Firewall configuration
Digi TransPort User Guide
672
Using [inspect-state] with the Out Of Service option
The
inspect-state
field can be used with an optional
oos
parameter. This parameter allows the
stateful inspect engine to mark as
out of service
any routes that are associated with the
specified interface and also to control how and the interfaces are returned to service. Such
routes will only be marked as
out of service
if the specified
oos
option parameters are met. The
oos
parameter takes the format:
oos {interface-name¦logical-name} secs {t=secs} {c=count} {d=count}
{r=“ping”|“tcp”{,secs}}
where:
interface-name or logical-name
The interface with which the firewall rule is associated, such as
PPP 1
. This can also be a logical
interface name which is simply a name that can be created (such as
waffle
). When a logical
interface name is specified then this name can become
oos
(
out of service
) and can be tested
in other firewall rules with the
oosed
keyword.
secs
The length of time, in seconds, for which the routes that are using the specified interface are
marked as out of service.
{t=secs}
An optional parameter that specifies the length of time in seconds the router will wait for a
response the packet that matched the rule.
{c=count}
An optional parameter that specifies the number of times that the stateful inspection engine
must trigger on the rule before the route is marked as out of service.
{d=count}
An optional parameter that specifies the number of times that the stateful inspection engine
must trigger on the rule before the interface is deactivated. This parameters applies to PPP
interfaces only.
{r=“ping”|“tcp”{,secs{,secs}}}
An optional parameter that specifies a recovery procedure. When a recovery procedure is
specified then after the oos timeout has expired instead of bringing the interface back into
service immediately the link is tested first. It is tested by either sending a TCP
SYN
packet or a
ping packet to the address/port that caused the oos condition. The
secs
field specifies the
retry time when checking for recovery. Only when the recovery succeeds will the interface
become in service again.
