D-link DFL-CP310 Reference Guide
D-Link NetDefend
Internet Security Firewall
CLI Reference Guide
Version 1.0
Revised: 01/17/06
COPYRIGHT & TRADEMARKS
Copyright © 2005 SofaWare, All Rights Reserved. No part of this
document may be reproduced in any form or by any means withou t
written permission from SofaWare.
Information in this document is subject to change without notice and
does not represent a commitment on part of SofaWare Technologies
Ltd.
SofaWare, Safe@Home and Safe@Office are trademarks, service
marks, or registered trademarks of SofaWare Technologies Ltd.
Check Point, the Check Point logo, FireWall-1, FireWall-1
SecureServer, FireWall-1 SmallOffice, FloodGate-1, INSPECT, IQ
Engine, Meta IP, MultiGate, Open Security Extension, OPSEC,
Provider-1, SecureKnowledge, SecureUpdate, SiteManager-1, SVN,
UAM, User-to-Address Mapping, UserAuthority, Visual Policy
Editor, VPN-1, VPN-1 Accelerator Card, VPN-1 Gateway, VPN-1
SecureClient, VPN-1 SecuRemote, VPN-1 SecureServer, and VPN-1
Edge are trademarks, service marks, or registe red tra dem arks of Chec k
Point Software Technologies Ltd. or its affiliates.
All other product names mentioned herein are trademarks or registered
trademarks of their respective owners.
The products described in th is document are protected by U .S. Patent
No. 5,606,668 and 5,835,726 and may be protected by other U.S.
Patents, foreign patents, or pending applications.
GNU GENERAL PUBLIC LICENSE
Version 2, June 1991
Copyright © 1989, 1991 Free Software Foundation, Inc.
59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
Everyone is permitted to copy and distribute verbatim copies of this
license document, but changing it is not all ow ed.
PREAMBLE
The licenses for most software are designed to take aw ay your
freedom to share and change it. By contrast, the GNU General Public
License is intended to guarantee your freedom to share and change
free software--to make sure the software is free for all its users. This
General Public License applies to most of the Free Software
Foundation's software and to any other program whose authors
commit to using it. (Some other Free Software Foundation software is
covered by the GNU Library General Public License instead.) You
can apply it to your program s, too.
When we speak of free software, we are referring to freedom, not
price. Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
this service if you wish), that you receive source code or can get it if
you want it, that you can change the software or use pieces of it in new
free programs; and that you know you can do these things.
To protect your rights, we need to make restrictions that forbid anyone
to deny you these rights or to ask you to surrender the rights. These
restrictions translate to certain responsibilities for you if you distribute
copies of the software, or if you modify it.
For example, if you distribute copies of such a program, whether
gratis or for a fee, you must give the recipients all the rights that you
have. You must make sure that they, too, receive or can get the source
code. And you must show them these terms so they know their rights.
We protect your rights with two steps: (1) copyright the software, and
(2) offer you this license which gives you legal permissio n to copy,
distribute and/or modify the software.
Also, for each author's protection and ours, we want to make certain
that everyone understands that there is no warranty for this free
software. If the software is modified by someone else and passed on,
we want its recipients to know that what they have is not the original,
so that any problems introd uced by others will not reflect on the
original authors' reputations.
Finally, any free program is threatened constantly by software patents.
We wish to avoid the danger that r e distributors of a free program will
individually obtain patent licenses, in effect making the program
proprietary. To prevent this, we have made it clear that any patent
must be licensed for everyone's free use or not licensed at all.
The precise terms and conditions for copying, distribution and
modification follow.
GNU GENERAL PUBLIC LICENSE TERMS AND CONDITIONS
FOR COPYING, DISTRIBUTION AND MODIFICATION
0. This License applies to any program or other work which
contains a notice placed by the copyright holder saying it may be
distributed under the terms of this General Public License. The
"Program", below, refers to any such program or work, and a "work
based on the Program" means either the Program or any derivative
work under copyright law: that is to say, a work containing the
Program or a portion of it, either verbatim or with modifications
and/or translated into another language. (Hereinafter, translation is
included without limitation in the term "modification".) Each licensee
is addressed as "you".
Activities other than copy ing, distribution and modification are not
covered by this License; they are outside its scope. The act of running
the Program is not restricted, and the output from the Program is
covered only if its contents constitute a work based on the Program
(independent of having been made by running the Program). Whether
that is true depends on what the Program does.
1. You may copy and distribute verbatim copies of the Program's
source code as you receive it, in any medium, provided that you
conspicuously and appropriately publish on each copy an appropriate
copyright notice and disclaimer of warranty; keep intact all the notices
that refer to this License and to the absence of any warranty; and give
any other recipients of the Program a copy of this License along with
the Program.
You may charge a fee for the physical act of transferring a copy, and
you may at your option offer warranty protection in exchange for a
fee.
2. You may modify your copy or copies of the Program or any
portion of it, thus form ing a work based on the Program, and copy and
distribute such modifications or work under the terms of Section 1
above, provided that you also meet all of these conditions:
a) You must cause the modified files to carry prominent
notices stating that you changed the files and the date of
any change.
b) You must cause any work that you distribute or publish,
that in whole or in part contains or is derived from the
Program or any part thereof, to be licensed as a whole at
no charge to all third partie s under the terms of this
License.
c) If the modified program normally reads commands
interactively when run, you must cause it, when started
running for such interactive use in the most ordinary way,
to print or display an announcement including an
appropriate copyright notice and a notice that there is no
warranty (or else, saying that you provide a warranty) and
that users may redistribute the program under these
conditions, and telling the user how to view a copy of this
License. (Exception: if the Program itself is interactive but
does not normally print such an announcement, your work
based on the Program is not requ ired to print an
announcement.)
These requirements apply to the modified work as a whole. If
identifiable sections of that work are not derived from the Program,
and can be reasonably considered independent and separate works in
themselves, then this License, and its terms, do not apply to those
sections when you distribu te them as separate works. But when you
distribute the same sections as part of a whole which is a work based
on the Program, the distribution of the whole must be on the terms of
this License, whose permissions for other licensees extend to the
entire whole, and thus to each and every part regardless of who wrote
it.
Thus, it is not the intent of this section to claim rights or contest your
rights to work written entirely by you; rather, the intent is to exercise
the right to control the distribution of derivative or collective works
based on the Program.
In addition, mere aggregation of another work not based on the
Program with the Program (or with a work based on the Program) on a
volume of a storage or distribution medium does not bring the other
work under the scope of this License.
3. You may copy and distribute the Program (or a work based on it,
under Section 2) in object code or executable form under the terms of
Sections 1 and 2 above provided that you also do one of the following :
a) Accompany it with the complete corresponding
machine-readable source code, which must be distributed
under the terms of Sections 1 and 2 above on a medium
customarily used for software interchange; or,
b) Accompany it with a written offer, valid for at least
three years, to give any third party, for a charge no more
than your cost of physically performing source
distribution, a complete machine-readable copy of the
corresponding source code, to be distributed under the
terms of Sections 1 and 2 above on a medium customarily
used for software interchange; or,
c) Accompany it with the information you received as to
the offer to distribute corresponding source code. (This
alternative is allowed only for noncommercial distribution
and only if you received the program in object code or
executable form with such an offer, in accord with
Subsection b above.)
The source code for a work means the preferred form of the work for
making modifications to it. For an executable work, complete source
code means all the source code for all modules it contains, plus any
associated interface definition files, plus the scripts used to control
compilation and installation of the executable. However, as a special
exception, the source code distributed need not include anything that
is normally distributed (in either source or binary form) with t he major
components (compiler, ker nel, and so on) of the operating syste m on
which the executable runs, unless that component itself accompanies
the executable.
If distribution of executable or object code is made by offering access
to copy from a designated place, then offering equivalent access to
copy the source code from the same place counts as distribution of the
source code, even though third parties are not compelled to copy the
source along with the object code.
4. You may not copy, modify, sublicense, or distribute the Program
except as expressly provided under this License. Any attempt
otherwise to copy, modify, sublicense or distribute the Program is
void, and will automatically terminate your rights under this License.
However, parties who have received copies, or rights, from you under
this License will not have their licenses terminated so long as such
parties remain in full compliance.
5. You are not required to accept this License, since you have not
signed it. However, nothing else grants you permission to modify or
distribute the Program or its derivative works. These actions are
prohibited by law if you do not accept this License. Therefore, by
modifying or distributing the Program (or any work based on the
Program), you indicate your acceptance of this License to do so, and
all its terms and conditions for copying, distributing or m odifying the
Program or works based on it.
6. Each time you redistribute the Program (or any work based on
the Program), the recipient automatically receives a license from the
original licensor to copy, distribute or modify the Program subject to
these terms and conditions. You may not impose any further
restrictions on the recipients' exercise of the rights granted herein. You
are not responsible for enforcing compliance by third parties to this
License.
7. If, as a consequence of a court judgment or allegation of patent
infringement or for any other reason (not limited to patent issues),
conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot
distribute so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence
you may not distribute the Program at all. For example, if a patent
license would not permit royalty-free redistribution of the Progr am by
all those who receive copies directly or indirectly through you, th e n
the only way you could satisfy both it and this License would be to
refrain entirely from distribution of the Program.
If any portion of this section is held invalid or unenforceable under
any particular circumstance, the balance of the section is intended to
apply and the section as a whole is intended to apply in other
circumstances.
It is not the purpose of this section to induce you to infringe any
patents or other property right claims or to contest validity of any such
claims; this section has the sole purpose of protecting the integrity of
the free software distribution system, which is implemented by public
license practices. Many people have made generous contribu tions to
the wide range of software distributed through that system in reliance
on consistent application of that system; it is up to the author/donor to
decide if he or she is willing to distribute software through any other
system and a licensee cannot impose that choice.
This section is intended to make thoroughly clear what is believed to
be a consequence of the rest of this License.
8. If the distribution and/or use of the Program is restricted in
certain countries either by patents or by copyrighted interfaces, the
original copyright holder who places the Program under this License
may add an explicit geographical distribution limitation excluding
those countries, so that dis tribution is permitted only in or among
countries not thus excluded. In such case, this License incorporates the
limitation as if written in the body of this License.
9. The Free Software Foundation may publish revised and/or new
versions of the General Public License from time to time. Such new
versions will be similar in spirit to the present version, but may differ
in detail to address new problems or concerns.
Each version is given a distinguishing version number. If the Program
specifies a version number of this License which applies to it and "any
later version", you have the option of following the terms and
conditions either of that version or of any later version published by
the Free Software Foundation. If the Program does not specify a
version number of this License, you may choose any version ever
published by the Free Software Foundation.
10. If you wish to incorporate parts of the Program into other free
programs whose distribution conditions are different, write to the
author to ask for permission. For software which is copyrighted by the
Free Software Foundation, write to the Free Software Foundation; we
sometimes make exceptions for this. Our decision will be guided by
the two goals of preserving the free status of all derivatives of our free
software and of promoting the sharing and reuse of software generally.
NO WARRANTY
11. BECAUSE THE PROGRAM IS LICENSED FREE OF
CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO
THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT
WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE
PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND,
EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND
PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD
THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST
OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE
LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT
HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED
ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING
ANY GENERAL, SPECIAL, INCIDENTAL OR
CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR
INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT
LIMITED TO LOSS OF DATA OR DATA BEING RENDERED
INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE
WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR
OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
SUCH DAMAGES.
To receive the SofaWare GPL licensed code, contact
info@sofaware.com.
SAFETY PRECAUTIONS
Carefully read the Safety Instructions the Installation and Operating
Procedures provided in this User's Guide before at tempting to install
or operate the appliance. Failure to follow these instructions may
result in damage to equipm e nt and/or personal injuries.
Before cleaning the appliance, unplug the power cord. Use
only a soft cloth dampened with water for cleaning.
When installing the appliance, ensure that the vents are not
blocked.
Do not place this product on an unstable surface or support.
The product may fall, causing serious injury to a child or adult,
as well as serious damage to the product.
Do not use the appliance outdoors.
Do not expose the appliance to liquid or moisture.
Do not expose the appliance to e xtreme high or low
temperatures.
Do not disassemble or open the appliance. Failure to comply
will void the warranty.
Do not use any accessories other than those approved by
Check Point. Failure to do so may result in loss of
performance, damage to the product, fire, electric shock or
injury, and will void the warranty.
Route power supply cords where they are not likely to be
walked on or pinched by items placed on or against them. Pay
particular attention to cords where they are attached to plugs
and convenience receptacles, and examine the point where
they exit the unit.
Do not connect or disconnect power supply cables and data
transmission lines during thunderstorms.
Do not overload wall outlets or extension cords, as this can
result in a risk of fire or electric shock. Overloaded AC outlets,
extension cords, frayed power cords, damaged or cracked wire
insulation, and broken plugs are dangerous. They may result in
a shock or fire hazard. Periodically examine the cord, and if its
appearance indicates damage or deteriorated insulation, have it
replaced by your service technician.
If the unit or any part of it is damaged, disconnect the power
plug and inform the responsible service personnel. Nonobservance may result in damage to the router.
POWER ADAPTER
Operate this product only from the type of power source
indicated on the product’s marking label. If you are not sure of
the type of power supplied to your home, consult your dealer
or local power company.
Use only the power supply provided with your product. Check
whether the device’s set supply voltage is the same as the local
supply voltage.
To reduce risk of damage to the unit, remove it from the outlet
by holding the power adapter rather than the cord.
SECURITY DISCLAIMER
The appliance provides your office network with the highest level of
security. However, no single security product can provide you with
absolute protection against a determined effort to break into your
system. We recommend using additional security measures to secure
highly valuable or sensitive information.
Contents
Contents
Chapter 1: Introduction.......................................................................................................................1
About Your D-Link NetDefend Firewall............................................................................................1
Using This Reference..........................................................................................................................2
Document Conventions and Syntax....................................................................................................3
Related Publications............................................................................................................................4
Chapter 2: Using the Serial Console....................................................................................................5
Chapter 3: Using the NetDefend Command Line Interface..............................................................7
General Guidelines..............................................................................................................................8
Command Line Editing...................................................................................................................9
Running Commands............................................................................................................................9
Using the NetDefend Portal..................................................................................................... .....10
Using SSH.....................................................................................................................................11
Importing CLI Scripts...................................................................................................................13
Typical Return Values.......................................................................................................................14
Chapter 4: CLI Commands................................................................................................................17
Variable Operation Commands.........................................................................................................18
add.................................................................................................................................................19
clear...............................................................................................................................................22
delete.............................................................................................................................................25
set..................................................................................................................................................28
show..............................................................................................................................................30
Appliance Operation Commands......................................................................................................32
quit................................................................................................................................................33
reset certificate..............................................................................................................................34
reset defaults .................................................................................................................................35
reset firmware ...............................................................................................................................36
Contents i
Contents
reset gateway.................................................................................................................................37
reset logs .......................................................................................................................................38
reset services.................................................................................................................................39
reset smartdefense ai cifs file-sharing patterns..............................................................................40
reset statistics................................................................................................................................41
reset vstream-database ..................................................................................................................42
updatenow.....................................................................................................................................43
Informational Commands..................................................................................................................44
authenticate...................................................................................................................................46
export............................................................................................................................................49
help................................................................................................................................................ 53
info certificate...............................................................................................................................56
info computers ..............................................................................................................................59
info connections............................................................................................................................64
info device.....................................................................................................................................67
info fw...........................................................................................................................................70
info logs ........................................................................................................................................72
info nat..........................................................................................................................................74
info net..........................................................................................................................................78
info ospf........................................................................................................................................80
info ospf database .........................................................................................................................81
info ospf interface.........................................................................................................................84
info ospf neighbor.........................................................................................................................86
info ospf routes .............................................................................................................................88
info ports.......................................................................................................................................90
info printers...................................................................................................................................92
info probe......................................................................................................................................94
ii D-Link NetDefend CLI Reference Guide
Contents
info statistics .................................................................................................................................96
info statistics interface ..................................................................................................................99
info statistics qos.........................................................................................................................102
info tunnels..................................................................................................................................104
info vstream ................................................................................................................................107
info wan ......................................................................................................................................109
info wireless ap...........................................................................................................................112
Chapter 5: CLI Variables.................................................................................................................115
certificate.........................................................................................................................................118
clock................................................................................................................................................121
device..............................................................................................................................................123
dhcp scopes.....................................................................................................................................125
dialup...............................................................................................................................................131
fw....................................................................................................................................................134
fw rules............................................................................................................................................137
fw servers........................................................................................................................................145
ha.....................................................................................................................................................148
ha effect...........................................................................................................................................152
ha track............................................................................................................................................154
https.................................................................................................................................................156
hotspot.............................................................................................................................................159
mailfilter antispam ..........................................................................................................................162
mailfilter antivirus...........................................................................................................................164
mailfilter protocols..........................................................................................................................166
net dmz............................................................................................................................................168
net dmz ha.......................................................................................................................................175
net dmz ospf....................................................................................................................................177
Contents iii
Contents
net dmz ospf md5............................................................................................................................179
net lan..............................................................................................................................................181
net lan ha.........................................................................................................................................187
net lan ospf......................................................................................................................................188
net lan ospf md5..............................................................................................................................189
net officemode.................................................................................................................................190
net wan............................................................................................................................................195
net wan ospf....................................................................................................................................208
net wan ospf md5............................................................................................................................209
net wan probe..................................................................................................................................210
net wan2..........................................................................................................................................214
net wan2 ospf..................................................................................................................................216
net wan2 ospf md5..........................................................................................................................217
net wan2 probe................................................................................................................................218
net wlan...........................................................................................................................................219
net wlan ha......................................................................................................................................225
netobj...............................................................................................................................................226
ospf..................................................................................................................................................231
ospf area..........................................................................................................................................234
ospf network....................................................................................................................................236
ospf redistribute...............................................................................................................................238
ospf redistribute connected .............................................................................................................239
ospf redistribute kernel....................................................................................................................241
port dmz..........................................................................................................................................243
port lan1 / port lan2 / port lan3 / port lan4......................................................................................245
port serial ........................................................................................................................................247
port wan ..........................................................................................................................................249
iv D-Link NetDefend CLI Reference Guide
Contents
printers ............................................................................................................................................251
qos classes.......................................................................................................................................253
radius permissions...........................................................................................................................259
radius servers...................................................................................................................................262
routes...............................................................................................................................................265
smartdefense ai cifs file-sharing......................................................................................................268
smartdefense ai cifs file-sharing patterns........................................................................................271
smartdefense ai ftp..........................................................................................................................274
smartdefense ai ftp bounce..............................................................................................................277
smartdefense ai ftp commands........................................................................................................279
smartdefense ai im icq..................................................................................................................... 282
smartdefense ai im skype................................................................................................................284
smartdefense ai im yahoo................................................................................................................285
smartdefense ai p2p bittorrent .........................................................................................................286
smartdefense ai p2p emule..............................................................................................................288
smartdefense ai p2p gnutella...........................................................................................................290
smartdefense ai p2p kazaa...............................................................................................................292
smartdefense ai routing igmp..........................................................................................................294
smartdefense network-security dos flooding...................................................................................296
smartdefense network-security dos land.........................................................................................299
smartdefense network-security dos ping-of-death...........................................................................301
smartdefense network-security dos teardrop...................................................................................303
smartdefense network-security ip-icmp cisco-ios...........................................................................305
smartdefense network-security ip-icmp fragments .........................................................................308
smartdefense network-security ip-icmp max-ping-size...................................................................311
smartdefense network-security ip-icmp net-quota..........................................................................313
smartdefense network-security ip-icmp null-payload.....................................................................316
Contents v
Contents
smartdefense network-security ip-icmp packet-sanity....................................................................318
smartdefense network-security ip-icmp welchia.............................................................................321
smartdefense network-security port-scan host-port-scan................................................................323
smartdefense network-security port-scan ip-sweep-scan................................................................326
smartdefense network-security tcp small-pmtu...............................................................................329
smartdefense network-security tcp strict-tcp...................................................................................331
smp..................................................................................................................................................333
snmp................................................................................................................................................335
ssh ...................................................................................................................................................338
statistics...........................................................................................................................................341
syslog ..............................................................................................................................................343
users ................................................................................................................................................345
vlan..................................................................................................................................................350
vlan ospf..........................................................................................................................................357
vlan ospf md5..................................................................................................................................359
vpn externalserver...........................................................................................................................361
vpn internalserver............................................................................................................................364
vpn sites ..........................................................................................................................................366
vpn sites ospf...................................................................................................................................378
vpn sites ospf md5...........................................................................................................................380
vstream............................................................................................................................................382
vstream archive-options..................................................................................................................385
vstream options...............................................................................................................................388
vstream policy rule..........................................................................................................................392
webfilter..........................................................................................................................................400
webfilter categories.........................................................................................................................402
wireless ...........................................................................................................................................404
vi D-Link NetDefend CLI Reference Guide
Contents
wireless wep....................................................................................................................................416
wireless wpa....................................................................................................................................419
wireless wpapsk ..............................................................................................................................421
Chapter 6: Country Codes...............................................................................................................423
Glossary of Terms.............................................................................................................................429
Index...................................................................................................................................................437
Contents vii
About Your D-Link NetDefend Firewall
Chapter 1
Introduction
This chapter introduces the D-Link NetDefend Firewall and this guide.
This chapter includes the following topics:
About Your D-Link NetDefend Firewall .....................................................1
Using This Reference ...................................................................................2
Document Conventions and Syntax..............................................................3
Related Publications.....................................................................................4
About Your D-Link NetDefend Firewall
The D-Link NetDefend firewall is a unified threat management (UTM) appliance
that enables secure high-speed Internet access from the office. Incorporating
software by SofaWare Technologies, an affiliate of Check Point Software
Technologies, the worldwide leader in securing the Internet, the NetDefend
Secured by Check Point Product Family includes both wired and wireless models.
The D-Link firewall, based on the world-leading Check Point Embedded NGX
Stateful Inspection technology, inspects and filters all incoming and outgoing
traffic, blocking all unauthorized traffic.
The NetDefend firewall also allows sharing your Internet connection among
several PCs or other network devices, enabling advanced office networking and
saving the cost of purchasing static IP addresses.
With the NetDefend firewall, you can subscribe to additional security services
available from select service providers, including firewall security and software
updates, Antivirus, Web Filtering, reporting, and VPN management. By supporting
integrated VPN capabilities, the NetDefend firewall allows teleworkers and road
warriors to securely connect to the office network, and enables secure
interconnection of branch offices.
Chapter 1: Introduction 1
Using This Reference
Using This Reference
This reference guide explains how to use CLI commands to control your
NetDefend firewall.
In the chapter CLI Commands on page 17, the CLI commands are divided into
groups, according to their purpose. The commands are presented in alphabetical
order within those groups.
Several CLI commands have CLI variables as their parameters. These CLI
variables function as sub-commands and may have multiple fields.
This guide presents CLI variables in a separate chapter, CLI Variables on page
115. Like CLI commands, the CLI variables appear in alphabetical order. However,
the variables are not divided into groups, because a single variable may be used by
more than one group of commands.
The following information is provided for each CLI command or variable:
Purpose Describes the command or variable's purpose and provides
background information
Effect Describes the effect of running the command. Relevant for
Appliance Operation commands only.
Syntax The format of the command
Parameters Describes the command's parameters, if there are any.
Relevant for commands only.
Fields Describes the variable's fields, if there are any. Relevant for
variables only.
2 D-Link NetDefend CLI Reference Guide
Document Conventions and Syntax
Return Values The values returned in the command line interface.
This information is provided only when running the
command results in return values other than the typical
values, for example when you run Informational commands.
For information on the typical return values, see Typical
Return Values on page 14. For information on Informational
commands, see Informational Commands on page 44.
Examples One or more examples that illustrate the command or
variable's usage
Note: The information in this guide is relevant for both NetDefend firewalls. For
information on specific NetDefend firewall models, refer to your NetDefend firewall's
User Guide (see Related Publications on page 4).
Document Conventions and Syntax
To make finding information in this manual easier, some types of information are
marked with special symbols or formatting.
Boldface type is used for button names.
Note: Notes are denoted by indented text and preceded by the Note icon.
Warning: Warnings are denoted by indented text and preceded by the Warning icon.
CLI commands and variables appear in Courier style:
command
CLI command syntax is presented in the following format:
command mandatory-parameter [optional-parameter]
CLI variable syntax is presented in the following format:
variable mandatory-field [optional-field]
Chapter 1: Introduction 3
Related Publications
Examples appear in Courier style in boxes:
This is an example of a CLI command.
Related Publications
Use this guide in conjunction with the User Guide provided with your appliance:
• NetDefend Secured by Check Point User Guide
4 D-Link NetDefend CLI Reference Guide
Related Publications
Chapter 2
Using the Serial Console
You can connect a console to the NetDefend firewall, and use the console to
control the appliance via the command line.
Note: Your terminal emulation software must be set to 57600 bps, N-8-1.
To run commands using a console
1. Connect the serial console to your NetDefend firewall's serial port, using an RS232 Null modem cable.
2. Log on to the NetDefend Portal.
For instructions, refer to the User Guide.
3. Click Network in the main menu, and click the Ports tab.
The Ports page appears.
4. In the RS232 drop-down list, select Console.
5. Click Apply.
You can now control the NetDefend firewall from the serial console.
Chapter 2: Using the Serial Console 5
Related Publications
Chapter 3
Using the NetDefend Command Line
Interface
This chapter explains how to use the command line interface to run a CLI
command and provides a list of typical return values.
This chapter includes the following topics:
General Guidelines.......................................................................................8
Running Commands.....................................................................................9
Typical Return Values................................................................................14
Chapter 3: Using the NetDefend Command Line Interface 7
General Guidelines
General Guidelines
When running commands in the NetDefend firewall, follow these guidelines:
• NetDefend CLI commands, variables, and fields are case-sensitive.
• It is not necessary to type a command or variable in its entirety; it is
sufficient to type the shortest string that is unique to the command or
variable.
For example, instead of typing:
delete netobj 3
You can type:
del neto 3
You cannot abbreviate netobj to net, because these letters are not unique to
netobj.
• If a command or variable is composed of multiple words, you may only
abbreviate the final word.
For example, instead of typing:
show qos classes 1
You can type:
sh qos cl 1
You cannot abbreviate qos classes to qos.
• Do not enclose commands, variables, or field names in quotation marks.
8 D-Link NetDefend CLI Reference Guide
Running Commands
• Occasionally, a field's value will be a string containing one or more spaces.
In this case, enclose the string in quotation marks.
For example:
set dialup type "Hayes Accura 56K"
Tip: If you are unsure how to configure a particular setting via the command line, you
can configure it in the NetDefend Portal tab, export the NetDefend firewall settings,
and then examine the exported settings to find out how the CLI command for the
desired setting looks.
For information on exporting settings via the command line, see export on page 49.
Command Line Editing
When using SSH or Serial Console:
• You can press the TAB key to either complete the current command, or
show a list of possible completions.
• All commands entered during a CLI session are saved in a command
history. You can browse through the command history by using the UP and
DOWN arrow keys.
Running Commands
Depending on your NetDefend model, you can control your appliance via the
command line in the following ways:
• Using the NetDefend Portal's command line interface.
See Using the NetDefend Portal on page 10.
• Using a console connected to the NetDefend firewall.
For information, see Using the Serial Console on page 5.
• Using an SSH client.
See Using SSH on page 11.
• Importing CLI scripts
Chapter 3: Using the NetDefend Command Line Interface 9
Running Commands
See Importing CLI Scripts on page 13.
Using the NetDefend Portal
You can run commands using the NetDefend Portal.
To run commands using the NetDefend Portal
1. Log on to the NetDefend Portal.
For instructions, refer to the User Guide.
2. Click Setup in the main menu, and click the Tools tab.
The Tools page appears.
3. Click Command.
The Command Line page appears.
4. In the upper field, type a command.
5. Click Go.
The command is implemented.
Return values appear in the lower field.
10 D-Link NetDefend CLI Reference Guide
Running Commands
Using SSH
NetDefend users can control the firewall via the command line, using the SSH
(Secure Shell) management protocol.
By default, SSH access is allowed only from the internal networks. You can allow
SSH access via the Internet, by configuring remote SSH access.
Note: The NetDefend firewall supports SSHv2 clients only. The SSHv1 protocol
contains security vulnerabilities and is not supported.
To enable SSH access from the Internet
1. Log on to the NetDefend Portal.
For instructions, refer to the User Guide.
2. Click Setup in the main menu, and click the Management tab.
The Management page appears.
3. Specify from where SSH access should be granted.
See Access Options on page 12 for information.
Warning: If remote SSH is enabled, your NetDefend firewall settings can be changed
remotely, so it is especially important to make sure all NetDefend firewall users’
passwords are difficult to guess.
If you selected IP Address Range, additional fields appear.
4. If you selected IP Address Range, enter the desired IP address range in the fields
provided.
5. Click Apply.
You can now control the NetDefend firewall using an SSHv2 client.
Chapter 3: Using the NetDefend Command Line Interface 11
Running Commands
Table 1: Access Options
Select this
To allow access from…
option…
Internal Network The internal network only.
This disables remote access capability. This is the default.
Internal Network and
VPN
IP Address Range A particular range of IP addresses.
ANY Any IP address.
The internal network and your VPN.
Additional fields appear, in which you can enter the desired I P address
range.
12 D-Link NetDefend CLI Reference Guide
Running Commands
Importing CLI Scripts
All NetDefend models enable you to import CLI scripts to the appliance.
To import CLI scripts
1. Do one of the following:
• Write a CLI script in a text file with the extension *.cfg.
• Edit an exported NetDefend configuration file.
For information on exporting configuration files, refer to the User Guide.
2. Log on to the NetDefend Portal.
For instructions, refer to the User Guide.
3. Click Setup in the main menu, and click the Tools tab.
The Tools page appears.
4. Click Import.
The Import Settings page appears.
5. Do one of the following:
• In the Import Settings field, type the full path to the configuration file.
Or
• Click Browse, and browse to the configuration file.
6. Click Upload.
A confirmation message appears.
7. Click OK.
The NetDefend firewall settings are imported.
The Import Settings page displays the configuration file's content and the result
of implementing each configuration command.
Chapter 3: Using the NetDefend Command Line Interface 13
Typical Return Values
Note: If the appliance's IP address changed as a result of the configuration import,
your computer may be disconnected from the network; therefore you may not be
able to see the results.
Typical Return Values
When you run a command whose purpose is to display information, the return
value is the information. For example, if you run the command
command line interface returns information about the firewall. These return values
are described after each relevant command and variable in this guide.
When you run a command whose purpose is not informational, the command line
interface typically returns one of the values listed in the table below.
Table 2: Typical Return Values
Value Explanation
info fw, then the
OK
Failed
item {deleted |
The command was implemented successfully.
The command failed.
The add / delete / clear command was implemented successfully.
added | cleared}
item cannot be
The add / delete / clear command failed.
{deleted | added |
cleared}
Possible
completions
<list of possible
The command you entered is not complete, because a variable or
a field is missing. Use the list provided to complete the command,
and then run the command again.
completions>
14 D-Link NetDefend CLI Reference Guide
Typical Return Values
Value Explanation
Missing value for
property name
Syntax error
<error>
Invalid index
The command you entered is not complete, because a field's
value is missing. Complete the command, and then run the
command again.
The syntax of the command you entered is incorrect. The
erroneous syntax is displayed.
The command you entered relates to a table in an incorrect way.
For example, in the case of
applies only to tables, and the variable is not a type of table.
delete device, the command
Chapter 3: Using the NetDefend Command Line Interface 15
Typical Return Values
Chapter 4
CLI Commands
This chapter provides a list of CLI commands for controlling your NetDefend
firewall. The CLI commands are divided into the following groups:
• Variable Operation Commands. CLI commands for working with variables
• Appliance Operation Commands. CLI commands for managing the
NetDefend firewall
• Informational Commands. CLI commands for displaying information about
your NetDefend firewall, its settings
Several CLI commands use CLI variables. For information on CLI variables, see
CLI Variables on page 115.
This chapter includes the following topics:
Variable Operation Commands..................................................................18
Appliance Operation Commands................................................................32
Informational Commands...........................................................................44
Chapter 4: CLI Commands 17
Variable Operation Commands
Variable Operation Commands
The commands in this section enable you to perform the following actions on
variables:
• Add a variable to a table
• Delete a variable from a table
• Modify a variable
• Display a variable's settings
• Display a table of variables
• Clear a table of variables
For information on CLI variables, see CLI Variables on page 115.
18 D-Link NetDefend CLI Reference Guide
Loading...