Firewall configuration
Digi TransPort User Guide
679
Keeping a route out of service and using recovery
You may want to keep the interface OOS until you are sure that a future connection will work. To
help achieve this, you can specify one or more recovery options. These options get the router to
test connectivity between the router and the destination IP address of the packet that
established the stateful rule. The recovery can be in the form of a
ping
or a TCP socket
connection. An interval between recovery checks must also be specified. For example:
pass out break end on PPP 2 proto TCP from 10.1.1.1 to 10.1.2.1 port=telnet flags S!A
inspect-state oos 60 t=10 c=5 d=10 r=tcp,120
Now the interface will be set to OOS for
60
seconds after
5
consecutive failures. After the
60
seconds elapses, the recovery procedure is initiated. In this example, the recovery consists of TCP
connection attempts executed at
2-minute
intervals. The interface remains OOS until the
recovery procedure completes successfully. The destination IP address in this case is
10.1.2.1
.
To override the default socket connection time, you can specify an additional recovery option. For
example:
pass out break end on PPP 2 proto TCP from 10.1.1.1 to 10.1.2.1 port=telnet flags S!A
inspect-state oos 60 t=10 c=5 d=10 r=tcp,120,10
Now,
10 seconds
is allowed for each recovery attempt. If the socket connects within that time,
the recovery is successful, else the recovery is unsuccessful.
There is also an option
{rd=x}
to disconnect the interface after a recovery attempt completes.
You can use this option to deactivate the interface after a recovery failure, success, or either.
x
is
a bitmask indicating the cases where the interface should be deactivated. Bit
0
is used to
deactivate the interface after a recovery failure. Bit
1
is used to deactivate the interface after a
recovery success, such as:
•
rd=1
means deactivate after a recovery failure.
•
rd=2
means deactivate after a recovery success.
•
rd=3
means deactivate after either recovery success or recovery failure.
Extending our firewall rule to include this option gives:
pass out break end on PPP 2 proto TCP from 10.1.1.1 to 10.1.2.1 port=telnet flags S!A
inspect-state oos 60 t=10 c=5 d=10 r=tcp,120,10 rd=3
Now the interface will be deactivated after a recovery success or failure.
If the
{rd=x}
option is not used, the interface remains up until its inactivity timer expires, or it is
deactivated by some other means.
The
{dt=secs}
option can be used to indicate that the interface is to remain OOS when it is
disconnected, and that it should be reactivated some time after it last disconnected. Recovery
procedures start after the interface connects.
Extending our firewall rule to include this option gives:
pass out break end on PPP 2 proto TCP from 10.1.1.1 to 10.1.2.1 port=telnet flags S!A
inspect-state oos 60 t=10 c=5 d=10 r=tcp,120,10 rd=3 dt=60
Now, the interface is reconnected
60
seconds after it disconnects and recovery procedures start
after the interface connects. This option would normally be used with the
{rd=x}
option so that
recovery has control over when the interface connects and disconnects.
Содержание TransPort
Страница 1: ...User Guide Digi TransPort ...
Страница 95: ...Regulatory and safety statements Digi TransPort User Guide 95 TransPort WR41Declaration of Conformity ...
Страница 96: ...Regulatory and safety statements Digi TransPort User Guide 96 ...
Страница 97: ...Regulatory and safety statements Digi TransPort User Guide 97 TransPort WR44 Declaration of Conformity ...
Страница 773: ...Manage files Digi TransPort User Guide 773 For example ...
