D-Link NetDefend DFL-260E, Руководство пользователя

Страница: 111 / 552

IPsec tunnels have a status of being either up or not up. With GRE tunnels in NetDefendOS this
does not really apply. The GRE tunnel is up if it exists in the configuration.
However, we can check on the what is going on with a GRE tunnel. For example, if the tunnel is
called gre_interface then we can use the ifstat CLI command:
gw-world:/> ifstat gre_interface
This will show us what is happening with the tunnel and the ifstat command options can provide
various details.
3.3.6. Interface Groups
Any set of NetDefendOS interfaces can be grouped together into an Interface Group. This then acts
as a single NetDefendOS configuration object which can be used in creating security policies in the
place of a single group. When a group is used, for example, as the source interface in an IP rule ,
any of the interfaces in the group could provide a match for the rule.
A group can consist of ordinary Ethernet interfaces or it could consist of other types such as VLAN
interfaces or VPN Tunnels. Also, the members of a group do not need to be of the same type. A
group might consist, for example, of a combination of two Ethernet interfaces and four VLAN
interfaces.
The Security/Transport Equivalent Option
When creating an interface group, the option Security/Transport Equivalent can be enabled (it is
disabled by default). Enabling the option means that the group can be used as the destination
interface in NetDefendOS rules where connections might need to be moved between two interfaces.
For example, the interface might change with route failover or OSPF.
If a connection is moved from one interface to another within a group and Security/Transport
Equivalent is enabled, NetDefendOS will not check the connection against the NetDefendOS rule
sets with the new interface.
With the option disabled, a connection cannot be moved to another interface in the group and is
instead dropped and must be reopened. This new connection is then checked against the
NetDefendOS rule sets. In some cases, such as an alternative interface that is much slower, it may
not be sensible to allow certain connections over the new interface.
Example 3.12. Creating an Interface Group
Command-Line Interface
gw-world:/> add Interface InterfaceGroup examplegroup
Members=exampleif1,exampleif2
Web Interface
1. Go to Interfaces > Interface Groups > Add > InterfaceGroup
2. Enter the following information to define the group:
• Name: The name of the group to be used later
• Security/Transport Equivalent: If enabled, the interface group can be used as a destination interface in
rules where connections might need to be moved between the interfaces.
• Interfaces: Select the interfaces to be in the group
3. Click OK
3.3.6. Interface Groups Chapter 3. Fundamentals
111