Configuration Objects
220
target-interface
List of NMTOKEN -
Target interface(s)
target-ip
List
of
IPNameRange
-
Target IP address range(s)
target-port
List of PortRange
-
Target port(s)
Table K.95. rule-set: Elements
Element
Type
Instances
Description
ip-group
ip-group
Optional, unlimited
Named IP groups
rule
session-rule
Optional, unlimited
Individual rules, first match applies
K.2.69. session-rule: Firewall rules
Firewall rule
The individual firewall rules are checked in order within the rule-set, and the first match applied. The default
action for a rule is continue, so once matched the next rule-set is considered.
Table K.96. session-rule: Attributes
Attribute
Type
Default
Description
action
firewall-action
continue
Action taken on match
comment
string
-
Comment
cug
List of PortRange
-
Closed user group ID(s)
hash
boolean
-
Use hash of IPs for load sharing
interface
List of NMTOKEN -
Source or target interface(s)
ip
List
of
IPNameRange
-
Source or target IP address range(s)
log
NMTOKEN
As rule-set
Log session start
log-end
NMTOKEN
As rule-set
Log session end
name
string
-
Name
profile
NMTOKEN
-
Profile name
protocol
List of unsignedByte -
Protocol(s) [1=ICMP, 6=TCP, 17=UDP]
set-gateway
IPAddr
-
New gateway
set-graph
string
-
Graph name for shaping/logging
set-graph-dynamic
dynamic-graph
-
Dynamically create graph
set-initial-timeout
duration
-
Initial time-out
set-nat
boolean
-
Changed source IP and port to local for
NAT
set-ongoing-timeout duration
-
Ongoing time-out
set-reverse-graph
string
-
Graph name for shaping/logging (far side
of session)
set-source-ip
IPAddr
-
New source IP
set-source-port
unsignedShort
-
New source port
set-table
(unsignedByte 0-99)
routetable
-
Set new routing table