User manual ALCATEL-LUCENT SPEEDTOUCH 608 1

[. . . ] SpeedTouchTM608 Business DSL Routers CLI Reference Guide Release R5. 3. 1 SpeedTouchTM 608 CLI Reference Guide R5. 3. 1 Copyright Copyright ©1999-2005 THOMSON. Passing on, and copying of this document, use and communication of its contents is not permitted without written authorization from THOMSON. The content of this document is furnished for informational use only, may be subject to change without notice, and should not be construed as a commitment by THOMSON. THOMSON assumes no responsibility or liability for any errors or inaccuracies that may appear in this document. [. . . ] Represents the ICMP code range end (inclusive). srcport OPTIONAL srcportend OPTIONAL dstport OPTIONAL dstportend OPTIONAL icmptype OPTIONAL icmpcode icmpcodeend OPTIONAL OPTIONAL E-DOC-CTC-20050531-0060 v1. 0 305 Expr Commands 306 E-DOC-CTC-20050531-0060 v1. 0 Firewall Commands Firewall Commands Introduction This chapter describes the commands of the firewall command group. Contents This chapter covers the following commands: firewall config firewall clear firewall list firewall chain add firewall chain delete firewall chain flush firewall chain list firewall debug clear firewall debug stats firewall debug traceconfig firewall level add firewall level delete firewall level flush firewall level list firewall level modify firewall level set firewall rule add firewall rule delete firewall rule flush firewall rule list firewall rule modify firewall rule debug clear firewall rule debug stats firewall rule debug traceconfig Configure the firewall options. Set the security level or display the current security level. Show a list of the firewall rules in a chain. Display or modify the rule trace configuration. 308 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 327 328 329 331 332 334 335 E-DOC-CTC-20050531-0060 v1. 0 307 Firewall Commands firewall config Configure the firewall options. SYNTAX: firewall config [state = <{disabled | enabled}>] [keep = <{disabled | enabled}>] [tcpchecks = <{none | fast | exact}>] [udpchecks = <{disabled|enabled}>] [icmpchecks = <{disabled | enabled}>] [logdefault = <{disabled | enabled}>] [logthreshold = <{disabled | enabled}>] [tcpwindow = <number{0-1073725440}>] where: state keep Enable or disable the firewall. The firewall keeps active connections (enabled) or not (disabled) when the firewall rules change. Select the level of TCP sequence number checks. Choose between: none: no TCP checks are done. fast: check all the combinations of flag and disallow all the possible illegal combinations shown below: SYN PSH (SYN PSH URG, . . . ) SYN FIN (SYN FIN PSH, SYN FIN RST PSH, . . . ) FIN flag set without ACK All flags set No flags set. exact: check and permit only combinations of flag with the TCP state of a connection: SYN: request to open connection SYN ACK: agree to open connection A, PA, AU, PAU: acknowledgement of receipt FA, FAP, FAU, FAP, FAPU, FAU, FPAU: request to close connection R, RA, RP, RU, RPA, RPU, RAU, RPAU: tear down connection. Disable or enable logging of default firewall rule. This parameter permits to modify the TCP window for fast TCP checks. OPTIONAL OPTIONAL tcpchecks OPTIONAL udpchecks icmpchecks logdefault logthreshold tcpwindow OPTIONAL OPTIONAL OPTIONAL OPTIONAL OPTIONAL 308 E-DOC-CTC-20050531-0060 v1. 0 Firewall Commands EXAMPLE: =>firewall config :firewall config state=enabled keep=disabled tcpchecks=fast icmpchecks=enabled logdefault=disabled logthreshold=enabled tcpwindow=65536 => E-DOC-CTC-20050531-0060 v1. 0 309 Firewall Commands firewall clear Flush the firewall configuration. SYNTAX: firewall clear 310 E-DOC-CTC-20050531-0060 v1. 0 Firewall Commands firewall list List the firewall configuration. SYNTAX: firewall list where: format Select the output format in which the configuration must be shown. Choose between: pretty: the configuration is shown as intuitive output in clear text. cli: the configuration is shown via the CLI commands configuration. OPTIONAL [format = <{pretty | cli}>] EXAMPLE of output in text mode: =>firewall list Config ====== State Keep TcpChecks TcpWindow IcmpChecks LogDefault LogThreshold : : : : : : : enabled disabled fast 65536 enabled disabled enabled Modules ======= Module State Text Hooks -------------------------------------------------------------------------------------------------fire enabled Firewall Administration Module sink, forward, source host_service enabled Firewall Host Service Module forward level enabled Firewall Level Module forward system_service enabled Firewall System Service Module sink => EXAMPLE of output in CLI mode: =>firewall list format=cli :firewall config state=enabled keep=disabled tcpchecks=fast icmpchecks=enabled logdefault=disabled | logthreshold=enabled tcpwindow=65536 :firewall debug traceconfig tcpchecks=disabled icmpchecks=disabled sink=none forward=none | source=none => E-DOC-CTC-20050531-0060 v1. 0 311 Firewall Commands firewall chain add Add a chain. SYNTAX: firewall chain add where: chain The name of the chain to be added. REQUIRED chain = <string> EXAMPLE: =>firewall chain list Chains ====== Name Description ----------------------------------------------------------------sink system forward system source system sink_fire system forward_fire system source_fire system forward_host_service system forward_level system sink_system_service system forward_level_BlockAll system forward_level_Standard system forward_level_Disabled system =>firewall chain add chain=myCHAIN =>firewall chain list Chains ====== Name Description ----------------------------------------------------------------sink system forward system source system sink_fire system forward_fire system source_fire system forward_host_service system forward_level system sink_system_service system forward_level_BlockAll system forward_level_Standard system forward_level_Disabled system myCHAIN user => RELATED COMMANDS: firewall chain delete firewall chain list Delete a chain. List all chains. 312 E-DOC-CTC-20050531-0060 v1. 0 Firewall Commands firewall chain delete Delete a chain. SYNTAX: firewall chain delete where: chain The name of the chain to be deleted. REQUIRED chain = <string> EXAMPLE: =>firewall chain list Chains ====== Name Description ----------------------------------------------------------------sink system forward system source system sink_fire system forward_fire system source_fire system forward_host_service system forward_level system sink_system_service system forward_level_BlockAll system forward_level_Standard system forward_level_Disabled system myCHAIN user =>firewall chain delete chain=myCHAIN =>firewall chain list Chains ====== Name Description ----------------------------------------------------------------sink system forward system source system sink_fire system forward_fire system source_fire system forward_host_service system forward_level system sink_system_service system forward_level_BlockAll system forward_level_Standard system forward_level_Disabled system => RELATED COMMANDS: firewall chain add firewall chain list Add a chain. List all chains. E-DOC-CTC-20050531-0060 v1. 0 313 Firewall Commands firewall chain flush Flush all chains. SYNTAX: firewall chain flush 314 E-DOC-CTC-20050531-0060 v1. 0 Firewall Commands firewall chain list List all chains. SYNTAX: firewall chain list where: format Select the output format in which the chains must be shown. Choose between: pretty: the chains are shown as intuitive output in clear text. cli: the chains are shown via the CLI commands configuration. [. . . ] R: indicates the default remote administrator. RELATED COMMANDS: user delete user list Delete a user. Display the users. E-DOC-CTC-20050531-0060 v1. 0 729 User Commands user config Modify a user. You can only modify a user whose privileges are the same or lower than your own privileges. SYNTAX: user config name = <string> [password = <password>] [role = <string>] [descr = <quoted string>] [defuser = <{disabled | enabled}>] [defremadmin = <{disabled | enabled}>] where: name password The user name. REQUIRED OPTIONAL Note role The maximum length is 32 characters. [. . . ]