Network Configuration

enabled

Enable/disable a network interface:

• on

• off

iface-type

Interface type:

• l3: interface works in Layer 3 mode (you can assign an IP address and use it in firewall, content filtering, and other rules; this is the standard interface operation mode).

• mirror: interface works in Mirror mode (it can receive traffic from the network equipment SPAN port to analyze it).

netflow-profile

The Netflow profile to send statistical data to the Netflow collector. For more details on Netflow profile settings, see Configuring Netflow Profiles.

mac

Interface MAC address.

dhcp-relay

Settings for the DHCP relay on the interface. You need to specify the following:

• enabled: enable/disable the relay:

  • on

  • off

• utm-address: IP address of the UserGate interface on which the relay function is added (possible values: <ip | none>).

• server-address: addresses of DHCP servers where DHCP requests from clients should be redirected.

ip-addresses

Specified IP address.

enabled

Enable/disable a VLAN interface:

• on

• off

iface-type

Interface type:

• l3: Layer 3 (you can assign an IP address and use it in firewall, content filtering, and other rules; this is the standard interface operation mode).

• mirror: interface works in Mirror mode (it can receive traffic from the network equipment SPAN port to analyze it).

node-name

Cluster node name where the VLAN is created.

zone

Zone to which the interface belongs.

mac

Interface MAC address.

dhcp-relay

Settings for the DHCP relay on the interface. You need to specify the following:

• enabled: enable/disable the relay:

  • on

  • off

• utm-address: IP address of the UserGate interface on which the relay function is added.

• server-address: addresses of DHCP servers where DHCP requests from clients should be redirected.

ip-addresses

Specified IP address.

enabled

Enable/disable the interface:

• on

• off

node-name

Cluster node where the bond interface is created.

netflow-profile

The Netflow profile to send statistical data to the Netflow collector. For more details on Netflow profile settings, see Configuring Netflow Profiles.

bonding

Additional bond interface parameters:

• aggr-mode: bond operation mode. The available options:

  • round-robin: Round robin mode (packets are sent sequentially starting with the first available interface and ending with the last one. This policy is used to provide load balancing and high availability.)

  • active-backup: Active backup mode (only one network interface in the bond will be active. Another slave interface can become active only if the currently active interface fails. With this policy, the MAC address of the bond interface is only visible externally through one network port to avoid problems with the switch. This policy is used to provide high availability).

  • xor: XOR mode (the transmission is allocated among the NICs using the following formula: [( XOR ) MOD ]. This means that the same NIC sends packets to the same recipients. Optionally, the transmission allocation can also be based on the xmit_hash policy. The XOR policy is used for load balancing and high availability).

  • broadcast: Broadcast mode (broadcasts everything to all network interfaces. This policy is used for high availability).

  • 802.3ad: IEEE 802.3ad mode (the default mode supported by most network switches. Creates aggregated groups of NICs with identical speed and duplex settings. When combined like this, all links in the active aggregation participate in transmission as per IEEE 802.3ad. The choice of interface for packet transmission is determined by the policy. By default, the XOR policy is used, with the xmit_hash policy as a possible alternative).

  • transmit: Adaptive transmit load balancing mode (outgoing traffic is distributed depending on the loading of each NIC (determined by the load speed). No additional configuration on the switch is required. The incoming traffic is received by the current network card. If this card fails, another card assumes the MAC address of the failed one).

  • load: Adaptive load balancing mode. Includes the previous policy plus incoming traffic balancing. No additional configuration on the switch is required. The incoming traffic is balanced through ARP negotiation. The driver intercepts ARP responses sent from the local NICs to the outside and overwrites the source MAC address with one of the unique MAC addresses of the NIC in the bond. Thus, different peers use different server MAC addresses. The incoming traffic is balanced sequentially (round-robin) among the interfaces.

• mii-monitoring: MII monitoring period in milliseconds. Determines how often the link state will be checked for failures.

• down-delay: delay time (in milliseconds) before an interface is disabled if a connection failure occurs. This option is only valid for MII monitoring (miimon). The parameter value must be a multiple of miimon,

• up-delay: delay time in milliseconds before deploying the channel if it is detected to be restored. This parameter is only valid with MII monitoring (miimon). The parameter value must be a multiple of miimon,

• lacp-rate: interval with which the partner transmits LACPDU packets in 802.3ad mode. Enumerated options:

  • slow: requests that the partner send LACPDU packets every 30 seconds.

  • fast: requests that the partner send LACPDU packets every second.

• failover-mac: define the assignment type of MAC addresses to bond interfaces in Active backup mode when switching interfaces. Enumerated options:

  • disabled: the same MAC address is set on all interfaces during switching.

  • active: the MAC address on the bond interface will always be identical to that on the currently active slave. The MAC addresses on the backup interfaces are not changed. The MAC address on the bond interface changes during the failover processing.

  • follow: the MAC address on the bond interface will be the same as that on the first slave added to the bond. This MAC is not set on the second and subsequent interfaces while they are in backup mode. That MAC address gets assigned during a failover: when a backup slave interface becomes active, it assumes a new MAC (the one on the bond interface), and the formerly active slave is assigned the MAC that the currently active one used to have.

• xmit-hash: define a hash policy for sending packets over bond interfaces in XOR or IEEE 802.3ad mode. Enumerated options:

  • l2: use only MAC addresses to generate the hash. With this algorithm, the traffic for a particular network host is always sent over the same interface. This algorithm is compatible with IEEE 802.3ad.

  • l2-3: use both MAC and IP addresses to generate the hash. This algorithm is compatible with IEEE 802.3ad.

  • l3-4: uses IP addresses and transport layer protocols (TCP or UDP) to generate the hash. This algorithm is not universally compatible with IEEE 802.3ad, as both fragmented and non-fragmented packets can be transmitted within a single TCP or UDP interaction. Fragmented packets lack the source and destination ports. As a result, packets from the same session can reach the recipient in an order other than the intended one because they are sent via different slaves.

• interface: interfaces to be bonded.

ip-addresses

Assign an IP address to the interface.

The IP addresses are specified as [ <ip_address/mask> ] or [ <ip_address/mask> <ip_address/mask> ]. In case of several IP addresses (with space used as the separator), the subnet mask is entered in the decimal format.

Important! Make sure to separate the square brackets with spaces on both sides.

mtu

Specify the MTU size.

ip-addresses

Specified IP address.

bonding interface

Bonded interfaces.

enabled

Enable/disable a bridge:

• on

• off

description

Bridge interface description.

zone

Zone to which the bridge belongs.

bridging

Additional bridge parameters:

• iface-type: interface mode:

  • l2: Layer 2 (you do not need to assign an IP address or specify routes and gateways for the bridge to work correctly. In this mode, the bridge works at the MAC address level by forwarding packets from one network segment to another. Mail security rules cannot be used in this case; content filtering is available in this mode).

  • l3: Layer 3 (you can assign an IP address and use it in firewall, content filtering, and other rules; this is the standard interface operation mode).

• interface: interfaces to use to create the bridge.

• stp: enable/disable STP (Spanning Tree Protocol) for protection against network loops:

  • on.

  • off

• forward-delay: delay before the bridge switches to the active mode (Forwarding) if the STP is enabled (in seconds).

• max-age: time after which the STP connection is considered lost (in seconds).

• bypass-pair: interface pair to use to build the bypass bridge. UserGate HSC support is required.

ip-addresses

Assign an IP address to the interface.

The IP addresses are specified as [ <ip_address/mask> ] or [ <ip_address/mask> <ip_address/mask> ]. In case of several IP addresses (with space used as the separator), the subnet mask is entered in the decimal format.

Important! Make sure to separate the square brackets with spaces on both sides.

mtu

Specify the MTU size.

ip-addresses

Specified IP address.

enabled

Enable/disable a PPPoE interface:

• on

• off

description

PPPoE interface description.

zone

Zone to which the interface belongs.

config

Additional PPPoE interface parameters:

• interface: interface where the PPPoE interface is created.

• login: login name for PPPoE connection.

• password: password for PPPoE connection.

• persist-connection: automatic reconnection in case of connection failure:

  • on

  • off

• auth-type: authorization type:

  • CHAP.

  • PAP.

• holdoff: time period (in seconds) to restart the connection after it was broken.

• default-route: use the PPPoE interface as the default route:

  • on

  • off

• echo-intervall: interval to check the connection.

• echo-failure: number of LCP echo failures after which UserGate assumes there is no connection and drops it.

• providers-dns: use DNS servers provided by the ISP:

  • on

  • off

• connection-attempts: number of unsuccessful connection attempts, after which auto-connection attempts will stop.

• service-name: specify the service name if provided by the ISP.

enabled

Enable/disable a VPN interface:

• on

• off

description

VPN interface description.

netflow-profile

The Netflow profile to send statistical data to the Netflow collector. For more details on Netflow profile settings, see Configuring Netflow Profiles.

ip-addresses

Assign an IP address to the interface.

The IP addresses are specified as [ <ip_address/mask> ] or [ <ip_address/mask> <ip_address/mask> ]. In case of several IP addresses (with space used as the separator), the subnet mask is entered in the decimal format.

Important! Make sure to separate the square brackets with spaces on both sides.

enabled

Enable/disable the tunnel:

• on

• off

description

Tunnel description.

zone

Zone to which the interface belongs.

enabled

Enable/disable the interface:

• on

• off

netflow-profile

The Netflow profile to send statistical data to the Netflow collector. For more details on Netflow profile settings, see Configuring Netflow Profiles.

mac

Interface MAC address.

dhcp-relay

Settings for the DHCP relay on the interface. You need to specify the following:

• enabled: enable/disable the relay:

  • on

  • off

• utm-address: IP address of the UserGate interface on which the relay function is added (possible values: <ip | none>).

• server-address: addresses of DHCP servers where DHCP requests from clients should be redirected.

ip-addresses

Specified IP address.

filtering

DNS request filtering:

• on

• off

limit

Limit the number of DNS queries per second for each user (default value: 100).

recursive

Perform recursive DNS queries:

• on

• off

a-aaaa-unknown

Respond only to requests for A and AAAA records from unknown users. This effectively blocks attempts to establish a VPN over the DNS protocol:

• on

• off

factory-defaults

Reset the values of the selected parameter (parameters shown in this table) or all parameters (all) to factory defaults.

PASS

OK

Action to create a rule using UPL.

name

The name of the rule.

Example: name("DNS rule example").

url.domain

List of domains to which you want to redirect. You can use an asterisk (*) to specify a domain template.

To specify a list of domains: url.domain = "*.example.com".

enabled

Enable/disable static record usage:

• on

• off

description

DNS record description.

dns-a-records

List of IP addresses the UserGate server will return when this FQDN is queried.

enabled

Enable/disable usage of a static route:

• on

• off

description

Route description.

destination-ip

IP address of the destination subnet, format: <ip/mask>.

interface

Interface through which the route is added.

enabled

Enable/disable an OSPF router:

• on

• off

metric

Redistributed route metric.

interfaces

Select one of the existing interfaces on which OSPF will run. Only the interfaces belonging to this virtual router are available for selection.

To add an interface or change parameters for an existing interface, use the following commands:

Admin@nodename# set network virtual-router <virtual-router-name> ospf interfaces new Admin@nodename# set network virtual-router <virtual-router-name> ospf interfaces <interface-name>

Next, specify the following parameters:

• enabled <on | off>: enable/disable the interface.

• interface: name of the interface in this virtual router.

• description: interface description.

• bfd: Add a bfd profile (Bidirectional Forwarding Detection). Bfd profiles are created in the element library, read more in the Configuring Libraries section.

• cost: interface link cost. This value is reported in the LSA (link-state advertisement) to the neighboring routers which use it to compute the shortest path. Default value: 1.

• priority: an integer from 0 to 255. The higher the value, the higher the probability that this router will become the network's designated router for sending out LSAs. A value of 0 excludes the router from being designated. Default value: 1.

• network-type: select a network type to optimize the adjacency establishment process. Available values:

  • none: not specified

  • bc: broadcast

  • ptm: point to multipoint

  • ptp: point to point

• passive-mode <on | off>: enable/disable the passive operating mode of the interface, in which routing protocol update packets are prohibited from being sent through the interface.

• hello-interval: time between sending hello packets (in seconds). This should be the same for all routers in an autonomous system. The default value is 10 seconds.

• dead-interval: time after which the router is considered offline (in seconds). The time is counted from the moment of receiving the last hello packet from the neighboring router. The default value is 40 seconds.

• retransmit-interval: time before the LSA packet is retransmitted (in seconds). The default value is 5 seconds.

• transmit-delay: approximate time required to deliver link state updates to neighbor routers (in seconds). The default value is 1 second.

• authentication: authentication type. Available values:

  • enabled <on | off>: enable/disable mandatory authentication for each OSPF message received by the router. Authentication is normally used to prevent the injection of a fake route from illegitimate routers.

  • auth-type: select the authentication type as plain (transmit the key as plain text to authenticate routers) or digest (use an MD5 hash of the key to authenticate OSPF packets).

  • md5: the key ID.

  • key: the key. A key can only contain Latin letters, numbers, and the underscore. Maximum length: 16 characters.

enabled

Enable/disable an OSPF router:

• on

• off

asn

An autonomous system is a system of IP networks and routers managed by one or more operators that have a single routing policy. The autonomous system number identifies the router as belonging to that system.

redistribute

BGP route redistribution:

• connected: redistribute routes to the networks directly connected to UserGate

• kernel: redistribute routes added by the administrator.

• ospf: redistribute routes received via the OSPF protocol.

routemaps

Routemaps are used to manage routing tables and specify the match conditions under which routes are passed between domains.

To create a routemap or change parameters for an existing routemap, use the following commands:

Admin@nodename# set network virtual-router <virtual-router-name> bgp routemaps new Admin@nodename# set network virtual-router <virtual-router-name> bgp routemaps <routemap-name>

Routemap parameters:

• name: routemap name.

• description: routemap description.

• action: action:

  • allow: allow data that matches the routemap conditions to pass through

  • block: deny data that matches the routemap conditions to pass through.

• match-by: match condition to apply a routemap. Match by:

  • ip: IP address.

  • aspath: AS path.

  • community: Community.

• next-hop: set next hop value for filtered routes to the specified IP address.

• weight: set the weight for filtered routes to the specified value.

• metric: set the metric for filtered routes to the specified value.

• preference: set the preference for filtered routes to the specified value.

• as-prepend: set the AS-prepend value, which is a list of autonomous systems being added for this route.

• community: set the BGP community value for filtered routes.

• append-community: append community.

• ip-match: add all required IP addresses when selecting IP address matching.

• as-path-match: add all required autonomous network numbers when selecting AS path matching. POSIX 1003.2 regular expressions are allowed, supplemented by the underscore (_) character that is interpreted as:

  • A space

  • A comma

  • Start of line

  • End of line

  • AS set delimiter { and }

  • AS confederation delimiter ( and ).

  • community-match: add the strings of all desired BGP communities when matching by Community is selected.

neighbors

BGP neighbors.

To add new neighbors or change data for existing ones, use the following commands:

Admin@nodename# set network virtual-router <virtual-router-name> bgp neighbors new Admin@nodename# set network virtual-router <virtual-router-name> bgp neighbors <host-ip>

Parameters:

• enabled: enable/disable use of the neighbor:

  • on

  • off

• description: BGP neighbor description.

• host: neighbor IP address.

• remote-asn: neighbor's autonomous system number.

• weight: weight of routes received from this neighbor.

• ttl: maximum allowed hop number to this neighbor.

• allowas-in: allows receiving and processing routes even if the router detects its own autonomous system number on the AS Path in the aggregation route.

  • on

  • off

• allowas-in-number: how many times the autonomous BGP neighbor's system number can be included in the AS Path. Available values: from 0 to 10 (0 is the origin).

• bfd: Add a bfd profile (Bidirectional Forwarding Detection). Bfd profiles are created in the element library, read more in the Configuring Libraries section.

• next-hop-self: if the neighbor is a BGP, replace the next-hop-self value with its own IP address:

  • on

  • off

• ebgp-multihop: the connection to this BGP neighbor is not direct (more than one hop):

  • on

  • off

• route-reflector-client: determine if a BGP neighbor is a Route reflector client:

  • on

  • off

• soft-reconfiguration: use soft reconfiguration (without disconnecting) to update the configuration:

  • on

  • off

• default-originate: announce the default route to a neighbor:

  • on

  • off

• send-community: redirect the community to BGP neighbors.

  • on

  • off

• enable-auth: enable/disable authentication for the neighbor.

  • on

  • off

• password: the neighbor authentication password.

• filter-in: restrict routing information received from neighbors.

• filter-out: restrict routing information announced to neighbors.

• routemap-in: restrict routing information that BGP receives from neighbors.

• routemap-out: restrict routing information that BGP sends to neighbors.

enabled

Enable/disable an RIP router:

• on

• off

metric

RIP metric. Default value: 1; max value: 15. A value of 16 is considered infinite.

originate

Sends itself as the router by default.

networks-interface

Specify the network interface from which to send route information updates. Provide interfaces that belong to the virtual router.

interfaces

Configure interfaces where the RIP protocol is supported. The interfaces should be added to the virtual router.

To add new interfaces or change data for existing ones, use the following commands:

Admin@UGOS# set network virtual-router <virtual-router-name> rip interfaces new Admin@UGOS# set network virtual-router <virtual-router-name> rip interfaces <interface-name>

Parameters:

• interface: select the interface.

• send-version: the RIP protocol version that the router will send. Available values:

  • 0

  • 1

  • 2

  • 3

• receive-version: the RIP protocol version that the router will receive. Available values:

  • 0

  • 1

  • 2

  • 3

• password: the authorization string that will be sent and received in RIP packets. All routes participating in RIP information exchange must have an identical password.

• split-horizone: a routing loop avoidance method where the router does not redistribute network information through the interface on which the update arrived.

  • on

  • off

• poisoned-reverse: a routing loop avoidance method where the router sets the route cost to 16 and sends it to the neighbor from which it was received.

  • on

  • off

• passive-mode: an interface mode in which the interface receives RIP updates but does not send them.

  • on

  • off

enabled

Enable/disable an RIP router:

• on

• off

ecmp-rebalance

Use ECMP rebalance:

• on: if one of the interfaces through which traffic was sent has disconnected, then all existing flows are redistributed among the remaining routes (next hop).

• off: if one of the interfaces through which traffic was sent has disconnected, only the flows sent through the disconnected interface will be redistributed.

register-suppress

Interval after which the router sends a register suppress message.

interfaces

Interface to use for multicasting. You can only specify interfaces added to the virtual router.

To add new interfaces or change data for existing ones, use the following commands:

Admin@nodename# set network virtual-router <virtual-router-name> multicast-router interfaces new Admin@nodename# set network virtual-router <virtual-router-name> multicast-router interfaces <interface-name>

Parameters:

• interface: select an interface for multicast. Only the interfaces belonging to this virtual router are available for selection.

• hello-timeout: the interval to send PIM HELLO messages (in seconds). PIM Hello messages are sent periodically from all interfaces for which multicast support is enabled. These messages let the router know about neighbor routers that support multicasting.

• dr-priority: the Designated router (DR) selection priority, which allows the administrator to control the process of DR selection for the LAN.

• bfd: Add a bfd profile (Bidirectional Forwarding Detection). Bfd profiles are created in the element library, read more in the Configuring Libraries section.

• enable-igmp: receive IGMP report and IGMP query messages on this interface.

• use-igmpv2: use IGMP v2 (the default is IGMP v3).

ssm-allowed-groups

A multicast router setting that defines a list of allowed group addresses for source-specific multicast. You can specify any networks in the range 232.0.0.0/8. If nothing is specified, there are no restrictions.