D-Link DFL-860 Product Manual - Page 107
Interface Groups, ifstat gre_interface
UPC - 790069900204
View all D-Link DFL-860 manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 107 highlights
3.3.6. Interface Groups Chapter 3. Fundamentals IPsec tunnels have a status of being either up or not up. With GRE tunnels in NetDefendOS this doesn't really apply. The GRE tunnel is up if it exists in the configuration. However, we can check on the what is going on with a GRE tunnel. For example, if the tunnel is called gre_interface then we can use the ifstat CLI command: gw-world:/> ifstat gre_interface This will show us what is happening with the tunnel and the ifstat command options can provide various details. 3.3.6. Interface Groups Any set of NetDefendOS interfaces can be grouped together into an Interface Group. This then acts as a single NetDefendOS configuration object which can be used in creating security policies in the place of a single group. When a group is used, for example, as the source interface in an IP rule , any of the interfaces in the group could provide a match for the rule. A group can consist of ordinary Ethernet interfaces or it could consist of other types such as VLAN interfaces or VPN Tunnels. Also, the members of a group do not need to be of the same type. A group might consist, for example, of a combination of two Ethernet interfaces and four VLAN interfaces. The Security/Transport Equivalent Option When creating an interface group, the option Security/Transport Equivalent can be enabled (it is disabled by default). Enabling the option means that the group can be used as the destination interface in NetDefendOS rules where connections might need to be moved between two interfaces. For example, the interface might change with route failover or OSPF. If a connection is moved from one interface to another within a group and Security/Transport Equivalent is enabled, NetDefendOS will not check the connection against the NetDefendOS rule sets with the new interface. With the option disabled, a connection cannot be moved to another interface in the group and is instead dropped and must be reopened. This new connection is then checked against the NetDefendOS rule sets. In some cases, such as an alternative interface that is much slower, it may not be sensible to allow certain connections over the new interface. Example 3.12. Creating an Interface Group Command-Line Interface gw-world:/> add Interface InterfaceGroup examplegroup Members=exampleif1,exampleif2 Web Interface 1. Go to Interfaces > Interface Groups > Add > InterfaceGroup 2. Enter the following information to define the group: • Name: The name of the group to be used later • Security/Transport Equivalent: If enabled, the interface group can be used as a destination interface in rules where connections might need to be moved between the interfaces. • Interfaces: Select the interfaces to be in the group 3. Click OK 107