FireBrick FB6402, Руководство пользователя

Страница: 26 / 196

9
Chapter 3. Configuration
3.1. The Object Hierarchy
The FB6000 has, at its core, a configuration based on a hierarchy of objects, with each object having one or
more attributes. An object has a type, which determines its role in the operation of the FB6000. The values
of the attributes determine how that object affects operation. Attributes also have a type (or datatype), which
defines the type of data that attribute specifies. This in turn defines what the valid syntax is for a value of that
datatype - for example some are numeric, some are free-form strings, others are strings with a specific format,
such as a dotted-quad IP address. Some examples of attribute values are :-
• IP addresses, and subnet definitions in CIDR format e.g. 192.168.10.0/24
• free-form descriptive text strings, e.g. a name for a firewall rule
• Layer 4 protocol port numbers e.g. TCP ports
• data rates used to control traffic shaping
• enumerated values used to control a feature e.g. defining Ethernet port LED functions
The object hierarchy can be likened to a family-tree, with relationships between objects referred to using terms
such as Parent, Child, Sibling, Ancestor and Descendant. This tree-like structure is used to :-
• group a set of related objects, such as a set of firewall rules - the parent object acts as a container for a group
of (child) objects, and may also contribute to defining the detailed behaviour of the group
• define a context for an object - for example, an object used to define a locally-attached subnet is a child of
an object that defines an interface, and as such defines that the subnet is accessible on that specific interface.
Since multiple interfaces can exist, other interface objects establish different contexts for subnet objects.
Additional inter-object associations are established via attribute values that reference other objects, typically
by name, e.g. a firewall rule can specify one of several destinations for log information to be sent when the
rule is processed.
3.2. The Object Model
The term 'object model' is used here to collectively refer to :-
• the constraints that define a valid object hiearchy - i.e. which object(s) are valid child objects for a given
parent object, how many siblings of the same type can exist etc.
• for each object type, the allowable set of attributes, whether the attributes are mandatory or optional, their
datatypes, and permissible values of those attributes
The bulk of this User Manual therefore serves to document the object model and how it controls operation of
the FB6000.
Tip
This version of the User Manual may not yet be complete in its coverage of the full object model.
Some more obscure attributes may not be covered at all - some of these may be attributes that are
not used under any normal circumstances, and used only under guidance by support personnel. If you
encounter attribute(s) that are not documented in this manual, please refer in the first instance to the
documentation described in Section 3.2.1 below. If that information doesn't help you, and you think
the attribute(s) may be relevant to implementing your requirements, please consult the usual support
channel(s) for advice.