.
Example: 1234
 
nameCategory name.
<IPS_CATEGORY_NAME> Category name.
Example: ACTIVEX

Example

no ips category name ACTIVEX

Syntax

no ips categories

Mode

Match Object

Description

Delete all IPS categories.

Example

no ips categories

Syntax

ips policy category { id <IPS_CATEGORY_ID> | name <IPS_CATEGORY_NAME> } signature { id <IPS_POLICY_ID> | name <IPS_POLICY_NAME> }

Mode

Match Object

Description

Add an IPS policy.

Options

categoryCategory.
 
idCategory ID.
<IPS_CATEGORY_ID> Category ID.
Example: 1234
 
nameCategory name.
<IPS_CATEGORY_NAME> Category name.
Example: ACTIVEX
signatureSignature.
 
idSignature ID.
<IPS_POLICY_ID> Policy ID.
Example: 1234
 
nameSignature name.
<IPS_POLICY_NAME> Policy name.
Example: ActivePDF WebGrabber ActiveX Instantiation

Example

ips category name ACTIVEX signature name "Free Tetris Executable (Adware)"

Syntax

no ips policy category { id <IPS_CATEGORY_ID> | name <IPS_CATEGORY_NAME> } signature { id <IPS_POLICY_ID> | name <IPS_POLICY_NAME> }

Mode

Match Object

Description

Delete an IPS policy.

Options

categoryCategory.
 
idCategory ID.
<IPS_CATEGORY_ID> Category ID.
Example: 1234
 
nameCategory name.
<IPS_CATEGORY_NAME> Category name.
Example: ACTIVEX
signatureSignature.
 
idSignature ID.
<IPS_POLICY_ID> Policy ID.
Example: 1234
 
nameSignature name.
<IPS_POLICY_NAME> Policy name.
Example: ActivePDF WebGrabber ActiveX Instantiation

Example

no ips category name ACTIVEX signature name "Free Tetris Executable (Adware)"

Syntax

no ips policies

Mode

Match Object

Description

Delete all IPS policies.

Example

no ips policies

Syntax

category { id <AC_CATEGORY_ID> | name <AC_CATEGORY_NAME> }

Mode

Match Object

Description

Add an application category.

Options

 
idCategory ID.
<AC_CATEGORY_ID> Category ID.
Example: 123
 
nameCategory name.
<AC_CATEGORY_NAME> Category name.
Example: APP-UPDATE

Example

category name APP-UPDATE

category id 22

Syntax

no category { id <AC_CATEGORY_ID> | name <AC_CATEGORY_NAME> }

Mode

Match Object

Description

Delete an application category.

Options

 
idCategory ID.
<AC_CATEGORY_ID> Category ID.
Example: 123
 
nameCategory name.
<AC_CATEGORY_NAME> Category name.
Example: APP-UPDATE

Example

no category name APP-UPDATE

no category id 22

Syntax

no categories

Mode

Match Object

Description

Delete all application categories.

Example

no categories

Syntax

application category { id <AC_CATEGORY_ID> | name <AC_CATEGORY_NAME> } app { id <AC_APP_ID> | name <AC_APP_NAME> }

Mode

Match Object

Description

Add an application.

Options

categoryApplication category.
 
idCategory ID.
<AC_CATEGORY_ID> Category ID.
Example: 123
 
nameCategory name.
<AC_CATEGORY_NAME> Category name.
Example: APP-UPDATE
appApplication.
 
idApplication ID.
<AC_APP_ID> Application ID.
Example: 123
 
nameApplication name.
<AC_APP_NAME> Application name.
Example: APP-UPDATE

Example

application category name BACKUP-APPS app name Dropbox

application category id 56 app id 604

Syntax

no application category { id <AC_CATEGORY_ID> | name <AC_CATEGORY_NAME> } app { id <AC_APP_ID> | name <AC_APP_NAME> }

Mode

Match Object

Description

Delete an application.

Options

categoryApplication category.
 
idCategory ID.
<AC_CATEGORY_ID> Category ID.
Example: 123
 
nameCategory name.
<AC_CATEGORY_NAME> Category name.
Example: APP-UPDATE
appApplication.
 
idApplication ID.
<AC_APP_ID> Application ID.
Example: 123
 
nameApplication name.
<AC_APP_NAME> Application name.
Example: APP-UPDATE

Example

no application category name BACKUP-APPS app name Dropbox

no application category id 56 app id 604

Syntax

no applications

Mode

Match Object

Description

Delete all applications.

Example

no applications

Syntax

signature category { id <AC_CATEGORY_ID> | name <AC_CATEGORY_NAME> } app { id <AC_APP_ID> | name <AC_APP_NAME> } sig { id <AC_SIG_ID> | name <AC_SIG_NAME> }

Mode

Match Object

Description

Add a signature.

Options

categoryApplication category.
 
idCategory ID.
<AC_CATEGORY_ID> Category ID.
Example: 123
 
nameCategory name.
<AC_CATEGORY_NAME> Category name.
Example: APP-UPDATE
appApplication.
 
idApplication ID.
<AC_APP_ID> Application ID.
Example: 123
 
nameApplication name.
<AC_APP_NAME> Application name.
Example: APP-UPDATE
sigSignature.
 
idSignature ID.
<AC_SIG_ID> Signature ID.
Example: 123
 
nameSignature name.
<AC_SIG_NAME> Signature name.

Example

signature category name BACKUP-APPS app name Dropbox sig name "SSL Traffic"

signature category id 56 app id 604 sig id 1736

Syntax

no signature category { id <AC_CATEGORY_ID> | name <AC_CATEGORY_NAME> } app { id <AC_APP_ID> | name <AC_APP_NAME> } sig { id <AC_SIG_ID> | name <AC_SIG_NAME> }

Mode

Match Object

Description

Delete a signature.

Options

categoryApplication category.
 
idCategory ID.
<AC_CATEGORY_ID> Category ID.
Example: 123
 
nameCategory name.
<AC_CATEGORY_NAME> Category name.
Example: APP-UPDATE
appApplication.
 
idApplication ID.
<AC_APP_ID> Application ID.
Example: 123
 
nameApplication name.
<AC_APP_NAME> Application name.
Example: APP-UPDATE
sigSignature.
 
idSignature ID.
<AC_SIG_ID> Signature ID.
Example: 123
 
nameSignature name.
<AC_SIG_NAME> Signature name.

Example

no signature category name BACKUP-APPS app name Dropbox sig name "SSL Traffic"

no signature category id 56 app id 604 sig id 1736

Syntax

no signatures

Mode

Match Object

Description

Delete all signatures.

Example

no signatures

Syntax

cfs category { abortion-advocacy-groups | adult-mature-content | advertisement | alcohol-tobacco | all | arts-entertainment | business-economy | chat-instant-messaging | cult-occult | cultural-institutions | drugs-illegal-drugs | e-mail | education | freeware-software-downloads | gambling | games | gay-lesbian-issues | government | hacking-proxy-avoidance-systems | health | humor-jokes | illegal-questionable-skills | information-technology-computers | internet-auctions | internet-watch-foundation | intimate-apparel-swimsuit | job-search | kid-friendly | malware | military | multimedia | news-media | not-rated | nudism | online-banking | online-brokerage-trading | other | pay-to-surf-sites | personals-dating | political-advocacy-groups | pornography | real-estate | reference | religion | restaurants-dining | search-engine-portals | sex-education | shopping | social-networking | society-lifestyle | sports-recreation | travel | usernet-news-groups | vehicles | violence-hate-racism | weapons | web-communication | web-hosting }

Mode

Match Object

Description

Enable a CFS category.

Options

 
abortion-advocacy-groupsRating.
 
adult-mature-contentRating.
 
advertisementRating.
 
alcohol-tobaccoRating.
 
allAll ratings.
 
arts-entertainmentRating.
 
business-economyRating.
 
chat-instant-messagingRating.
 
cult-occultRating.
 
cultural-institutionsRating.
 
drugs-illegal-drugsRating.
 
e-mailRating.
 
educationRating.
 
freeware-software-downloadsRating.
 
gamblingRating.
 
gamesRating.
 
gay-lesbian-issuesRating.
 
governmentRating.
 
hacking-proxy-avoidance-systemsRating.
 
healthRating.
 
humor-jokesRating.
 
illegal-questionable-skillsRating.
 
information-technology-computersRating.
 
internet-auctionsRating.
 
internet-watch-foundationRating.
 
intimate-apparel-swimsuitRating.
 
job-searchRating.
 
kid-friendlyRating.
 
malwareRating.
 
militaryRating.
 
multimediaRating.
 
news-mediaRating.
 
not-ratedRating.
 
nudismRating.
 
online-bankingRating.
 
online-brokerage-tradingRating.
 
otherRating.
 
pay-to-surf-sitesRating.
 
personals-datingRating.
 
political-advocacy-groupsRating.
 
pornographyRating.
 
real-estateRating.
 
referenceRating.
 
religionRating.
 
restaurants-diningRating.
 
search-engine-portalsRating.
 
sex-educationRating.
 
shoppingRating.
 
social-networkingRating.
 
society-lifestyleRating.
 
sports-recreationRating.
 
travelRating.
 
usernet-news-groupsRating.
 
vehiclesRating.
 
violence-hate-racismRating.
 
weaponsRating.
 
web-communicationRating.
 
web-hostingRating.

Example

cfs category pornography

Syntax

no cfs category { abortion-advocacy-groups | adult-mature-content | advertisement | alcohol-tobacco | all | arts-entertainment | business-economy | chat-instant-messaging | cult-occult | cultural-institutions | drugs-illegal-drugs | e-mail | education | freeware-software-downloads | gambling | games | gay-lesbian-issues | government | hacking-proxy-avoidance-systems | health | humor-jokes | illegal-questionable-skills | information-technology-computers | internet-auctions | internet-watch-foundation | intimate-apparel-swimsuit | job-search | kid-friendly | malware | military | multimedia | news-media | not-rated | nudism | online-banking | online-brokerage-trading | other | pay-to-surf-sites | personals-dating | political-advocacy-groups | pornography | real-estate | reference | religion | restaurants-dining | search-engine-portals | sex-education | shopping | social-networking | society-lifestyle | sports-recreation | travel | usernet-news-groups | vehicles | violence-hate-racism | weapons | web-communication | web-hosting }

Mode

Match Object

Description

Disable a CFS category.

Options

 
abortion-advocacy-groupsRating.
 
adult-mature-contentRating.
 
advertisementRating.
 
alcohol-tobaccoRating.
 
allAll ratings.
 
arts-entertainmentRating.
 
business-economyRating.
 
chat-instant-messagingRating.
 
cult-occultRating.
 
cultural-institutionsRating.
 
drugs-illegal-drugsRating.
 
e-mailRating.
 
educationRating.
 
freeware-software-downloadsRating.
 
gamblingRating.
 
gamesRating.
 
gay-lesbian-issuesRating.
 
governmentRating.
 
hacking-proxy-avoidance-systemsRating.
 
healthRating.
 
humor-jokesRating.
 
illegal-questionable-skillsRating.
 
information-technology-computersRating.
 
internet-auctionsRating.
 
internet-watch-foundationRating.
 
intimate-apparel-swimsuitRating.
 
job-searchRating.
 
kid-friendlyRating.
 
malwareRating.
 
militaryRating.
 
multimediaRating.
 
news-mediaRating.
 
not-ratedRating.
 
nudismRating.
 
online-bankingRating.
 
online-brokerage-tradingRating.
 
otherRating.
 
pay-to-surf-sitesRating.
 
personals-datingRating.
 
political-advocacy-groupsRating.
 
pornographyRating.
 
real-estateRating.
 
referenceRating.
 
religionRating.
 
restaurants-diningRating.
 
search-engine-portalsRating.
 
sex-educationRating.
 
shoppingRating.
 
social-networkingRating.
 
society-lifestyleRating.
 
sports-recreationRating.
 
travelRating.
 
usernet-news-groupsRating.
 
vehiclesRating.
 
violence-hate-racismRating.
 
weaponsRating.
 
web-communicationRating.
 
web-hostingRating.

Example

no cfs category pornography

Syntax

no cfs categories

Mode

Match Object

Description

Disable all CFS categories.

Example

no cfs categories

Syntax

action-object <ACTION_OBJ_NAME>

Mode

Config

Description

Create/edit specified action object and enter its configuration mode.

Options

<ACTION_OBJ_NAME> Action object name.
Example: HTTP Block Page

Example

action-object "Corp E-mail Message"

Syntax

no action-object <ACTION_OBJ_NAME>

Mode

Config

Description

Delete specified action object.

Options

<ACTION_OBJ_NAME> Action object name.
Example: HTTP Block Page

Example

no action-object "Corp E-mail Message"

Syntax

no action-objects

Mode

Config

Description

Delete all action objects.

Example

no action-objects

Syntax

name <ACTION_OBJ_NAME>

Mode

Action Object

Description

Action object name.

Options

<ACTION_OBJ_NAME> Action object name.
Example: HTTP Block Page

Example

name "Corp Mail Message"

Syntax

action { bandwidth-management | block-smtp-error-reply | disable-email-attachment | email-add-text | ftp-notification-reply | http-block-page | http-redirect }

Mode

Action Object

Description

Set action.

Options

 
bandwidth-managementBandwidth management.
 
block-smtp-error-replyBlock SMTP e-mail and send error reply.
 
disable-email-attachmentDisable e-mail attachment and add text.
 
email-add-textE-mail - add text.
 
ftp-notification-replyFTP notification reply.
 
http-block-pageHTTP block page.
 
http-redirectHTTP redirect.

Example

action block-smtp-email error-reply

Syntax

no content

Mode

Action Object

Description

Clear action object content.

Example

no content

Syntax

content <WORD>

Mode

Action Object

Description

Action object content.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

content "Corporate does not allow attachments to Emails."

Syntax

no color

Mode

Action Object

Description

Clear HTTP block page color.

Example

no color

Syntax

color { blue | red | white | yellow }

Mode

Action Object

Description

HTTP block page color.

Options

 
blueBlue.
 
redRed.
 
whiteWhite.
 
yellowYellow.

Example

color white

Syntax

bandwidth-management

Mode

Action Object

Description

Configure bandwidth management.

Example

bandwidth-management

Syntax

aggregation-method { per-action | per-policy }

Mode

Bandwidth Management

Description

Set the bandwidth aggregation method.

Options

 
per-actionPer action.
 
per-policyPer policy.

Example

aggregation-method per-policy

Syntax

no egress [ bandwidth-object ]

Mode

Bandwidth Management

Description

Disable egress bandwidth management.

Options

bandwidth-objectClear bandwidth object.

Example

no egress

Syntax

egress priority { high | highest | low | lowest | medium | medium-high | medium-low | realtime }

Mode

Bandwidth Management

Description

Enable egress bandwidth management and set priority.

Options

 
highHigh 2.
 
highestHighest 1.
 
lowLow 6.
 
lowestLowest 1.
 
mediumMedium 4.
 
medium-highMedium-high 3.
 
medium-lowMedium-low 5.
 
realtimeRealtime 0.

Example

egress priority highest

Syntax

egress bandwidth-object <BANDWIDTH_RULE_NAME>

Mode

Bandwidth Management

Description

Enable egress bandwidth management and configure.

Options

<BANDWIDTH_RULE_NAME> Bandwidth object name.
Example: \"Corp High Priority\"

Example

egress bandwidth-object "Corp High Priority"

Syntax

no igress [ bandwidth-object ]

Mode

Bandwidth Management

Description

Disable igress bandwidth management.

Options

bandwidth-objectClear bandwidth object.

Example

no igress

Syntax

igress priority { high | highest | low | lowest | medium | medium-high | medium-low | realtime }

Mode

Bandwidth Management

Description

Enable ingress bandwidth management and set priority.

Options

 
highHigh 2.
 
highestHighest 1.
 
lowLow 6.
 
lowestLowest 1.
 
mediumMedium 4.
 
medium-highMedium-high 3.
 
medium-lowMedium-low 5.
 
realtimeRealtime 0.

Example

igress priority highest

Syntax

igress bandwidth-object <BANDWIDTH_RULE_NAME>

Mode

Bandwidth Management

Description

Enable ingress bandwidth management and configure.

Options

<BANDWIDTH_RULE_NAME> Bandwidth object name.
Example: \"Corp High Priority\"

Example

igress bandwidth-object "Corp High Priority"

Syntax

usage-tracking

Mode

Bandwidth Management

Description

Enable tracking bandwidth usage.

Example

usage-tracking

Syntax

no usage-tracking

Mode

Bandwidth Management

Description

Disable tracking bandwidth usage.

Example

no usage-tracking

Syntax

no email-object <EMAIL_OBJ_NAME>

Mode

Config

Description

Delete an e-mail address object.

Options

<EMAIL_OBJ_NAME> E-mail object name.
Example: Marketing E-mail Object

Example

no email-object "Client E-mail Addresses"

Syntax

no email-objects

Mode

Config

Description

Delete all e-mail address objects.

Example

no email-objects

Syntax

email-object <EMAIL_OBJ_NAME>

Mode

Config

Description

Add/edit e-mail address object and enter configuration mode.

Options

<EMAIL_OBJ_NAME> E-mail object name.
Example: Marketing E-mail Object

Example

email-object "Client E-mail Addresses"

Syntax

name <EMAIL_OBJ_NAME>

Mode

E-mail Address Object

Description

Set e-mail address object name.

Options

<EMAIL_OBJ_NAME> E-mail object name.
Example: Marketing E-mail Object

Example

name "Client E-mail Addresses "

Syntax

no match-type

Mode

E-mail Address Object

Description

Clear e-mail address object match type.

Example

no match-type

Syntax

match-type { exact | partial | regex }

Mode

E-mail Address Object

Description

Set e-mail address object match type.

Options

 
exactExact match.
 
partialPartial match.
 
regexRegular expression match.

Example

match-type exact

Syntax

content-entry <EMAIL_OBJ_CONTENT_ENTRY>

Mode

E-mail Address Object

Description

Add e-mail address object content entry.

Options

<EMAIL_OBJ_CONTENT_ENTRY> E-mail object content.
Example: administrator@corp.local

Example

content-entry administrator@corp.local

Syntax

no content-entry <EMAIL_OBJ_CONTENT_ENTRY>

Mode

E-mail Address Object

Description

Delete e-mail address object content entry.

Options

<EMAIL_OBJ_CONTENT_ENTRY> E-mail object content.
Example: administrator@corp.local

Example

no content-entry administrator@corp.local

Syntax

no content-entries

Mode

E-mail Address Object

Description

Delete all e-mail address object content entries.

Example

no content-entries

Syntax

app-control

Mode

Config

Description

Enter App Control Configuration Mode.

Example

app-control

Syntax

update-signatures

Mode

App Control

Description

Update signature database.

Example

update-signatures

Syntax

enable

Mode

App Control

Description

Enable App Control.

Example

enable

Syntax

no enable

Mode

App Control

Description

Disable App Control.

Example

no enable

Syntax

log-all

Mode

App Control

Description

Enable logging for all apps.

Example

log-all

Syntax

no log-all

Mode

App Control

Description

Disable logging for all apps.

Example

no log-all

Syntax

reset-settings

Mode

App Control

Description

Reset App Control Settings to default.

Example

reset-settings

Syntax

category { id <AC_CATEGORY_ID> | name <AC_CATEGORY_NAME> }

Mode

App Control

Description

Enter configuration mode for the specified App Control Category.

Options

 
idCategory ID.
<AC_CATEGORY_ID> Category ID.
Example: 123
 
nameCategory name.
<AC_CATEGORY_NAME> Category name.
Example: APP-UPDATE

Example

category name "GAMING"

Syntax

exclusion list { ips | object { group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_RANGE_GROUP> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> } }

Mode

App Control

Description

Enable and Configure Application Control Exclusion List.

Options

 
ipsUse IPS Exclusion List.
 
objectUse specified address object for exclusion list.
 
groupAddress Object Group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress Object Host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameSpecify name of Address Object.
<ADDR_RANGE_GROUP> Range group address object name.
Example: Public Servers Group
 
networkAddress Object Network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeSpecify IP Range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

exclusion list ips

exclusion list object name "Corp App Control Exclusion List"
exclusion list object range 10.10.10.1 10.10.10.10

Syntax

no exclusion list

Mode

App Control

Description

Disable Application Control Exclusion List.

Example

no exclusion list

Syntax

application category { id <AC_CATEGORY_ID> | name <AC_CATEGORY_NAME> } app { id <AC_APP_ID> | name <AC_APP_NAME> }

Mode

App Control

Description

Enter configuration mode for the specified Application Control Application.

Options

categoryCategory.
 
idCategory ID.
<AC_CATEGORY_ID> Category ID.
Example: 123
 
nameCategory name.
<AC_CATEGORY_NAME> Category name.
Example: APP-UPDATE
appSpecify an application.
 
idApp ID.
<AC_APP_ID> Application ID.
Example: 123
 
nameApp name.
<AC_APP_NAME> Application name.
Example: APP-UPDATE

Example

application category name GAMING app name "Build-A-Bearville Online"

Syntax

signature category { id <AC_CATEGORY_ID> | name <AC_CATEGORY_NAME> } app { id <AC_APP_ID> | name <AC_APP_NAME> } sig { id <AC_SIG_ID> | name <AC_SIG_NAME> }

Mode

App Control

Description

Enter configuration mode for the specified Application Control Signature.

Options

categoryCategory.
 
idCategory ID.
<AC_CATEGORY_ID> Category ID.
Example: 123
 
nameCategory name.
<AC_CATEGORY_NAME> Category name.
Example: APP-UPDATE
appSpecify an application.
 
idApp ID.
<AC_APP_ID> Application ID.
Example: 123
 
nameApp name.
<AC_APP_NAME> Application name.
Example: APP-UPDATE
sigSpecify an signature.
 
idSignature ID.
<AC_SIG_ID> Signature ID.
Example: 123
 
nameSignature name.
<AC_SIG_NAME> Signature name.

Example

signature category name APP-UPDATE app name 360Safe sig name "Update Traffic 6"

Syntax

name <WORD>

Mode

App Control Category

App Control Application
App Control Signature

Description

Policy name.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

name GAMING

Syntax

id <UINT32>

Mode

App Control Category

App Control Application
App Control Signature

Description

Policy ID.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

id 8

Syntax

block { disable | enable }

Mode

App Control Category

Description

Set Prevention for App Control Category.

Options

 
disableDisable.
 
enableEnable.

Example

block enable

Syntax

log { disable | enable | global-setting }

Mode

App Control Category

Description

Set Logging for App Control Category.

Options

 
disableEnable.
 
enableEnable.
 
global-settingUse Global Setting.

Example

log enable

Syntax

included users { administrator | all | group <LOCAL_USER_GROUP_NAME> | guests | name <LOCAL_USER_NAME> }

Mode

App Control Category

Description

Set Included Users/Groups.

Options

 
administratorBuilt-in administrator.
 
allAll.
 
groupSpecify local user group.
<LOCAL_USER_GROUP_NAME> User group object name.
Example: Limited Administrators
 
guestsGuests.
 
nameSpecify local user.
<LOCAL_USER_NAME> User object name.
Example: user1

Example

included users all

Syntax

excluded users { administrator | group <LOCAL_USER_GROUP_NAME> | guests | name <LOCAL_USER_NAME> | none }

Mode

App Control Category

Description

Set Excluded Users/Groups.

Options

 
administratorBuilt-in administrator.
 
groupSpecify local user group.
<LOCAL_USER_GROUP_NAME> User group object name.
Example: Limited Administrators
 
guestsGuests.
 
nameSpecify local user.
<LOCAL_USER_NAME> User object name.
Example: user1
 
noneNone.

Example

excluded users guests

Syntax

included ip { all | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_RANGE_GROUP> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> }

Mode

App Control Category

Description

Set Included IP address Range.

Options

 
allAll.
 
groupAddress Object Group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress Object Host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameSpecify name of Range Address Object.
<ADDR_RANGE_GROUP> Range group address object name.
Example: Public Servers Group
 
networkAddress Object Network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeSpecify IP Range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

included ip range 10.10.10.1 10.10.10.10

Syntax

excluded ip { group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_RANGE_GROUP> | network <ADDR_NETWORK> <ADDR_MASK> | none | range <ADDR_BEGIN> <ADDR_END> }

Mode

App Control Category

Description

Set Excluded IP address Range.

Options

 
groupAddress Object Group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress Object Host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameSpecify name of Range Address Object.
<ADDR_RANGE_GROUP> Range group address object name.
Example: Public Servers Group
 
networkAddress Object Network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
noneNone.
 
rangeSpecify IP Range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

excluded ip range 10.10.10.1 10.10.10.10

Syntax

schedule { always-on | days <SCHED_DAYS> time <SCHED_TIME_BEGIN> <SCHED_TIME_END> | name <SCHED_NAME> }

Mode

App Control Category

Description

Set IPS category schedule.

Options

 
always-onAlways on.
 
daysSchedule Object days.
<SCHED_DAYS> Days of the week in the form: SU-M-T-W-TH-F-SA.
Example: SU-M-TH-SA
timeSchedule Object beginning/ending time.
<SCHED_TIME_BEGIN> Time in the form: DD:DD.
Example: 12:00
<SCHED_TIME_END> Time in the form: DD:DD.
Example: 12:00
 
nameSchedule Object name.
<SCHED_NAME> Schedule object name.
Example: Work Hours

Example

schedule always-on

Syntax

log-redundancy filter <UINT16>

Mode

App Control Category

Description

Set IPS category log redundancy filter.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

log-redundancy filter 45

Syntax

block { category-setting | disable | enable }

Mode

App Control Application

Description

Set Blocking for App Control Application.

Options

 
category-settingUse Category Setting.
 
disableEnable.
 
enableEnable.

Example

block enable

Syntax

log { category-setting | disable | enable }

Mode

App Control Application

Description

Set Logging for App Control Application.

Options

 
category-settingUse Category Setting.
 
disableEnable.
 
enableEnable.

Example

log enable

Syntax

included users { administrator | all | category-setting | group <LOCAL_USER_GROUP_NAME> | guests | name <LOCAL_USER_NAME> }

Mode

App Control Application

Description

Set Included Users/Groups.

Options

 
administratorBuilt-in administrator.
 
allAll.
 
category-settingUse Category Setting.
 
groupSpecify local user group.
<LOCAL_USER_GROUP_NAME> User group object name.
Example: Limited Administrators
 
guestsGuests.
 
nameSpecify local user.
<LOCAL_USER_NAME> User object name.
Example: user1

Example

included users all

Syntax

excluded users { administrator | category-setting | group <LOCAL_USER_GROUP_NAME> | guests | name <LOCAL_USER_NAME> | none }

Mode

App Control Application

Description

Set Excluded Users/Groups.

Options

 
administratorBuilt-in administrator.
 
category-settingUse Category Setting.
 
groupSpecify local user group.
<LOCAL_USER_GROUP_NAME> User group object name.
Example: Limited Administrators
 
guestsGuests.
 
nameSpecify local user.
<LOCAL_USER_NAME> User object name.
Example: user1
 
noneNone.

Example

excluded users guests

Syntax

included ip { all | category-setting | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_RANGE_GROUP> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> }

Mode

App Control Application

Description

Set Included IP address Range.

Options

 
allAll.
 
category-settingUse Category Setting.
 
groupAddress Object Group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress Object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress Object name.
<ADDR_RANGE_GROUP> Range group address object name.
Example: Public Servers Group
 
networkAddress Object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress Object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

included ip range 10.10.10.1 10.10.10.10

Syntax

excluded ip { category-setting | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_RANGE_GROUP> | network <ADDR_NETWORK> <ADDR_MASK> | none | range <ADDR_BEGIN> <ADDR_END> }

Mode

App Control Application

Description

Set Excluded IP address Range.

Options

 
category-settingUse Category Setting.
 
groupAddress Object Group.
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress Object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress Object name.
<ADDR_RANGE_GROUP> Range group address object name.
Example: Public Servers Group
 
networkAddress Object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
noneNone.
 
rangeAddress Object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

excluded ip range 10.10.10.1 10.10.10.10

Syntax

schedule { always-on | category-setting | days <SCHED_DAYS> time <SCHED_TIME_BEGIN> <SCHED_TIME_END> | name <SCHED_NAME> }

Mode

App Control Application

Description

Set App Control application schedule.

Options

 
always-onAlways on.
 
category-settingUse Category Setting.
 
daysSchedule Object days.
<SCHED_DAYS> Days of the week in the form: SU-M-T-W-TH-F-SA.
Example: SU-M-TH-SA
timeSchedule Object beginning/ending time.
<SCHED_TIME_BEGIN> Time in the form: DD:DD.
Example: 12:00
<SCHED_TIME_END> Time in the form: DD:DD.
Example: 12:00
 
nameSchedule Object name.
<SCHED_NAME> Schedule object name.
Example: Work Hours

Example

schedule always-on

Syntax

log-redundancy { category-setting | filter <UINT16> }

Mode

App Control Application

Description

Set IPS application log redundancy filter.

Options

 
category-settingUse Category Setting.
 
filterSet log redundancy filter in seconds.
<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

log-redundancy filter 45

Syntax

block { app-setting | disable | enable }

Mode

App Control Signature

Description

Set Blocking for App Control Signature.

Options

 
app-settingUse App Setting.
 
disableEnable.
 
enableEnable.

Example

block enable

Syntax

log { app-setting | disable | enable }

Mode

App Control Signature

Description

Set Logging for App Control Signature.

Options

 
app-settingUse App Setting.
 
disableEnable.
 
enableEnable.

Example

log enable

Syntax

included users { administrator | all | app-setting | group <LOCAL_USER_GROUP_NAME> | guests | name <LOCAL_USER_NAME> }

Mode

App Control Signature

Description

Set Included Users/Groups.

Options

 
administratorBuilt-in administrator.
 
allAll.
 
app-settingUse App Setting.
 
groupSpecify local user group.
<LOCAL_USER_GROUP_NAME> User group object name.
Example: Limited Administrators
 
guestsGuests.
 
nameSpecify local user.
<LOCAL_USER_NAME> User object name.
Example: user1

Example

included users all

Syntax

excluded users { administrator | app-setting | group <LOCAL_USER_GROUP_NAME> | guests | name <LOCAL_USER_NAME> | none }

Mode

App Control Signature

Description

Set Excluded Users/Groups.

Options

 
administratorBuilt-in administrator.
 
app-settingUse App Setting.
 
groupSpecify local user group.
<LOCAL_USER_GROUP_NAME> User group object name.
Example: Limited Administrators
 
guestsGuests.
 
nameSpecify local user.
<LOCAL_USER_NAME> User object name.
Example: user1
 
noneNone.

Example

excluded users guests

Syntax

included ip { all | app-setting | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_RANGE_GROUP> | network <ADDR_NETWORK> <ADDR_MASK> | range <ADDR_BEGIN> <ADDR_END> }

Mode

App Control Signature

Description

Set Included IP address Range.

Options

 
allAll.
 
app-settingUse App Setting.
 
groupAddress Object Group
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress Object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress Object name.
<ADDR_RANGE_GROUP> Range group address object name.
Example: Public Servers Group
 
networkAddress Object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeAddress Object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

included ip range 10.10.10.1 10.10.10.10

Syntax

excluded ip { app-setting | group <ADDR_GROUP_NAME> | host <ADDR_HOST> | name <ADDR_RANGE_GROUP> | network <ADDR_NETWORK> <ADDR_MASK> | none | range <ADDR_BEGIN> <ADDR_END> }

Mode

App Control Signature

Description

Set Excluded IP address Range.

Options

 
app-settingUse App Setting.
 
groupAddress Object Group
<ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostAddress Object host.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress Object name.
<ADDR_RANGE_GROUP> Range group address object name.
Example: Public Servers Group
 
networkAddress Object network.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
noneNone.
 
rangeAddress Object range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

excluded ip range 10.10.10.1 10.10.10.10

Syntax

schedule { always-on | app-setting | days <SCHED_DAYS> time <SCHED_TIME_BEGIN> <SCHED_TIME_END> | name <SCHED_NAME> }

Mode

App Control Signature

Description

Set IPS signature schedule.

Options

 
always-onAlways on.
 
app-settingUse App Setting.
 
daysSchedule Object days.
<SCHED_DAYS> Days of the week in the form: SU-M-T-W-TH-F-SA.
Example: SU-M-TH-SA
timeSchedule Object beginning/ending time.
<SCHED_TIME_BEGIN> Time in the form: DD:DD.
Example: 12:00
<SCHED_TIME_END> Time in the form: DD:DD.
Example: 12:00
 
nameSchedule Object name.
<SCHED_NAME> Schedule object name.
Example: Work Hours

Example

schedule always-on

Syntax

log-redundancy { app-setting | filter <UINT16> }

Mode

App Control Signature

Description

Set IPS signature log redundancy filter.

Options

 
app-settingUse App Setting.
 
filterSet log redundancy filter in seconds.
<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

log-redundancy filter 45

Syntax

rbl

Mode

Config

Description

Enter Real-Time Blacklist Configuration Mode.

Example

rbl

Syntax

enable

Mode

RBL

Description

Enable Real-Time Blacklist Blocking.

Example

enable

Syntax

no enable

Mode

RBL

Description

Disable Real-Time Blacklist Blocking.

Example

no enable

Syntax

dns { inherit | primary <IPV4_HOST> | secondary <IPV4_HOST> | tertiary <IPV4_HOST> }

Mode

RBL

Description

Set whether RBL DNS is inherited from WAN Zone or set manually with the associated DNS server IP addresses.

Options

 
inheritInherit DNS servers.
 
primarySpecify primary DNS server IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
 
secondarySpecify secondary DNS server IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
 
tertiarySpecify tertiary DNS server IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

dns primary 192.168.168.165

Syntax

no dns { primary | secondary | tertiary }

Mode

RBL

Description

Manually Clear DNS server IP address.

Options

 
primaryClear primary DNS server IP address.
 
secondaryClear secondary DNS server IP address.
 
tertiaryClear tertiary DNS server IP address.

Example

no dns primary

Syntax

service { enable <RBL_SERVICE_NAME> | name <RBL_SERVICE_NAME> }

Mode

RBL

Description

Enable/Add/Edit Real-Time Blacklist Service.

Options

 
enableEnable specified parameter.
<RBL_SERVICE_NAME> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
nameReal-Time Blacklist Service Name.
<RBL_SERVICE_NAME> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

service name avidspamsender.local

Syntax

no service { enable <RBL_SERVICE_NAME> | name <RBL_SERVICE_NAME> }

Mode

RBL

Description

Delete Real-Time Blacklist Service.

Options

 
enableEnable specified parameter.
<RBL_SERVICE_NAME> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
nameReal-Time Blacklist Service Name.
<RBL_SERVICE_NAME> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

no service enable xxx.org

Syntax

no services

Mode

RBL

Description

Delete all RBL services.

Example

no services

Syntax

no statistics [ name <RBL_SERVICE_NAME> ]

Mode

RBL

Description

Clear all or specified RBL service statistics.

Options

nameRBL service name.
<RBL_SERVICE_NAME> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

no statistics

no statistics name "dnsbl.sorbs.net"

Syntax

blacklist { fqdn <ADDR_FQDN> | host <ADDR_HOST> | name <RBL_ADDR_NAME> | range <ADDR_BEGIN> <ADDR_END> }

Mode

RBL

Description

Add SMTP server to blacklist.

Options

 
fqdnSMTP server Full Qualified Domain Name.
<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
hostSMTP server host address.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameSMTP server named host address object.
<RBL_ADDR_NAME> Address object name.
Example: Web Server
 
rangeSMTP server Range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

blacklist host 168.226.49.15

Syntax

no blacklist { fqdn <RBL_ADDR_FQDN> | host <RBL_ADDR_HOST> | name <RBL_ADDR_NAME> | range <RBL_ADDR_BEGIN> <RBL_ADDR_END> }

Mode

RBL

Description

Remove SMTP server from blacklist.

Options

 
fqdnSMTP server Full Qualified Domain Name.
<RBL_ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
hostSMTP server host address.
<RBL_ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameSMTP server named host address object.
<RBL_ADDR_NAME> Address object name.
Example: Web Server
 
rangeSMTP server Range.
<RBL_ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<RBL_ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

no blacklist host 168.226.49.15

Syntax

whitelist { fqdn <ADDR_FQDN> | host <ADDR_HOST> | name <RBL_ADDR_NAME> | range <ADDR_BEGIN> <ADDR_END> }

Mode

RBL

Description

Add SMTP server to whitelist.

Options

 
fqdnSMTP server Full Qualified Domain Name.
<ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
hostSMTP server host address.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameSMTP server named host address object.
<RBL_ADDR_NAME> Address object name.
Example: Web Server
 
rangeSMTP server Range.
<ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

whitelist host 168.226.49.15

Syntax

no whitelist { fqdn <RBL_ADDR_FQDN> | host <RBL_ADDR_HOST> | name <RBL_ADDR_NAME> | range <RBL_ADDR_BEGIN> <RBL_ADDR_END> }

Mode

RBL

Description

Remove SMTP server from whitelist.

Options

 
fqdnSMTP server Full Qualified Domain Name.
<RBL_ADDR_FQDN> FQDN in the form: example.com or *.example.com.
Example: example.com
 
hostSMTP server host address.
<RBL_ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameSMTP server named host address object.
<RBL_ADDR_NAME> Address object name.
Example: Web Server
 
rangeSMTP server Range.
<RBL_ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<RBL_ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

no whitelist host 168.226.49.15

Syntax

enable

Mode

RBL Service

Description

Enable Real-Time Blacklist Domain.

Example

enable

Syntax

no enable

Mode

RBL Service

Description

Disable Real-Time Blacklist Domain.

Example

no enable

Syntax

domain <HOSTNAME>

Mode

RBL Service

Description

Set Real-Time Blacklist Service Domain Name.

Options

<HOSTNAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com

Example

domain avidspamsender.local

Syntax

blocked-responses [ open-relay ] [ dialup-spam-source ] [ spam-source ] [ smart-host ] [ spamware-site ] [ bad-list-server ] [ insecure-script ] [ open-proxy-server ] [ block-all ]

Mode

RBL Service

Description

Enable specified RBL Blocked Responses.

Options

open-relay127.0.0.2 - Open Relay.
dialup-spam-source127.0.0.3 - Dialup Spam Source.
spam-source127.0.0.4 - Spam Source.
smart-host127.0.0.5 - Smart Host.
spamware-site127.0.0.6 - Spamware Site.
bad-list-server127.0.0.7 - Bad List Server.
insecure-script127.0.0.8 - Insecure Script.
open-proxy-server127.0.0.9 - Open Proxy Server.
block-allBlock All Responses.

Example

blocked-responses open-relay spamware-site

Syntax

no blocked-responses [ open-relay ] [ dialup-spam-source ] [ spam-source ] [ smart-host ] [ spamware-site ] [ bad-list-server ] [ insecure-script ] [ open-proxy-server ] [ block-all ]

Mode

RBL Service

Description

Disable specified RBL Blocked Responses.

Options

open-relay127.0.0.2 - Open Relay.
dialup-spam-source127.0.0.3 - Dialup Spam Source.
spam-source127.0.0.4 - Spam Source.
smart-host127.0.0.5 - Smart Host.
spamware-site127.0.0.6 - Spamware Site.
bad-list-server127.0.0.7 - Bad List Server.
insecure-script127.0.0.8 - Insecure Script.
open-proxy-server127.0.0.9 - Open Proxy Server.
block-allBlock All Responses.

Example

no blocked-responses open-relay spamware-site

Syntax

show security-services [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show security services configuration.

Options

 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show security-services

Syntax

show intrusion-prevention [ categories | category { id <IPS_CATEGORY_ID> | name <IPS_CATEGORY_NAME> } | exclusion-list | policies | policy <IPS_POLICY_NAME> | status ] [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show Intrusion Prevention configuration.

Options

 
categoriesShow Intrusion Prevention categories.
 
categoryShow Intrusion Prevention category.
 
idCategory ID.
<IPS_CATEGORY_ID> Category ID.
Example: 1234
 
nameCategory name.
<IPS_CATEGORY_NAME> Category name.
Example: ACTIVEX
 
exclusion-listShow Intrusion Prevention exclusion list.
 
policiesShow Intrusion Prevention policies.
 
policyShow Intrusion Prevention policy.
<IPS_POLICY_NAME> Policy name.
Example: ActivePDF WebGrabber ActiveX Instantiation
 
statusShow Intrusion Prevention status.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show intrusion-prevention

Syntax

show gateway-antivirus [ exclusion-list | signatures | status ] [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show Gateway Anti-Virus configuration.

Options

 
exclusion-listShow Gateway Anti-Virus exclusion list.
 
signaturesShow Gateway Anti-Virus signatures.
 
statusShow Gateway Anti-Virus status.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show gateway-antivirus

Syntax

show match-objects [ status ] [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show all match objects.

Options

statusShow match objects status.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show match-objects

Syntax

show match-object <MATCH_OBJ_NAME> [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show a match object.

Options

<MATCH_OBJ_NAME> Match object name.
Example: Match FTP
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show match-object "Match FTP"

Syntax

show action-objects [ status ] [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show all action objects.

Options

statusShow action objects status.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show action-objects

Syntax

show action-object <ACTION_OBJ_NAME> [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show action object configuration.

Options

<ACTION_OBJ_NAME> Action object name.
Example: HTTP Block Page
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show action-object CorpMailMessage

Syntax

show email-objects [ status ] [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show all e-mail address objects.

Options

statusShow e-mail user objects status.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show email-objects

Syntax

show email-object <EMAIL_OBJ_NAME> [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show an e-mail address Object.

Options

<EMAIL_OBJ_NAME> E-mail object name.
Example: Marketing E-mail Object
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show email-object "Client E-mail Addresses"

Syntax

show app-control [ application { id <AC_APP_ID> | name <AC_APP_NAME> } | applications | categories | category { id <AC_CATEGORY_ID> | name <AC_CATEGORY_NAME> } | exclusion-list | signature { app { id <AC_APP_ID> | name <AC_APP_NAME> } sig name <AC_SIG_NAME> | id <AC_SIG_ID> } | signatures | status ] [ { custom | default } ] [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show App Control configuration.

Options

 
applicationShow App Control application.
 
idApplication ID.
<AC_APP_ID> Application ID.
Example: 123
 
nameApplication name.
<AC_APP_NAME> Application name.
Example: APP-UPDATE
 
applicationsShow App Control applications.
 
categoriesShow App Control categories.
 
categoryShow App Control category.
 
idCategory ID.
<AC_CATEGORY_ID> Category ID.
Example: 123
 
nameCategory name.
<AC_CATEGORY_NAME> Category name.
Example: APP-UPDATE
 
exclusion-listShow App Control exclusion list.
 
signatureShow App Control signature.
 
appSpecify an App Control application.
 
idApplication ID.
<AC_APP_ID> Application ID.
Example: 123
 
nameApplication name.
<AC_APP_NAME> Application name.
Example: APP-UPDATE
sigSpecify a signature.
nameSignature name.
<AC_SIG_NAME> Signature name.
 
idSignature ID.
<AC_SIG_ID> Signature ID.
Example: 123
 
signaturesShow App Control signatures.
 
statusShow App Control status.
 
customShow custom configuration.
 
defaultShow system/factory default configuration.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show app-control

Syntax

show rbl [ blacklist | service <RBL_SERVICE_NAME> | services | statistics | whitelist ] [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show Real-Time Blacklist configuration.

Options

 
blacklistShow RBL blacklist.
 
serviceShow Real-Time Blacklist service.
<RBL_SERVICE_NAME> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
servicesShow Real-Time Blacklist services.
 
statisticsShow Real-Time Blacklist service statistics.
 
whitelistShow RBL whitelist.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show rbl

Syntax

virtual-assist

Mode

Config

Description

Enter virtual assist configuration mode.

Example

virtual-assist

Syntax

logout <CUSTOMER_ID>

Mode

Virtual Assist

Description

Logout specified virtual assist customer.

Options

<CUSTOMER_ID> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

logout myuser@acme.com

Syntax

assistance-code <WORD>

Mode

Virtual Assist

Description

Set virtual assist assistance code.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

assistance-code keyi0123

Syntax

no assistance-code

Mode

Virtual Assist

Description

Clear virtual assist assistance code.

Example

no assistance-code

Syntax

support-without-invitation

Mode

Virtual Assist

Description

Enable support without invitation.

Example

support-without-invitation

Syntax

no support-without-invitation

Mode

Virtual Assist

Description

Disable support without invitation.

Example

no support-without-invitation

Syntax

disclaimer <ROL>

Mode

Virtual Assist

Description

Set virtual assist disclaimer.

Options

<ROL> Remaining command line input.
Example: line...

Example

disclaimer "Disclaimer message."

Syntax

no disclaimer

Mode

Virtual Assist

Description

Clear virtual assist disclaimer.

Example

no disclaimer

Syntax

customer-access-link <WORD>

Mode

Virtual Assist

Description

Set virtual assist customer access link.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

customer-access-link www.virtualassistaccess.com

Syntax

no customer-access-link

Mode

Virtual Assist

Description

Clear virtual assist customer access link.

Example

no customer-access-link

Syntax

link-on-portal-login

Mode

Virtual Assist

Description

Enable display virtual assist link from portal login.

Example

link-on-portal-login

Syntax

no link-on-portal-login

Mode

Virtual Assist

Description

Disable display virtual assist link from portal login.

Example

no link-on-portal-login

Syntax

technician-email-list <ROL>

Mode

Virtual Assist

Description

Set virtual assist technician e-mail list.

Options

<ROL> Remaining command line input.
Example: line...

Example

technician-email-list myuser@acme.com

Syntax

no technician-email-list

Mode

Virtual Assist

Description

Clear virtual assist technician e-mail list.

Example

no technician-email-list

Syntax

invitation-subject <WORD>

Mode

Virtual Assist

Description

Set technician subject of invitation.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

invitation-subject "%EXPERTNAME% has sent you a support invitation"

Syntax

no invitation-subject

Mode

Virtual Assist

Description

Clear technician subject of invitation.

Example

no invitation-subject

Syntax

invitation-message <ROL>

Mode

Virtual Assist

Description

Set technician invitation message.

Options

<ROL> Remaining command line input.
Example: line...

Example

invitation-message "An assistance invitation has been generated for you"

Syntax

no invitation-message

Mode

Virtual Assist

Description

Clear technician invitation message.

Example

no invitation-message

Syntax

max-requests <UINT8>

Mode

Virtual Assist

Description

Set maximum requests.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

max-requests 10

Syntax

limit-message <WORD>

Mode

Virtual Assist

Description

Set technician limit message.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

limit-message "Maximum queue size reached, please try again later"

Syntax

no limit-message

Mode

Virtual Assist

Description

Clear technician limit message.

Example

no limit-message

Syntax

max-requests-one-ip <UINT16>

Mode

Virtual Assist

Description

Set maximum requests allowed from one IP.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

max-requests-one-ip 5

Syntax

no max-requests-one-ip

Mode

Virtual Assist

Description

Set no limit requests allowed from one IP.

Example

no max-requests-one-ip

Syntax

pending-request-expiration <UINT16>

Mode

Virtual Assist

Description

Set time (in minutes) customers are allowed to remain in queue before being removed without being assisted by technician.

Options

<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

pending-request-expiration 10

Syntax

no pending-request-expiration

Mode

Virtual Assist

Description

Clear expiration time customers are allowed to remain in queue before being removed without being assisted by technician.

Example

no pending-request-expiration

Syntax

deny-requests { host <IPV4_HOST> | network <IPV4_HOST> <IPV4_MASK> }

Mode

Virtual Assist

Description

Add address from which to deny requests from.

Options

 
hostIP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
 
networkNetwork address and subnet mask.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
<IPV4_MASK> IPV4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D.
Example: 255.255.255.0

Example

deny-requests host 10.10.10.1

deny-requests network 10.10.10.0 255.255.255.0

Syntax

no deny-requests { host <VIRTUAL_ASSIST_DENY_REQUESTS_HOST> | network <VIRTUAL_ASSIST_DENY_REQUESTS_HOST> <VIRTUAL_ASSIST_DENY_REQUESTS_NETMASK> }

Mode

Virtual Assist

Description

Delete address from which to deny requests from.

Options

 
hostIP address.
<VIRTUAL_ASSIST_DENY_REQUESTS_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
 
networkNetwork address and subnet mask.
<VIRTUAL_ASSIST_DENY_REQUESTS_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
<VIRTUAL_ASSIST_DENY_REQUESTS_NETMASK> IPV4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D.
Example: 255.255.255.0

Example

no deny-requests host 10.10.10.1

Syntax

show virtual-assist [ sessions ] [ { pending-config | with-pending-config } ]

Mode

All Modes

Description

Show virtual assist configuration.

Options

sessionsShow virtual assist active customer sessions.
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.

Example

show virtual-assist

Syntax

vpn [ policy { enable <VPN_POLICY_NAME> | group-vpn <VPN_GROUP_POLICY_NAME> | ipv6 { site-to-site <VPN_SITE_POLICY_V6_NAME> } | site-to-site <VPN_SITE_POLICY_NAME> | tunnel-interface <VPN_TUNNEL_POLICY_NAME> } ]

Mode

Config

Description

Configure VPN.

Options

policyAdd, edit or enable a VPN policy.
 
enableEnable a VPN policy.
<VPN_POLICY_NAME> VPN policy name.
Example: Remote Office
 
group-vpnEdit group VPN policy.
<VPN_GROUP_POLICY_NAME> Group VPN policy name.
Example: WAN GroupVPN
 
ipv6IPv6 vpn policy.
site-to-siteAdd or edit IPv6 site-to-site VPN policy.
<VPN_SITE_POLICY_V6_NAME> IPv6 Site-to-site VPN policy name.
Example: Remote Office
 
site-to-siteAdd or edit site-to-site VPN policy.
<VPN_SITE_POLICY_NAME> Site-to-site VPN policy name.
Example: Remote Office
 
tunnel-interfaceAdd or edit tunnel interface VPN policy.
<VPN_TUNNEL_POLICY_NAME> Tunnel interface VPN policy name.
Example: Remote Office

Example

vpn

vpn policy site-to-site "Remote Office"
vpn policy group-vpn "WAN GroupVPN"
vpn policy enable "Remote Office"

Syntax

no vpn policy { enable <VPN_POLICY_NAME> | ipv6 { site-to-site <VPN_SITE_POLICY_V6_NAME> } | site-to-site <VPN_SITE_POLICY_NAME> | tunnel-interface <VPN_TUNNEL_POLICY_NAME> }

Mode

Config

Description

Delete or disable a VPN policy.

Options

 
enableEnable a VPN policy.
<VPN_POLICY_NAME> VPN policy name.
Example: Remote Office
 
ipv6IPv6 vpn policy.
site-to-siteDelete IPv6 site-to-site VPN policy.
<VPN_SITE_POLICY_V6_NAME> IPv6 Site-to-site VPN policy name.
Example: Remote Office
 
site-to-siteDelete site-to-site VPN policy.
<VPN_SITE_POLICY_NAME> Site-to-site VPN policy name.
Example: Remote Office
 
tunnel-interfaceDelete tunnel interface VPN policy.
<VPN_TUNNEL_POLICY_NAME> Tunnel interface VPN policy name.
Example: Remote Office

Example

no vpn policy site-to-site "Remote Office"

no vpn policy enable "Remote Office"

Syntax

no vpn policies

Mode

Config

Description

Delete all VPN policies.

Example

no vpn policies

Syntax

enable

Mode

VPN

Description

Enable VPN.

Example

enable

Syntax

no enable

Mode

VPN

Description

Disable VPN.

Example

no enable

Syntax

firewall-identifier <WORD>

Mode

VPN

Description

Configure unique firewall identifier.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

firewall-identifier CorpFirewall

Syntax

no ike-dpd

Mode

VPN

Description

Disable IKE dead peer detection.

Example

no ike-dpd

Syntax

ike-dpd

Mode

VPN

Description

Configure IKE dead peer detection.

Example

ike-dpd

Syntax

interval <UINT8>

Mode

IKE Dead Peer Detection

Description

Configure dead peer detection interval.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

interval 60

Syntax

trigger <UINT8>

Mode

IKE Dead Peer Detection

Description

Configure failure trigger level in number of heartbeats.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

trigger 3

Syntax

idle-dpd [ interval <UINT16> ]

Mode

IKE Dead Peer Detection

Description

Enable dead peer detection for idle VPN sessions.

Options

intervalDead peer detection interval for idle VPN sessions in seconds.
<UINT16> Integer in the form: D OR 0xHHHH.
Example: 123

Example

idle-dpd interval 600

Syntax

no idle-dpd

Mode

IKE Dead Peer Detection

Description

Disable dead peer detection for idle VPN sessions.

Example

no idle-dpd

Syntax

frag-packets

Mode

VPN

Description

Enable and configure fragmented packet handling for VPN.

Example

frag-packets

Syntax

no frag-packets

Mode

VPN

Description

Disable fragmented packet handling for VPN.

Example

no frag-packets

Syntax

ignore-df-bit

Mode

Fragmented Packet Handling

Description

Ignore DF (don't fragment) bit.

Example

ignore-df-bit

Syntax

no ignore-df-bit

Mode

Fragmented Packet Handling

Description

Disable ignore DF (don't fragment) bit.

Example

no ignore-df-bit

Syntax

nat-traversal

Mode

VPN

Description

Enable NAT traversal.

Example

nat-traversal

Syntax

no nat-traversal

Mode

VPN

Description

Disable NAT traversal.

Example

no nat-traversal

Syntax

cleanup-tunnels

Mode

VPN

Description

Enable clean up active tunnels when peer gateway DNS name resolves to a different IP address.

Example

cleanup-tunnels

Syntax

no cleanup-tunnels

Mode

VPN

Description

Disable clean up active tunnels when peer gateway DNS name resolves to a different IP address.

Example

no cleanup-tunnels

Syntax

preserve-ike-port

Mode

VPN

Description

Enable preserve IKE port for pass through connections.

Example

preserve-ike-port

Syntax

no preserve-ike-port

Mode

VPN

Description

Disable preserve IKE port for pass through connections.

Example

no preserve-ike-port

Syntax

no ocsp-checking

Mode

VPN

Description

Disable OCSP checking.

Example

no ocsp-checking

Syntax

ocsp-checking

Mode

VPN

Description

Enable and configure OCSP checking.

Example

ocsp-checking

Syntax

responder-url <WEB_URL>

Mode

OCSP Checking

Description

Configure responder URL.

Options

<WEB_URL> URL in the form: http://host/file.
Example: http://www.example.com/products/

Example

responder-url http://www.sonicwall.com/ocsp

Syntax

no responder-url

Mode

OCSP Checking

Description

Clear responder URL.

Example

no responder-url

Syntax

traps-on-change

Mode

VPN

Description

Enable VPN tunnel traps only when tunnel status changes.

Example

traps-on-change

Syntax

no traps-on-change

Mode

VPN

Description

Disable VPN tunnel traps only when tunnel status changes.

Example

no traps-on-change

Syntax

use-radius { mschap | mschapv2 }

Mode

VPN

Description

Enable use RADIUS in specified mode for XAUTH.

Options

 
mschapUse MSCHAP for RADIUS.
 
mschapv2Use MSCHAPv2 for RADIUS.

Example

use-radius mschapv2

Syntax

no use-radius

Mode

VPN

Description

Disable use RADIUS for XAUTH.

Example

no use-radius

Syntax

ikev2

Mode

VPN

Description

Configure IKEv2.

Example

ikev2

Syntax

send-cookie

Mode

IKEv2

Description

Enable send IKEv2 cookie notify.

Example

send-cookie

Syntax

no send-cookie

Mode

IKEv2

Description

Disable send IKEv2 cookie notify.

Example

no send-cookie

Syntax

proposal dh-group { 1 | 14 | 19 | 2 | 20 | 21 | 25 | 26 | 5 }

Mode

IKEv2

Description

Configure IKEv2 DH group.

Options

 
1Group 1 modp768.
 
14Group 14 modp2048.
 
19Group 19 ECP random 256-bit.
 
2Group 2 modp1024.
 
20Group 20 ECP random 384-Bit.
 
21Group 21 ECP random 521-Bit.
 
25Group 25 ECP random 192-Bit.
 
26Group 26 ECP random 224-Bit.
 
5Group 5 modp1536.

Example

proposal dh-group 2

Syntax

proposal encryption { aes-128 | aes-192 | aes-256 | des | triple-des }

Mode

IKEv2

Description

Configure IKEv2 encryption algorithm.

Options

 
aes-128Advanced encryption standard (AES) - 128 bit.
 
aes-192Advanced encryption standard (AES) - 192 bit.
 
aes-256Advanced encryption standard (AES) - 256 bit.
 
desData encryption standard (DES).
 
triple-desTriple data encryption standard (3DES).

Example

proposal encryption aes-128

Syntax

proposal authentication { md5 | sha-1 | sha-256 | sha-384 | sha-512 }

Mode

IKEv2

Description

Configure IKEv2 authentication hashing algorithm.

Options

 
md5Message-digest algorithm 5 (MD5).
 
sha-1Secure hash algorithm 1 (SHA-1).
 
sha-256Secure hash algorithm 256 (SHA-256).
 
sha-384Secure hash algorithm 384 (SHA-384).
 
sha-512Secure hash algorithm 512 (SHA-512).

Example

proposal authentication md5

Syntax

policy { enable <VPN_POLICY_NAME> | group-vpn <VPN_GROUP_POLICY_NAME> | ipv6 { site-to-site <VPN_SITE_POLICY_V6_NAME> } | site-to-site <VPN_SITE_POLICY_NAME> | tunnel-interface <VPN_TUNNEL_POLICY_NAME> }

Mode

VPN

Description

Add, edit or enable a VPN policy.

Options

 
enableEnable a VPN policy.
<VPN_POLICY_NAME> VPN policy name.
Example: Remote Office
 
group-vpnEdit group VPN policy.
<VPN_GROUP_POLICY_NAME> Group VPN policy name.
Example: WAN GroupVPN
 
ipv6IPv6 vpn policy.
site-to-siteDelete IPv6 site-to-site VPN policy.
<VPN_SITE_POLICY_V6_NAME> IPv6 Site-to-site VPN policy name.
Example: Remote Office
 
site-to-siteAdd or edit site-to-site VPN policy.
<VPN_SITE_POLICY_NAME> Site-to-site VPN policy name.
Example: Remote Office
 
tunnel-interfaceAdd or edit tunnel interface VPN policy.
<VPN_TUNNEL_POLICY_NAME> Tunnel interface VPN policy name.
Example: Remote Office

Example

policy site-to-site "Remote Office"

policy group-vpn "WAN GroupVPN"
policy enable "Remote Office"

Syntax

no policy { enable <VPN_POLICY_NAME> | ipv6 { site-to-site <VPN_SITE_POLICY_V6_NAME> } | site-to-site <VPN_SITE_POLICY_NAME> | tunnel-interface <VPN_TUNNEL_POLICY_NAME> }

Mode

VPN

Description

Delete or disable a VPN policy.

Options

 
enableEnable a VPN policy.
<VPN_POLICY_NAME> VPN policy name.
Example: Remote Office
 
ipv6IPv6 vpn policy.
site-to-siteDelete IPv6 site-to-site VPN policy.
<VPN_SITE_POLICY_V6_NAME> IPv6 Site-to-site VPN policy name.
Example: Remote Office
 
site-to-siteDelete site-to-site VPN policy.
<VPN_SITE_POLICY_NAME> Site-to-site VPN policy name.
Example: Remote Office
 
tunnel-interfaceDelete tunnel interface VPN policy.
<VPN_TUNNEL_POLICY_NAME> Tunnel interface VPN policy name.
Example: Remote Office

Example

no policy site-to-site "Remote Office"

no policy enable "Remote Office"

Syntax

no policies

Mode

VPN

Description

Delete all VPN policies.

Example

no policies

Syntax

name <VPN_POLICY_NAME>

Mode

Site to Site VPN Policy

Tunnel Interface VPN Policy
Group VPN

Description

Configure policy name.

Options

<VPN_POLICY_NAME> VPN policy name.
Example: Remote Office

Example

name "Remote Office"

Syntax

name <VPN_SITE_POLICY_V6_NAME>

Mode

Site to Site VPN IPv6 Policy

Description

Configure policy name.

Options

<VPN_SITE_POLICY_V6_NAME> IPv6 Site-to-site VPN policy name.
Example: Remote Office

Example

name "Remote Office"

Syntax

enable

Mode

Site to Site VPN Policy

Site to Site VPN IPv6 Policy
Tunnel Interface VPN Policy
Group VPN

Description

Enable VPN policy.

Example

enable

Syntax

no enable

Mode

Site to Site VPN Policy

Site to Site VPN IPv6 Policy
Tunnel Interface VPN Policy
Group VPN

Description

Disable VPN policy.

Example

no enable

Syntax

gateway primary <HOSTNAME_MIXED>

Mode

Site to Site VPN Policy

Site to Site VPN IPv6 Policy
Tunnel Interface VPN Policy

Description

Configure the IPsec gateway name or address.

Options

<HOSTNAME_MIXED> IPV4: hostname in the form: D.D.D.D or hostname\nIPV6: host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: 2001:cdba:0000:0000:0000:0000:3257:9652\n

Example

gateway primary 10.10.10.1

Syntax

no gateway primary

Mode

Site to Site VPN Policy

Site to Site VPN IPv6 Policy
Tunnel Interface VPN Policy

Description

Clear the IPsec gateway name or address.

Example

no gateway primary

Syntax

gateway secondary <HOSTNAME_MIXED>

Mode

Site to Site VPN Policy

Site to Site VPN IPv6 Policy

Description

Configure the IPsec gateway name or address.

Options

<HOSTNAME_MIXED> IPV4: hostname in the form: D.D.D.D or hostname\nIPV6: host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: 2001:cdba:0000:0000:0000:0000:3257:9652\n

Example

gateway secondary 10.10.10.1

Syntax

no gateway secondary

Mode

Site to Site VPN Policy

Site to Site VPN IPv6 Policy

Description

Clear the IPsec gateway name or address.

Example

no gateway secondary

Syntax

auth-method { certificate | manual-key | shared-secret }

Mode

Site to Site VPN Policy

Site to Site VPN IPv6 Policy
Tunnel Interface VPN Policy

Description

Configure VPN policy authentication method.

Options

 
certificateIKE using 3rd party certificates.
 
manual-keyManual key.
 
shared-secretIKE using pre-shared secret.

Example

auth-method shared-secret

Syntax

auth-method { certificate | shared-secret }

Mode

Group VPN

Description

Configure VPN policy authentication method.

Options

 
certificateIKE using 3rd party certificates.
 
shared-secretIKE using pre-shared secret.

Example

auth-method shared-secret

Syntax

export group-vpn <VPN_GROUP_POLICY_ENABLE_NAME> { rcf { network { group <VPN_ADDR_GROUP_NAME> | name <VPN_ADDR_NAME> } [ password <WORD> ] { ftp <FTP_URL> } } | spd ftp <FTP_URL> }

Mode

VPN

Description

Export a group VPN client policy file to FTP server.

Options

<VPN_GROUP_POLICY_ENABLE_NAME> Group VPN policy name.
Example: WAN GroupVPN
 
rcfRcf format is required for Global VPN Clients.
networkConfigure the client access network(s) you wish to export.
 
groupSelect the network to named address object group.
<VPN_ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
nameSelect the network to named address object.
<VPN_ADDR_NAME> Host/network/range address object name.
Example: Web Server
passwordYou may encrypt the exported file using a chosen password.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
ftpExport using the FTP protocol.
<FTP_URL> FTP URL in the form: ftp://username:password@hostname/\n Escape character: ':' -> '\\\\:', '@' -> '\\\\@', '/' -> '\\\\/', '\\' -> '\\\\\\\\'.
Example: ftp://username:password@hostname/\nftp://username@hostname/\nftp://hostname/
 
spdSpd format is required for VPN Clients 8.x and earlier.
ftpExport using the FTP protocol.
<FTP_URL> FTP URL in the form: ftp://username:password@hostname/\n Escape character: ':' -> '\\\\:', '@' -> '\\\\@', '/' -> '\\\\/', '\\' -> '\\\\\\\\'.
Example: ftp://username:password@hostname/\nftp://username@hostname/\nftp://hostname/

Example

export group-vpn WAN\\ GroupVPN rcf network name LANSubnets ftp ftp://user:password@servername/WAN\\ GroupVPN.rcf

Syntax

shared-secret <ENC_PASSWORD>

Mode

IKE Preshared Secret

Description

Configure the pre-shared secret.

Options

<ENC_PASSWORD> Password.
Example: secret

Example

shared-secret mysecret

Syntax

no shared-secret

Mode

IKE Preshared Secret

Description

Clear the pre-shared secret.

Example

no shared-secret

Syntax

ike-id local { domain-name <VPN_FQDN> | email-address <EMAIL> | firewall-id <WORD> | ipv4 <IPV4_HOST> | ipv6 <IPV6_HOST> | key-id <WORD> }

Mode

IKE Preshared Secret

Description

Configure local IKE authentication associated identifiers.

Options

 
domain-nameDomain name identifier.
<VPN_FQDN> Domain name in the form: aaa.aa.
Example: example.com
 
email-addressE-mail address identifier.
<EMAIL> E-mail in the form: aaaaa@bbb.com.
Example: support@sonicwall.com
 
firewall-idFirewall identifier.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
ipv4IP address identifier.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
 
ipv6IPv6 address identifier.
<IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b
 
key-idKey ID identifier.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

ike-id local email-address user@domain.com

Syntax

no ike-id local { domain-name | email-address | firewall-id | ipv4 | ipv6 | key-id }

Mode

IKE Preshared Secret

Description

Clear local IKE authentication associated identifiers.

Options

 
domain-nameClear domain name identifier.
 
email-addressClear e-mail address identifier.
 
firewall-idClear Firewall ID identifier.
 
ipv4Clear IPv4 address identifier.
 
ipv6Clear IPv6 address identifier.
 
key-idClear key ID identifier.

Example

no ike-id local email-address

Syntax

ike-id peer { domain-name <VPN_FQDN> | email-address <EMAIL> | firewall-id <WORD> | ipv4 <IPV4_HOST> | ipv6 <IPV6_HOST> | key-id <WORD> }

Mode

IKE Preshared Secret

Description

Configure peer IKE authentication associated identifiers.

Options

 
domain-nameDomain name identifier.
<VPN_FQDN> Domain name in the form: aaa.aa.
Example: example.com
 
email-addressE-mail address identifier.
<EMAIL> E-mail in the form: aaaaa@bbb.com.
Example: support@sonicwall.com
 
firewall-idFirewall ID identifier.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
ipv4IP address identifier.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
 
ipv6IPv6 address identifier.
<IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b
 
key-idKey ID identifier.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

ike-id peer email-address user@domain.com

Syntax

no ike-id peer { domain-name | email-address | firewall-id | ipv4 | ipv6 | key-id }

Mode

IKE Preshared Secret

Description

Clear peer IKE authentication associated identifiers.

Options

 
domain-nameClear domain name identifier.
 
email-addressClear e-mail address identifier.
 
firewall-idClear Firewall ID identifier.
 
ipv4Clear IPv4 address identifier.
 
ipv6Clear IPv6 address identifier.
 
key-idClear key ID identifier.

Example

no ike-id peer email-address

Syntax

certificate <CERT_NAME>

Mode

IKE 3rd Party Certificate

IKE 3rd Party Certificate

Description

Configure the local certificate name.

Options

<CERT_NAME> Certificate name.
Example: my_cert

Example

certificate mycertificate

Syntax

no certificate

Mode

IKE 3rd Party Certificate

IKE 3rd Party Certificate

Description

Clear the local certificate name.

Example

no certificate

Syntax

ike-id local { default-id | distinguished-name | domain-name | email-id | ip }

Mode

IKE 3rd Party Certificate

Description

Configure the local identifier.

Options

 
default-idDefault ID from the certificate.
 
distinguished-nameDistinguished name (DN).
 
domain-nameDomain name (FQDN).
 
email-idE-mail ID (userFQDN).
 
ipIP address (IPV4).

Example

ike-id local default-id

Syntax

ike-id peer { distinguished-name <DISTINGUISHED_NAME> | domain-name <VPN_FQDN> | email-id <EMAIL> | ip <IPV4_HOST> }

Mode

IKE 3rd Party Certificate

Description

Configure the peer identifier.

Options

 
distinguished-nameDistinguished name (DN).
<DISTINGUISHED_NAME> Distinguished name filter in the form: c=*;cn=*;o=*;ou=*; or *.
Example: ou=aaa;c=a;*
 
domain-nameDomain name (FQDN).
<VPN_FQDN> Domain name in the form: aaa.aa.
Example: example.com
 
email-idE-mail ID (userFQDN).
<EMAIL> E-mail in the form: aaaaa@bbb.com.
Example: support@sonicwall.com
 
ipIP address (IPV4).
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

ike-id peer distinguished-name

Syntax

no ike-id peer { distinguished-name | domain-name | email-id | ip }

Mode

IKE 3rd Party Certificate

Description

Clear the peer identifier.

Options

 
distinguished-nameClear distinguished name (DN).
 
domain-nameClear domain name (FQDN).
 
email-idClear e-mail ID (userFQDN).
 
ipClear IP address (IPV4).

Example

no ike-id peer distinguished-name

Syntax

peer id { distinguished-name <DISTINGUISHED_NAME> | domain-name <VPN_FQDN_FILTER> | email-id <VPN_EMAIL_FILTER> }

Mode

IKE 3rd Party Certificate

Description

Configure the peer identifier type.

Options

 
distinguished-nameDistinguished name.
<DISTINGUISHED_NAME> Distinguished name filter in the form: c=*;cn=*;o=*;ou=*; or *.
Example: ou=aaa;c=a;*
 
domain-nameDomain name.
<VPN_FQDN_FILTER> Domain name filter in the form: aabb?*-.aa.
Example: example.com
 
email-idE-mail ID.
<VPN_EMAIL_FILTER> E-mail filter in the form: aaaaa@bbb.com.
Example: support@sonicwall.com

Example

peer id-type domain-name example.com

Syntax

peer match-issuer

Mode

IKE 3rd Party Certificate

Description

Enable allow only peer certificates signed by gateway issuer.

Example

peer match-issuer

Syntax

no peer match-issuer

Mode

IKE 3rd Party Certificate

Description

Disable allow only peer certificates signed by gateway issuer.

Example

no peer match-issuer

Syntax

network local { any | dhcp | group <VPN_ADDR_GROUP_NAME> | host <VPN_ADDR_HOST> | name <VPN_ADDR_NAME> | network <VPN_ADDR_NETWORK> <VPN_ADDR_MASK> | range <VPN_ADDR_BEGIN> <VPN_ADDR_END> }

Mode

Site to Site VPN Policy

Site to Site VPN IPv6 Policy

Description

Configure the local network.

Options

 
anyAny local network.
 
dhcpObtain IP addresses using DHCP through this VPN tunnel.
 
groupConfigure the local network to named address object group.
<VPN_ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostConfigure the local network to host address.
<VPN_ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameConfigure the local network to named address object.
<VPN_ADDR_NAME> Host/network/range address object name.
Example: Web Server
 
networkConfigure the local network to network address.
<VPN_ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<VPN_ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeConfigure the local network to range of addresses.
<VPN_ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<VPN_ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

network local name LANSubnets

Syntax

no network local

Mode

Site to Site VPN Policy

Site to Site VPN IPv6 Policy

Description

Clear the local network.

Example

no network local

Syntax

network remote { any | dhcp | group <VPN_ADDR_GROUP_NAME> | host <VPN_ADDR_HOST> | name <VPN_ADDR_NAME> | network <VPN_ADDR_NETWORK> <VPN_ADDR_MASK> | range <VPN_ADDR_BEGIN> <VPN_ADDR_END> }

Mode

Site to Site VPN Policy

Site to Site VPN IPv6 Policy

Description

Configure the remote network.

Options

 
anyUse this VPN tunnel as default route for all internet traffic.
 
dhcpDestination network obtains IP addresses using DHCP through this VPN tunnel.
 
groupConfigure the remote network to named address object group.
<VPN_ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostConfigure the remote network to host address.
<VPN_ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameConfigure the remote network to named address object.
<VPN_ADDR_NAME> Host/network/range address object name.
Example: Web Server
 
networkConfigure the remote network to network address.
<VPN_ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<VPN_ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeConfigure the remote network to range of addresses.
<VPN_ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<VPN_ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

network remote name RemoteSubnets

Syntax

no network remote

Mode

Site to Site VPN Policy

Site to Site VPN IPv6 Policy

Description

Clear the remote network.

Example

no network remote

Syntax

proposal ike { authentication { { md5 | sha-1 | sha-256 | sha-384 | sha-512 } } | dh-group { { 1 | 14 | 19 | 2 | 20 | 21 | 25 | 26 | 5 } } | encryption { { aes-128 | aes-192 | aes-256 | des | triple-des } } | exchange { { aggressive | ikev2 | main } } | lifetime <UINT32> }

Mode

Site to Site VPN Policy

Site to Site VPN IPv6 Policy
Tunnel Interface VPN Policy
Group VPN

Description

Configure VPN policy IKE (phase 1) proposal.

Options

 
authenticationAuthentication hashing encryption algorithm.
 
md5Message-digest algorithm 5 (MD5).
 
sha-1Secure hash algorithm 1 (SHA-1).
 
sha-256Secure hash algorithm 256 (SHA-256).
 
sha-384Secure hash algorithm 384 (SHA-384).
 
sha-512Secure hash algorithm 512 (SHA-512).
 
dh-groupDH group.
 
1Group 1 modp768.
 
14Group 14 modp2048.
 
19Group 19 ECP random 256-bit.
 
2Group 2 modp1024.
 
20Group 20 ECP random 384-Bit.
 
21Group 21 ECP random 521-Bit.
 
25Group 25 ECP random 192-Bit.
 
26Group 26 ECP random 224-Bit.
 
5Group 5 modp1536.
 
encryptionEncryption algorithm.
 
aes-128Advanced encryption standard (AES) - 128 bit.
 
aes-192Advanced encryption standard (AES) - 192 bit.
 
aes-256Advanced encryption standard (AES) - 256 bit.
 
desData encryption standard (DES).
 
triple-desTriple data encryption standard (3DES).
 
exchangeExchange.
 
aggressiveAggressive mode.
 
ikev2IKEv2 mode.
 
mainMain mode.
 
lifetimeLife time (seconds).
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

proposal ike encryption aes-256

proposal ike authentication sha-1
proposal ike dh-group 2
proposal ike lifetime 3000

Syntax

proposal ipsec { authentication { { aes-xcbc | md5 | sha-1 | sha-256 | sha-384 | sha-512 } } | authentication-key <VPN_HEX_STRING64> | encryption { { aes-128 | aes-192 | aes-256 | aes-gcm16-128 | aes-gcm16-192 | aes-gcm16-256 | aes-gmac-128 | aes-gmac-192 | aes-gmac-256 | des | triple-des } } | encryption-key <VPN_HEX_STRING64> | in-spi <HEX_UINT32> | lifetime <UINT32> | out-spi <HEX_UINT32> | perfect-forward-secrecy dh-group { { 1 | 14 | 19 | 2 | 20 | 21 | 25 | 26 | 5 } } | protocol { { ah | esp } } }

Mode

Site to Site VPN Policy

Site to Site VPN IPv6 Policy
Tunnel Interface VPN Policy
Group VPN

Description

Configure VPN policy IPsec (phase 2) proposal.

Options

 
authenticationAuthentication hashing encryption algorithm.
 
aes-xcbcSecure hash algorithm AES (AES-XCBC).
 
md5Message-digest algorithm 5 (MD5).
 
sha-1Secure hash algorithm 1 (SHA-1).
 
sha-256Secure hash algorithm 256 (SHA-256).
 
sha-384Secure hash algorithm 384 (SHA-384).
 
sha-512Secure hash algorithm 512 (SHA-512).
 
authentication-keyConfigure authentication key.
<VPN_HEX_STRING64> String of hexadecimal (16-64) digits.
Example: 0123456989abcdef
 
encryptionEncryption algorithm.
 
aes-128Advanced encryption standard (AES) - 128 bit.
 
aes-192Advanced encryption standard (AES) - 192 bit.
 
aes-256Advanced encryption standard (AES) - 256 bit.
 
aes-gcm16-128Advanced encryption standard (AES) - GCM16 128 bit.
 
aes-gcm16-192Advanced encryption standard (AES) - GCM16 192 bit.
 
aes-gcm16-256Advanced encryption standard (AES) - GCM16 256 bit.
 
aes-gmac-128Advanced encryption standard (AES) - GMAC 128 bit.
 
aes-gmac-192Advanced encryption standard (AES) - GMAC 192 bit.
 
aes-gmac-256Advanced encryption standard (AES) - GMAC 256 bit.
 
desData encryption standard (DES).
 
triple-desTriple data encryption standard (3DES).
 
encryption-keyConfigure encryption key.
<VPN_HEX_STRING64> String of hexadecimal (16-64) digits.
Example: 0123456989abcdef
 
in-spiConfigure incoming SPI.
<HEX_UINT32> Hexadecimal integer in the form: 0xHHHHHHHH.
Example: 0xaa55aa55
 
lifetimeLife time (seconds).
<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123
 
out-spiConfigure outgoing SPI.
<HEX_UINT32> Hexadecimal integer in the form: 0xHHHHHHHH.
Example: 0xaa55aa55
 
perfect-forward-secrecyEnable perfect forward secrecy.
dh-groupDH group.
 
1Group 1 modp768.
 
14Group 14 modp2048.
 
19Group 19 ECP random 256-bit.
 
2Group 2 modp1024.
 
20Group 20 ECP random 384-Bit.
 
21Group 21 ECP random 521-Bit.
 
25Group 25 ECP random 192-Bit.
 
26Group 26 ECP random 224-Bit.
 
5Group 5 modp1536.
 
protocolProtocol.
 
ahConfigure AH.
 
espConfigure ESP.

Example

proposal ipsec encryption aes-256

proposal ipsec authentication sha-1
proposal ipsec perfect-forward-secrecy dh-group 2
proposal ipsec lifetime 3000

Manual Key Only:

proposal ipsec in-spi 0x5d1b19a1
proposal ipsec out-spi 0x88f24984
proposal ipsec encryption-key 5f7cd04166523fd78e56ca9920d9c870d53ed63d92001d4f
proposal ipsec authentication-key 3b1db664fe578ae5fd38d7042e7a106f4c23408a

Syntax

no proposal ipsec { authentication | authentication-key | encryption | encryption-key | perfect-forward-secrecy }

Mode

Site to Site VPN Policy

Site to Site VPN IPv6 Policy
Tunnel Interface VPN Policy
Group VPN

Description

Clear VPN policy IPsec (phase 2) proposal.

Options

 
authenticationNone authentication hashing encryption algorithm.
 
authentication-keyConfigure authentication key.
 
encryptionNone encryption algorithm.
 
encryption-keyConfigure encryption key.
 
perfect-forward-secrecyDisable perfect forward secrecy.

Example

no proposal ipsec encryption-key

no proposal ipsec authentication-key
no proposal ipsec encryption
no proposal ipsec authentication
no proposal ipsec perfect-forward-secrecy

Syntax

client cache-xauth { always | never | single-session }

Mode

Group VPN

Description

Configure cache XAUTH user name and password on client.

Options

 
alwaysAlways cache.
 
neverNo caching.
 
single-sessionCache for single session.

Example

client cache-xauth single-session

Syntax

client virtual-adaptor { dhcp-and-manual | dhcp-only | none }

Mode

Group VPN

Description

Configure virtual adaptor lease settings.

Options

 
dhcp-and-manualUse DHCP lease or manual configuration.
 
dhcp-onlyUse DHCP lease.
 
noneNone.

Example

client virtual-adaptor dhcp-only

Syntax

client allow-connections-to { all-secured-gateways | split-tunnels | this-gateway-only }

Mode

Group VPN

Description

Configure what connections to allow to.

Options

 
all-secured-gatewaysAll secured gateways.
 
split-tunnelsSplit tunnels.
 
this-gateway-onlyThis gateway only.

Example

client allow-connections-to this-gateway-only

Syntax

client default-route { access-list | disable-acl }

Mode

Group VPN

Description

Configure default route as this gateway.

Options

 
access-listEnable apply VPN access control list.
 
disable-aclDisable apply VPN access control list.

Example

client default-route access-list

Syntax

no client default-route

Mode

Group VPN

Description

Clear default route as this gateway.

Example

no client default-route

Syntax

client simple-provisioning

Mode

Group VPN

Description

Enable use default key for simple client provisioning.

Example

client simple-provisioning

Syntax

no client simple-provisioning

Mode

Group VPN

Description

Disable use default key for simple client provisioning.

Example

no client simple-provisioning

Syntax

keep-alive

Mode

Site to Site VPN Policy

Site to Site VPN IPv6 Policy
Tunnel Interface VPN Policy

Description

Enable VPN policy keep alive.

Example

keep-alive

Syntax

no keep-alive

Mode

Site to Site VPN Policy

Site to Site VPN IPv6 Policy
Tunnel Interface VPN Policy

Description

Disable VPN policy keep alive.

Example

no keep-alive

Syntax

suppress-auto-add-rule

Mode

Site to Site VPN Policy

Description

Enable suppress automatic access rules creation for VPN policy.

Example

suppress-auto-add-rule

Syntax

no suppress-auto-add-rule

Mode

Site to Site VPN Policy

Description

Disable suppress automatic access rules creation for VPN policy.

Example

no suppress-auto-add-rule

Syntax

require-xauth <LOCAL_USER_GROUP_NAME>

Mode

Site to Site VPN Policy

Description

Enable XAUTH checking for VPN policy.

Options

<LOCAL_USER_GROUP_NAME> User group object name.
Example: Limited Administrators

Example

require-xauth "Everyone"

Syntax

no require-xauth

Mode

Site to Site VPN Policy

Description

Disable require authentication of VPN clients by XAUTH.

Example

no require-xauth

Syntax

anti-replay

Mode

Site to Site VPN Policy

Site to Site VPN IPv6 Policy
Tunnel Interface VPN Policy
Group VPN

Description

Enable anti replay.

Example

anti-replay

Syntax

no anti-replay

Mode

Site to Site VPN Policy

Site to Site VPN IPv6 Policy
Tunnel Interface VPN Policy
Group VPN

Description

Disable anti replay.

Example

no anti-replay

Syntax

allow-advanced-routing

Mode

Tunnel Interface VPN Policy

Description

Enable allow advanced routing.

Example

allow-advanced-routing

Syntax

no allow-advanced-routing

Mode

Tunnel Interface VPN Policy

Description

Disable allow advanced routing.

Example

no allow-advanced-routing

Syntax

transport-mode

Mode

Tunnel Interface VPN Policy

Description

Enable transport mode.

Example

transport-mode

Syntax

no transport-mode

Mode

Tunnel Interface VPN Policy

Description

Disable transport mode.

Example

no transport-mode

Syntax

netbios

Mode

Site to Site VPN Policy

Tunnel Interface VPN Policy
Group VPN

Description

Enable VPN policy NetBIOS.

Example

netbios

Syntax

no netbios

Mode

Site to Site VPN Policy

Tunnel Interface VPN Policy
Group VPN

Description

Disable VPN policy NetBIOS.

Example

no nebios

Syntax

multicast

Mode

Site to Site VPN Policy

Tunnel Interface VPN Policy
Group VPN

Description

Enable VPN policy multicast.

Example

multicast

Syntax

no multicast

Mode

Site to Site VPN Policy

Tunnel Interface VPN Policy
Group VPN

Description

Disable VPN policy multicast.

Example

no multicast

Syntax

permit-acceleration

Mode

Site to Site VPN Policy

Tunnel Interface VPN Policy
Group VPN

Description

Enable permit acceleration.

Example

permit-acceleration

Syntax

no permit-acceleration

Mode

Site to Site VPN Policy

Tunnel Interface VPN Policy
Group VPN

Description

Disable permit acceleration.

Example

no permit-acceleration

Syntax

apply-nat [ translated-local { group <VPN_ADDR_GROUP_NAME> | host <VPN_ADDR_HOST> | name <VPN_ADDR_NAME> | network <VPN_ADDR_NETWORK> <VPN_ADDR_MASK> | original | range <VPN_ADDR_BEGIN> <VPN_ADDR_END> } ] [ translated-remote { group <VPN_ADDR_GROUP_NAME> | host <VPN_ADDR_HOST> | name <VPN_ADDR_NAME> | network <VPN_ADDR_NETWORK> <VPN_ADDR_MASK> | original | range <VPN_ADDR_BEGIN> <VPN_ADDR_END> } ]

Mode

Site to Site VPN Policy

Description

Enable VPN policy NAT translation.

Options

translated-localTranslated local network.
 
groupConfigure the local network to named address object group.
<VPN_ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostHost IP.
<VPN_ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<VPN_ADDR_NAME> Host/network/range address object name.
Example: Web Server
 
networkNetwork address.
<VPN_ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<VPN_ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
originalOriginal translated local network.
 
rangeNetwork range.
<VPN_ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<VPN_ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
translated-remoteTranslated remote network.
 
groupConfigure the local network to named address object group.
<VPN_ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostHost IP.
<VPN_ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<VPN_ADDR_NAME> Host/network/range address object name.
Example: Web Server
 
networkNetwork address.
<VPN_ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<VPN_ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
originalOriginal translated remote network.
 
rangeNetwork range.
<VPN_ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<VPN_ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n

Example

apply-nat translated-local name "TranslatedLocalAddrs"

apply-nat translated-remote name "TranslatedRemoteAddrs"

Syntax

no apply-nat

Mode

Site to Site VPN Policy

Description

Disable VPN policy NAT parameters.

Example

no apply-nat

Syntax

no ocsp-checking

Mode

Site to Site VPN Policy

Tunnel Interface VPN Policy
Group VPN

Description

Disable OCSP checking.

Example

no ocsp-checking

Syntax

ocsp-checking

Mode

Site to Site VPN Policy

Tunnel Interface VPN Policy
Group VPN

Description

Enable and configure OCSP checking.

Example

ocsp-checking

Syntax

responder-url <WEB_URL>

Mode

OCSP Checking

Description

Configure responder URL.

Options

<WEB_URL> URL in the form: http://host/file.
Example: http://www.example.com/products/

Example

responder-url http://www.sonicwall.com/ocsp

Syntax

no responder-url

Mode

OCSP Checking

Description

Clear responder URL.

Example

no responder-url

Syntax

management { http | https | snmp | ssh }

Mode

Site to Site VPN Policy

Site to Site VPN IPv6 Policy
Tunnel Interface VPN Policy
Group VPN

Description

Enable management for VPN policy.

Options

 
httpEnable HTTP management for VPN policy.
 
httpsEnable HTTPS management for VPN policy.
 
snmpEnable SNMP management for VPN policy.
 
sshEnable SSH management for VPN policy.

Example

management https

Syntax

no management { http | https | snmp | ssh }

Mode

Site to Site VPN Policy

Site to Site VPN IPv6 Policy
Tunnel Interface VPN Policy
Group VPN

Description

Disable management for VPN policy.

Options

 
httpDisable HTTP management for VPN policy.
 
httpsDisable HTTPS management for VPN policy.
 
snmpDisable SNMP management for VPN policy.
 
sshDisable SSH management for VPN policy.

Example

no management https

Syntax

user-login { http | https }

Mode

Site to Site VPN Policy

Tunnel Interface VPN Policy

Description

Enable VPN policy for user login.

Options

 
httpEnable VPN policy for HTTP user login.
 
httpsEnable VPN policy for HTTPS user login.

Example

user-login http

Syntax

no user-login { http | https }

Mode

Site to Site VPN Policy

Tunnel Interface VPN Policy

Description

Disable VPN policy for user login.

Options

 
httpDisable VPN policy for HTTP user login.
 
httpsDisable VPN policy for HTTPS user login.

Example

no user-login http

Syntax

default-lan-gateway <IPV4_HOST>

Mode

Site to Site VPN Policy

Group VPN

Description

Configure LAN default gateway.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

default-lan-gateway 192.168.168.1

Syntax

no default-lan-gateway

Mode

Site to Site VPN Policy

Group VPN

Description

Clear LAN default gateway.

Example

no default-lan-gateway

Syntax

bound-to { interface <VPN_BOUND_TO_INTERFACE> | zone <ZONE_WAN_NAME> }

Mode

Site to Site VPN Policy

Site to Site VPN IPv6 Policy
Tunnel Interface VPN Policy

Description

Configure VPN policy bound to.

Options

 
interfaceBound to interface.
<VPN_BOUND_TO_INTERFACE> Interface name.
Example: X0
 
zoneBound to zone.
<ZONE_WAN_NAME> Zone object name.
Example: DMZ

Example

bound-to interface X1

Syntax

local-ip { custom <IPV6_HOST> | primary }

Mode

Site to Site VPN IPv6 Policy

Description

Set the local gateway ip address.

Options

 
customSpecify the Local Gateway IP address.
<IPV6_HOST> IPV6 Address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH.
Example: 2000:0000:0000:ff68:0205:62ef:ee8d:f25b
 
primaryUsing Primary IP address.

Example

local-ip custom 4::5

Syntax

group { 1 | 2 | 3 | 4 }

Mode

Site to Site VPN Policy

Site to Site VPN IPv6 Policy
Tunnel Interface VPN Policy

Description

Configure VPN policy group.

Options

 
1Bound to group 1.
 
2Bound to group 2.
 
3Bound to group 3.
 
4Bound to group 4.

Example

group 1

Syntax

preempt-secondary-gateway <UINT32>

Mode

Site to Site VPN Policy

Site to Site VPN IPv6 Policy

Description

Enable preempt secondary gateway and set primary gateway detection interval (seconds).

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

preempt-secondary-gateway 28800

Syntax

no preempt-secondary-gateway

Mode

Site to Site VPN Policy

Site to Site VPN IPv6 Policy

Description

Disable preempt secondary gateway.

Example

no preempt-secondary-gateway

Syntax

client-authentication { allow-unauthenticated { { group <VPN_ADDR_GROUP_NAME> | host <VPN_ADDR_HOST> | name <VPN_ADDR_NAME> | network <VPN_ADDR_NETWORK> <VPN_ADDR_MASK> | range <VPN_ADDR_BEGIN> <VPN_ADDR_END> } } | require-xauth <LOCAL_USER_GROUP_NAME> }

Mode

Group VPN

Description

Enable XAUTH checking for VPN policy.

Options

 
allow-unauthenticatedEnable unauthenticated access for VPN policy.
 
groupConfigure the remote network to named address object group.
<VPN_ADDR_GROUP_NAME> Group address object name.
Example: Sales Group
 
hostHost IP.
<VPN_ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAddress object name.
<VPN_ADDR_NAME> Host/network/range address object name.
Example: Web Server
 
networkNetwork address.
<VPN_ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<VPN_ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n
 
rangeNetwork range.
<VPN_ADDR_BEGIN> IPV4: address object IPv4 starting range in the form: D.D.D.D\nIPV6: address object IPv6 starting range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.100\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
<VPN_ADDR_END> IPV4: address object IPv4 ending range in the form: D.D.D.D\nIPV6: address object IPv6 ending range in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.1.150\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:effe\n
 
require-xauthEnable XAUTH checking for VPN policy.
<LOCAL_USER_GROUP_NAME> User group object name.
Example: Limited Administrators

Example

client-authentication require-xauth "Everyone"

Syntax

suppress-trigger-packet

Mode

Site to Site VPN Policy

Site to Site VPN IPv6 Policy
Tunnel Interface VPN Policy

Description

Do not send trigger packet during IKE SA negotiation for IKEv2.

Example

suppress-trigger-packet

Syntax

no suppress-trigger-packet

Mode

Site to Site VPN Policy

Site to Site VPN IPv6 Policy
Tunnel Interface VPN Policy

Description

Send trigger packet during IKE SA negotiation for IKEv2.

Example

no suppress-trigger-packet

Syntax

accept-hash

Mode

Site to Site VPN Policy

Site to Site VPN IPv6 Policy
Tunnel Interface VPN Policy

Description

Accept hash & URL certificate type for IKEv2.

Example

accept-hash

Syntax

no accept-hash

Mode

Site to Site VPN Policy

Site to Site VPN IPv6 Policy
Tunnel Interface VPN Policy

Description

Do not accept hash & URL certificate type for IKEv2.

Example

no accept-hash

Syntax

send-hash <WEB_URL>

Mode

Site to Site VPN Policy

Site to Site VPN IPv6 Policy
Tunnel Interface VPN Policy

Description

Enable send hash & URL certificate type for IKEv2 and specify url.

Options

<WEB_URL> URL in the form: http://host/file.
Example: http://www.example.com/products/

Example

send-hash <ikev2CertUrl>

Syntax

no send-hash

Mode

Site to Site VPN Policy

Site to Site VPN IPv6 Policy
Tunnel Interface VPN Policy

Description

Do not send hash & URL certificate type for IKEv2.

Example

no send-hash

Syntax

accept-multiple-proposals

Mode

Group VPN

Description

Enable accept multiple proposals for clients.

Example

accept-multiple-proposals

Syntax

no accept-multiple-proposals

Mode

Group VPN

Description

Disable accept multiple proposals for clients.

Example

no accept-multiple-proposals

Syntax

l2tp-server

Mode

VPN

Description

Enable/Configure L2TP Server.

Example

l2tp-server

Syntax

no l2tp-server

Mode

VPN

Description

Disable l2tp-server.

Example

no l2tp-server

Syntax

keep-alive <UINT32>

Mode

L2TP Server

Description

Set the Keep alive time (seconds).

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

keep-alive 10

Syntax

dns { primary <IPV4_HOST> | secondary <IPV4_HOST> }

Mode

L2TP Server

Description

Set the primary and secondary DNS server IP address.

Options

 
primaryPrimary DNS server IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
 
secondarySecondary DNS server IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

dns primary 192.168.168.169

Syntax

no dns { primary | secondary }

Mode

L2TP Server

Description

Manually Clear DNS server IP address.

Options

 
primaryClear primary DNS server IP address.
 
secondaryClear secondary DNS server IP address.

Example

no dns primary

Syntax

wins { primary <IPV4_HOST> | secondary <IPV4_HOST> }

Mode

L2TP Server

Description

Set the WINS server IP address.

Options

 
primaryPrimary WINS server IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
 
secondarySecondary WINS server IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

wins primary 192.168.168.169

Syntax

no wins { primary | secondary }

Mode

L2TP Server

Description

Clear the WINS server IP address.

Options

 
primaryPrimary WINS server IP address.
 
secondarySecondary WINS server IP address.

Example

no wins primary

Syntax

ip-pool { local <IPV4_HOST> <IPV4_HOST> | provided }

Mode

L2TP Server

Description

Set the IP address pool.

Options

 
localUse local L2TP IP pool.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
 
providedIP address provided by RADIUS/LDAP Server.

Example

ip-pool local 192.168.168.10 192.168.168.20

Syntax

no user-group

Mode

L2TP Server

Description

No L2TP user group.

Example

no user-group

Syntax

user-group <LOCAL_USER_GROUP_NAME>

Mode

L2TP Server

Description

Set user group for L2TP users.

Options

<LOCAL_USER_GROUP_NAME> User group object name.
Example: Limited Administrators

Example

user-group l2tpUsers

Syntax

dhcp-over-vpn { central | remote }

Mode

VPN

Description

Configure DHCP over VPN.

Options

 
centralConfigure DHCP over VPN for central gateway.
 
remoteConfigure DHCP over VPN for remote gateway.

Example

dhcp-over-vpn central

Syntax

internal-dhcp

Mode

Central

Description

Enable use internal DHCP server.

Example

internal-dhcp

Syntax

no internal-dhcp

Mode

Central

Description

Disable use internal DHCP server.

Example

no internal-dhcp

Syntax

global-vpn

Mode

Central

Description

Enable use internal DHCP server for global VPN client.

Example

global-vpn

Syntax

no global-vpn

Mode

Central

Description

Disable use internal DHCP server for global VPN client.

Example

no global-vpn

Syntax

remote

Mode

Central

Description

Enable use internal DHCP server for remote firewall.

Example

remote

Syntax

no remote

Mode

Central

Description

Disable use internal DHCP server for remote firewall.

Example

no remote

Syntax

send-requests

Mode

Central

Description

Enable send DHCP requests to the server addresses in the server list.

Example

send-requests

Syntax

no send-requests

Mode

Central

Description

Disable send DHCP requests to the server addresses in the server list.

Example

no send-requests

Syntax

dhcp-server <DHCP_SERVER_IPV4_HOST>

Mode

Central

Description

Add a DHCP server to the server list.

Options

<DHCP_SERVER_IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

dhcp-server 192.168.168.170

Syntax

no dhcp-server <DHCP_SERVER_IPV4_HOST>

Mode

Central

Description

Remove a DHCP server from the server list.

Options

<DHCP_SERVER_IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

no dhcp-server 192.168.168.170

Syntax

no dhcp-servers

Mode

Central

Description

Remove all DHCP servers from the server list.

Example

no dhcp-servers

Syntax

no relay-ip

Mode

Central

Description

Clear DHCP relay IP address.

Example

no relay-ip

Syntax

relay-ip <IPV4_HOST>

Mode

Central

Description

Configure DHCP relay IP address.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

relay-ip 192.168.168.170

Syntax

bound-to <DHCP_OVER_VPN_INTERFACE>

Mode

Remote

Description

DHCP lease bound to.

Options

<DHCP_OVER_VPN_INTERFACE> Interface name.
Example: X0

Example

bound-to X2

Syntax

no relay-ip

Mode

Remote

Description

Clear DHCP relay IP address.

Example

no relay-ip

Syntax

relay-ip <IPV4_HOST>

Mode

Remote

Description

Configure DHCP relay IP address.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

relay-ip 192.168.168.170

Syntax

no management-ip

Mode

Remote

Description

Clear remote management IP address.

Example

no management-ip

Syntax

management-ip <IPV4_HOST>

Mode

Remote

Description

Configure remote management IP address.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

management-ip 192.168.168.170

Syntax

block-spoof

Mode

Remote

Description

Enable block traffic through tunnel when IP spoof detected.

Example

block-spoof

Syntax

no block-spoof

Mode

Remote

Description

Disable block traffic through tunnel when IP spoof detected.

Example

no block-spoof

Syntax

temp-lease

Mode

Remote

Description

Enable obtain temporary lease from local DHCP server if tunnel is down.

Example

temp-lease

Syntax

no temp-lease

Mode

Remote

Description

Disable obtain temporary lease from local DHCP server if tunnel is down.

Example

no temp-lease

Syntax

lease-time <UINT8>

Mode

Remote

Description

Set the temporary lease time (minutes).

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

lease-time 10

Syntax

static-device <STATIC_DEVICE_IPV4_HOST> <STATIC_DEVICE_MAC>

Mode

Remote

Description

Add a static devices on LAN.

Options

<STATIC_DEVICE_IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
<STATIC_DEVICE_MAC> MAC address in the form: HH:HH:HH:HH:HH:HH OR HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD

Example

static-device 192.168.168.170 01:02:03:04:05:06

Syntax

no static-device <STATIC_DEVICE_IPV4_HOST>

Mode

Remote

Description

Remove a static device on LAN.

Options

<STATIC_DEVICE_IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

no static-device 192.168.168.170

Syntax

no static-devices

Mode

Remote

Description

Remove all static devices on LAN.

Example

no static-devices

Syntax

excluded-device <EXCLUDE_DEVICE_MAC>

Mode

Remote

Description

Add an excluded LAN device.

Options

<EXCLUDE_DEVICE_MAC> MAC address in the form: HH:HH:HH:HH:HH:HH OR HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD

Example

excluded-device 01:02:03:04:05:06

Syntax

no excluded-device <EXCLUDE_DEVICE_MAC>

Mode

Remote

Description

Remove an excluded LAN device.

Options

<EXCLUDE_DEVICE_MAC> MAC address in the form: HH:HH:HH:HH:HH:HH OR HHHHHHHHHHHH.
Example: 00:0C:F1:56:98:AD

Example

no excluded-device 01:02:03:04:05:06

Syntax

no excluded-devices

Mode

Remote

Description

Remove all excluded LAN devices.

Example

no excluded-devices

Syntax

show vpn [ { { tunnel <VPN_POLICY_NAME> | tunnels } [ ike | ipsec | summary ] } | dhcp-over-vpn [ leases ] | l2tp-server | policies [ { ipv4 | ipv6 } ] | policy <VPN_POLICY_NAME> ] [ { pending-config | with-pending-config } ] [ json | validate | xml ]

Mode

All Modes

Description

Show VPN status or configuration.

Options

 
 
tunnelShow an active VPN tunnel.
<VPN_POLICY_NAME> VPN policy name.
Example: Remote Office
 
tunnelsShow all currently active VPN tunnels.
 
ikeShow ike sa.
 
ipsecShow ipsec sa.
 
summaryShow vpn sa number.
 
dhcp-over-vpnShow DHCP over VPN status or configuration.
leasesShow DHCP over VPN leases.
 
l2tp-serverShow L2TP server configuration.
 
policiesShow all VPN policies.
 
ipv4Show only IPv4 VPN policies.
 
ipv6Show only IPv6 VPN policies.
 
policyShow a VPN policy.
<VPN_POLICY_NAME> VPN policy name.
Example: Remote Office
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show vpn

show vpn tunnels
show vpn tunnel "Remote Office"
show vpn tunnels ipsec
show vpn statistics 0x23ab3456
show vpn dhcp-over-vpn
show vpn dhcp-over-vpn leases
show vpn l2tp-server
show vpn policy "Remote Office"
show vpn policies

Syntax

ssl-vpn server

Mode

Config

Description

Configure server settings.

Example

ssl-vpn server

Syntax

ssl-vpn client

Mode

Config

Description

Configure client settings.

Example

ssl-vpn client

Syntax

ssl-vpn routes

Mode

Config

Description

Configure client routes.

Example

ssl-vpn routes

Syntax

ssl-vpn portal

Mode

Config

Description

Configure portal settings.

Example

ssl-vpn portal

Syntax

ssl-vpn virtual-office

Mode

Config

Description

Configure virtual office settings.

Example

ssl-vpn virtual-office

Syntax

ssl-vpn logout <SSLVPN_LOGOUT_IPV4_HOST>

Mode

Config

Description

Logout specified NetExtender virtual IP.

Options

<SSLVPN_LOGOUT_IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

ssl-vpn logout 1.1.1.1

Syntax

logout <SSLVPN_LOGOUT_IPV4_HOST>

Mode

SSL VPN Server

Description

Logout specified NetExtender virtual IP.

Options

<SSLVPN_LOGOUT_IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

logout 1.1.1.1

Syntax

sslvpn-access <SSLVPN_ZONE_NAME>

Mode

SSL VPN Server

Description

Enable SSL VPN access on specified zone.

Options

<SSLVPN_ZONE_NAME> Zone object name.
Example: DMZ

Example

sslvpn-access WAN

Syntax

no sslvpn-access <SSLVPN_ZONE_NAME>

Mode

SSL VPN Server

Description

Disable SSL VPN access on specified zone.

Options

<SSLVPN_ZONE_NAME> Zone object name.
Example: DMZ

Example

no sslvpn-access WAN

Syntax

port <IPV4_PORT>

Mode

SSL VPN Server

Description

Set SSL VPN server port.

Options

<IPV4_PORT> Integer in the form: D OR 0xHHHH.
Example: 80

Example

port 4433

Syntax

certificate { name <CERT_NAME> | use-self-signed }

Mode

SSL VPN Server

Description

Select SSL certificate to use for SSL VPN.

Options

 
nameSpecify certificate.
<CERT_NAME> Certificate name.
Example: my_cert
 
use-self-signedUse self signed certificate.

Example

certificate name CorpSSLVPNCert

Syntax

cipher { aes256-sha1 | rc4-md5 | triple-des-sha1 }

Mode

SSL VPN Server

Description

Enable cipher preference and specify.

Options

 
aes256-sha1AES256-SHA1.
 
rc4-md5RC4-MD5.
 
triple-des-sha13DES-SHA1.

Example

cipher aes256-sha1

Syntax

no cipher

Mode

SSL VPN Server

Description

Disable cipher preference.

Example

no cipher

Syntax

use-radius { mschap | mschapv2 }

Mode

SSL VPN Server

Description

Enable use RADIUS in specified mode for XAUTH.

Options

 
mschapUse MSCHAP for RADIUS.
 
mschapv2Use MSCHAPv2 for RADIUS.

Example

use-radius mschapv2

Syntax

no use-radius

Mode

SSL VPN Server

Description

Disable use RADIUS for XAUTH.

Example

no use-radius

Syntax

site-title <WORD>

Mode

SSL VPN Portal

Description

Set SSL VPN portal site title.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

site-title "Corp - Virtual Office"

Syntax

banner-title <WORD>

Mode

SSL VPN Portal

Description

Set SSL VPN portal banner title.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

banner-title "Virtual Office"

Syntax

home-page-message { custom <ROL> | default }

Mode

SSL VPN Portal

Description

Set SSL VPN portal home page message.

Options

 
customUse customed home page message.
<ROL> Remaining command line input.
Example: line...
 
defaultUse default home page message example template.

Example

home-page-message custom "TBD"

Syntax

login-message { custom <ROL> | default }

Mode

SSL VPN Portal

Description

Set SSL VPN portal login message.

Options

 
customUse customed login message.
<ROL> Remaining command line input.
Example: line...
 
defaultUse default login message example template.

Example

login-message custom "TBD"

Syntax

auto-launch

Mode

SSL VPN Portal

Description

Enable launch NetExtender after login.

Example

auto-launch

Syntax

no auto-launch

Mode

SSL VPN Portal

Description

Disable launch NetExtender after login.

Example

no auto-launch

Syntax

display-cert

Mode

SSL VPN Portal

Description

Enable display import certificate button.

Example

display-cert

Syntax

no display-cert

Mode

SSL VPN Portal

Description

Disable display import certificate button.

Example

no display-cert

Syntax

cache-control

Mode

SSL VPN Portal

Description

Enable HTTP meta tags for cache control (recommended).

Example

cache-control

Syntax

no cache-control

Mode

SSL VPN Portal

Description

Disable HTTP meta tags for cache control (recommended).

Example

no cache-control

Syntax

logo { custom <WORD> | default }

Mode

SSL VPN Portal

Description

Set SSL VPN portal logo.

Options

 
customEnable use custom sonicwall logo.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
defaultEnable use default sonicwall logo.

Example

logo default

Syntax

address-pool <IPV4_HOST> <IPV4_HOST> <SSLVPN_INTERFACE>

Mode

Client

Description

Set NetExtender client pool address range and interface.

Options

<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
<SSLVPN_INTERFACE> Interface name.
Example: X0

Example

address-pool 192.168.168.100 192.168.168.110 X0

Syntax

no address-pool

Mode

Client

Description

Clear NetExtender client pool address range.

Example

no address-pool

Syntax

no netextender-start-ip

Mode

Client

Description

Clear NetExtender start IP.

Example

no netextender-start-ip

Syntax

no netextender-end-ip

Mode

Client

Description

Clear NetExtender end IP.

Example

no netextender-end-ip

Syntax

dns { [ primary <IPV4_HOST> ] [ secondary <IPV4_HOST> ] | inherit }

Mode

Client

Description

Set the primary and secondary DNS server IP address for NetExtender client.

Options

 
primaryPrimary DNS server IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
secondarySecondary DNS server IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
 
inheritUse the default global DNS settings.

Example

dns primary 192.168.168.169 secondary 192.168.168.170

Syntax

dns-domain <HOSTNAME>

Mode

Client

Description

Set DNS domain suffix.

Options

<HOSTNAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com

Example

dns-domain sonicwall.com

Syntax

no dns-domain

Mode

Client

Description

Clear DNS domain suffix.

Example

no dns-domain

Syntax

user-domain <WORD>

Mode

Client

Description

Set user domain.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

user-domain CorpSSLVPNDomain

Syntax

no user-domain

Mode

Client

Description

Clear user domain.

Example

no user-domain

Syntax

wins { [ primary <IPV4_HOST> ] [ secondary <IPV4_HOST> ] }

Mode

Client

Description

Set the primary and secondary WINS server IP address for NetExtender clients.

Options

primaryPrimary WINS server IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
secondarySecondary WINS server IP address.
<IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168

Example

wins primary 192.168.168.169 secondary 192.168.168.170

Syntax

session-timeout <UINT32>

Mode

Client

Description

Set default session timeout in minutes.

Options

<UINT32> Integer in the form: D OR 0xHHHHHHHH.
Example: 123

Example

session-timeout 10

Syntax

no session-timeout

Mode

Client

Description

Clear the default session timeout.

Example

no session-timeout

Syntax

netbios-over-sslvpn

Mode

Client

Description

Enable NetBIOS over SSL VPN.

Example

netbios-over-sslvpn

Syntax

no netbios-over-sslvpn

Mode

Client

Description

Disable NetBIOS over SSL VPN.

Example

no netbios-over-sslvpn

Syntax

auto-update

Mode

Client

Description

Enable client auto update.

Example

auto-update

Syntax

no auto-update

Mode

Client

Description

Disable client auto update.

Example

no auto-update

Syntax

exit-after-disconnect

Mode

Client

Description

Enable exit client after disconnect.

Example

exit-after-disconnect

Syntax

no exit-after-disconnect

Mode

Client

Description

Disable exit client after disconnect.

Example

no exit-after-disconnect

Syntax

uninstall-after-exit

Mode

Client

Description

Enable uninstall client after exit.

Example

uninstall-after-exit

Syntax

no uninstall-after-exit

Mode

Client

Description

Disable uninstall client after exit.

Example

no uninstall-after-exit

Syntax

create-connection-profile

Mode

Client

Description

Enable create client connection profile.

Example

create-connection-profile

Syntax

no create-connection-profile

Mode

Client

Description

Disable create client connection profile.

Example

no create-connection-profile

Syntax

client-communicate

Mode

Client

Description

Enable communication between clients.

Example

client-communicate

Syntax

no client-communicate

Mode

Client

Description

Disable communication between clients.

Example

no client-communicate

Syntax

cache { credentials | user-name-only }

Mode

Client

Description

Set user name and password caching.

Options

 
credentialsAllow saving of user name and password.
 
user-name-onlyAllow saving of user name only.

Example

cache user-name-only

Syntax

no cache

Mode

Client

Description

Prohibit saving of user name and password.

Example

no cache

Syntax

tunnel-all

Mode

Client Routes

Description

Enable tunnel all.

Example

tunnel-all

Syntax

no tunnel-all

Mode

Client Routes

Description

Disable tunnel all.

Example

no tunnel-all

Syntax

route { host <ADDR_HOST> | name <ADDR_HOST_NETWORK_NAME> | network <ADDR_NETWORK> <ADDR_MASK> }

Mode

Client Routes

Description

Add a client route.

Options

 
hostAdd client route of host address.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAdd client route of named address object.
<ADDR_HOST_NETWORK_NAME> Host or network address object name.
Example: Web Server
 
networkAdd client route of network address.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n

Example

route name "Corp SSL-VPN Servers"

Syntax

no route { host <ADDR_HOST> | name <ADDR_HOST_NETWORK_NAME> | network <ADDR_NETWORK> <ADDR_MASK> }

Mode

Client Routes

Description

Delete a client route.

Options

 
hostAdd client route of host address.
<ADDR_HOST> IPV4: address object IPv4 host address in the form: D.D.D.D\nIPV6: address object IPv6 host address in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.168\nIPV6: 2001:cdba:0000:0000:0000:0000:3257:9652\n
 
nameAdd client route of named address object.
<ADDR_HOST_NETWORK_NAME> Host or network address object name.
Example: Web Server
 
networkAdd client route of network address.
<ADDR_NETWORK> IPV4: address object IPv4 network in the form: D.D.D.D\nIPV6: address object IPv6 network in the form: HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH:HHHH\n.
Example: IPV4: 192.168.168.0\nIPV6: 2001:cdba:3257:effe:0000:0000:0000:0000\n
<ADDR_MASK> IPV4: address object IPv4 netmask in decimal dotted or CIDR form: D.D.D.D OR /D\nIPV6: address object IPv6 netmask in the form: /D\n.
Example: IPV4: 255.255.255.0\nIPV6: /64\n

Example

no route name "Corp SSL-VPN Servers"

Syntax

no routes

Mode

Client Routes

Description

Delete all client routes.

Example

no routes

Syntax

bookmark <SSLVPN_BOOKMARK>

Mode

Virtual Office

Local User
Local Group

Description

Add/edit bookmark and enter configuration mode.

Options

<SSLVPN_BOOKMARK> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

bookmark "Admin Desktop"

Syntax

no bookmark <SSLVPN_BOOKMARK>

Mode

Virtual Office

Local User
Local Group

Description

Delete a specified bookmark.

Options

<SSLVPN_BOOKMARK> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

no bookmark "Admin Work Desktop"

Syntax

no bookmarks

Mode

Virtual Office

Local User
Local Group

Description

Delete all bookmarks.

Example

no bookmarks

Syntax

name <SSLVPN_BOOKMARK>

Mode

Bookmark

Description

Set bookmark name.

Options

<SSLVPN_BOOKMARK> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

name "Admin Work Desktop"

Syntax

host <HOSTNAME>

Mode

Bookmark

Description

Set host name or IP address.

Options

<HOSTNAME> Hostname in the form: hostname OR a.b.c.d.
Example: example.com

Example

host 192.168.168.57

Syntax

no host

Mode

Bookmark

Description

Clear host name or IP address.

Example

no host

Syntax

service { rdp-activex | rdp-java | sshv1 | sshv2 | telnet | vnc }

Mode

Bookmark

Description

Set bookmark service type.

Options

 
rdp-activexTerminal services (RDP5-ActiveX).
 
rdp-javaTerminal services (RDP5-JAVA).
 
sshv1Secure shell version 1 (SSHv1).
 
sshv2Secure shell version 2 (SSHv2).
 
telnetTelnet.
 
vncVirtual network computing (VNC).

Example

service vnc

Syntax

screen-size { 1024x768 | 1280x1024 | 640x480 | 800x600 | full-screen }

Mode

ActiveX

Java

Description

Set screen size.

Options

 
1024x7681024x768.
 
1280x10241280x1024.
 
640x480640x480.
 
800x600800x600.
 
full-screenFull screen.

Example

screen-size 1024x768

Syntax

colors { 15bit | 16bit | 24bit | 256 | 32bit }

Mode

ActiveX

Java

Description

Set screen colors.

Options

 
15bit15 bit - high color.
 
16bit16 bit - high color.
 
24bit24 bit - high color.
 
256256 bit.
 
32bit32 bit - highest quality.

Example

colors 24bit

Syntax

application-path <WORD>

Mode

ActiveX

Java

Description

Set application and path to launch.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

application-path "C:\\\\Remote Applications\\\\myapp.exe"

Syntax

no application-path

Mode

ActiveX

Java

Description

Clear application and path.

Example

no application-path

Syntax

start-in-folder <WORD>

Mode

ActiveX

Java

Description

Set folder to start in.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

start-in-folder "C:\\Work\\"

Syntax

no start-in-folder

Mode

ActiveX

Java

Description

Clear folder to start in.

Example

no start-in-folder

Syntax

redirect-printers

Mode

ActiveX

Java

Description

Enable redirect printers.

Example

redirect-printers

Syntax

no redirect-printers

Mode

ActiveX

Java

Description

Disable redirect printers.

Example

no redirect-printers

Syntax

redirect-drives

Mode

ActiveX

Java

Description

Enable redirect drives.

Example

redirect-drives

Syntax

no redirect-drives

Mode

ActiveX

Java

Description

Disable redirect drives.

Example

no redirect-drives

Syntax

redirect-ports

Mode

ActiveX

Java

Description

Enable redirect ports.

Example

redirect-ports

Syntax

no redirect-ports

Mode

ActiveX

Java

Description

Disable redirect ports.

Example

no redirect-ports

Syntax

redirect-smartcards

Mode

ActiveX

Java

Description

Enable redirect smartcards.

Example

redirect-smartcards

Syntax

no redirect-smartcards

Mode

ActiveX

Java

Description

Disable redirect smartcards.

Example

no redirect-smartcards

Syntax

console-session-login

Mode

ActiveX

Java

Description

Enable login to console session.

Example

console-session-login

Syntax

no console-session-login

Mode

ActiveX

Java

Description

Disable login to console session.

Example

no console-session-login

Syntax

automatic-login { custom [ name <WORD> ] [ password <ENC_PASSWORD> ] [ domain <WORD> ] | ssl-vpn }

Mode

ActiveX

Java

Description

Enable automatically log in.

Options

 
customUse custom account credentials.
nameEnter login name.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
passwordEnter login password.
<ENC_PASSWORD> Password.
Example: secret
domainEnter login domain.
<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
ssl-vpnUse SSL-VPN account credentials.

Example

automatic-login custom name myuser password mypassword domain mydomain

Syntax

no automatic-login

Mode

ActiveX

Java

Description

Disable automatically log in.

Example

no automatic-login

Syntax

plugin-dlls <WORD>

Mode

ActiveX

Description

Enable plugin DLLs.

Options

<WORD> Word in the form: WORD or \"QUOTED STRING\".
Example: abc

Example

plugin-dlls x.dll

Syntax

no plugin-dlls

Mode

ActiveX

Description

Disable plugin DLLs.

Example

no plugin-dlls

Syntax

display-connection-bar

Mode

Java

Description

Enable display connection bar.

Example

display-connection-bar

Syntax

no display-connection-bar

Mode

Java

Description

Disable display connection bar.

Example

no display-connection-bar

Syntax

dual-monitors

Mode

Java

Description

Enable dual monitors.

Example

dual-monitors

Syntax

no dual-monitors

Mode

Java

Description

Disable dual monitors.

Example

no dual-monitors

Syntax

redirect-clipboard

Mode

Java

Description

Enable redirect clipboard.

Example

redirect-clipboard

Syntax

no redirect-clipboard

Mode

Java

Description

Disable redirect clipboard.

Example

no redirect-clipboard

Syntax

redirect-plug-and-play

Mode

Java

Description

Enable redirect plug and play devices.

Example

redirect-plug-and-play

Syntax

no redirect-plug-and-play

Mode

Java

Description

Disable redirect plug and play devices.

Example

no redirect-plug-and-play

Syntax

auto-reconnection

Mode

Java

Description

Enable automatic reconnection.

Example

auto-reconnection

Syntax

no auto-reconnection

Mode

Java

Description

Disable automatic reconnections.

Example

no auto-reconnection

Syntax

desktop-background

Mode

Java

Description

Enable desktop background.

Example

desktop-background

Syntax

no desktop-background

Mode

Java

Description

Disable desktop background.

Example

no desktop-background

Syntax

font-smoothing

Mode

Java

Description

Enable font smoothing.

Example

font-smoothing

Syntax

no font-smoothing

Mode

Java

Description

Disable font smoothing.

Example

no font-smoothing

Syntax

desktop-composition

Mode

Java

Description

Enable desktop composition.

Example

desktop-composition

Syntax

no desktop-composition

Mode

Java

Description

Disable desktop composition.

Example

no desktop-composition

Syntax

window-drag

Mode

Java

Description

Enable window drag.

Example

window-drag

Syntax

no window-drag

Mode

Java

Description

Disable window drag.

Example

no window-drag

Syntax

animation

Mode

Java

Description

Enable menu / window animation.

Example

animation

Syntax

no animation

Mode

Java

Description

Disable menu / window animation.

Example

no animation

Syntax

themes

Mode

Java

Description

Enable themes.

Example

themes

Syntax

no themes

Mode

Java

Description

Disable themes.

Example

no themes

Syntax

bitmap-caching

Mode

Java

Description

Enable bitmap caching.

Example

bitmap-caching

Syntax

no bitmap-caching

Mode

Java

Description

Disable bitmap caching.

Example

no bitmap-caching

Syntax

encoding { corre | hextile | raw | rre | tight | zlib }

Mode

VNC

Description

Set encoding type.

Options

 
correSet CoRRE encoding type.
 
hextileSet hextile encoding type.
 
rawSet raw encoding type.
 
rreSet RRE encoding type.
 
tightSet tight encoding type.
 
zlibSet ZLIB encoding type.

Example

encoding raw

Syntax

compression-level <UINT8>

Mode

VNC

Description

Set compression level.

Options

<UINT8> Integer in the form: D OR 0xHH.
Example: 123

Example

compression-level 5

Syntax

jpeg-image-quality { level <UINT8> | off }

Mode

VNC

Description

Set JPEG image quality.

Options

 
levelSet JPEG image quality level.
<UINT8> Integer in the form: D OR 0xHH.
Example: 123
 
offTurn off JPEG image quality.

Example

jpeg-image-quality level 5

Syntax

cursor-shape-updates { disable | enable | ignore }

Mode

VNC

Description

Set cursor shape updates.

Options

 
disableDisable cursor shape updates.
 
enableEnable cursor shape updates.
 
ignoreIgnore cursor shape updates.

Example

cursor-shape-updates ignore

Syntax

use-copyrect

Mode

VNC

Description

Enable use copyrect.

Example

use-copyrect

Syntax

no use-copyrect

Mode

VNC

Description

Disable use copyrect.

Example

no use-copyrect

Syntax

restricted-colors

Mode

VNC

Description

Enable restricted colors (256).

Example

restricted-colors

Syntax

no restricted-colors

Mode

VNC

Description

Disable restricted colors (256).

Example

no restricted-colors

Syntax

reverse-mouse-buttons

Mode

VNC

Description

Enable reverse mouse buttons 2 and 3.

Example

reverse-mouse-buttons

Syntax

no reverse-mouse-buttons

Mode

VNC

Description

Disable reverse mouse buttons 2 and 3.

Example

no reverse-mouse-buttons

Syntax

view-only

Mode

VNC

Description

Enable view only.

Example

view-only

Syntax

no view-only

Mode

VNC

Description

Disable view only.

Example

no view-only

Syntax

share-desktop

Mode

VNC

Description

Enable share desktop.

Example

share-desktop

Syntax

no share-desktop

Mode

VNC

Description

Disable share desktop.

Example

no share-desktop

Syntax

automatic-accept-host-key

Mode

SSHV2

Description

Enable automatically accept host key.

Example

automatic-accept-host-key

Syntax

no automatic-accept-host-key

Mode

SSHV2

Description

Disable automatically accept host key.

Example

no automatic-accept-host-key

Syntax

bypass-user-name

Mode

SSHV2

Description

Enable bypass username.

Example

bypass-user-name

Syntax

no bypass-user-name

Mode

SSHV2

Description

Disable bypass username.

Example

no bypass-user-name

Syntax

show ssl-vpn [ bookmark <SSLVPN_BOOKMARK> | bookmarks | client | portal | routes | server | sessions | statistics <SSLVPN_LOGOUT_IPV4_HOST> ] [ { pending-config | with-pending-config } ] [ json | validate | xml ]

Mode

All Modes

Description

Show SSL VPN status or configuration.

Options

 
bookmarkShow a specified virtual office bookmark.
<SSLVPN_BOOKMARK> Word in the form: WORD or \"QUOTED STRING\".
Example: abc
 
bookmarksShow all virtual office bookmarks.
 
clientShow client configuration.
 
portalShow portal configuration.
 
routesShow client route configuration.
 
serverShow server configuration.
 
sessionsShow all active sessions.
 
statisticsShow statistics for the session associated with the specified NetExtender virtual IP.
<SSLVPN_LOGOUT_IPV4_HOST> IPV4 Address in the form: a.b.c.d.
Example: 192.168.168.168
 
pending-configShow pending configuration changes.
 
with-pending-configView current configuration with pending changes included in the output.
 
jsonFormat output as JSON.
 
validateValidate configuration settings.
 
xmlFormat output as XML.

Example

show ssl-vpn