IPsec tunnels have a status of being either up or not up. With GRE tunnels in NetDefendOS this
does not really apply. The GRE tunnel is up if it exists in the configuration.
However, we can check on the what is going on with a GRE tunnel. For example, if the tunnel is
called gre_interface then we can use the ifstat CLI command:
gw-world:/> ifstat gre_interface
This will show us what is happening with the tunnel and the ifstat command options can provide
various details.
3.3.6. Interface Groups
Any set of NetDefendOS interfaces can be grouped together into an Interface Group. This then acts
as a single NetDefendOS configuration object which can be used in creating security policies in the
place of a single group. When a group is used, for example, as the source interface in an IP rule ,
any of the interfaces in the group could provide a match for the rule.
A group can consist of ordinary Ethernet interfaces or it could consist of other types such as VLAN
interfaces or VPN Tunnels. Also, the members of a group do not need to be of the same type. A
group might consist, for example, of a combination of two Ethernet interfaces and four VLAN
interfaces.
The Security/Transport Equivalent Option
When creating an interface group, the option Security/Transport Equivalent can be enabled (it is
disabled by default). Enabling the option means that the group can be used as the destination
interface in NetDefendOS rules where connections might need to be moved between two interfaces.
For example, the interface might change with route failover or OSPF.
If a connection is moved from one interface to another within a group and Security/Transport
Equivalent is enabled, NetDefendOS will not check the connection against the NetDefendOS rule
sets with the new interface.
With the option disabled, a connection cannot be moved to another interface in the group and is
instead dropped and must be reopened. This new connection is then checked against the
NetDefendOS rule sets. In some cases, such as an alternative interface that is much slower, it may
not be sensible to allow certain connections over the new interface.
Example 3.12. Creating an Interface Group
Command-Line Interface
gw-world:/> add Interface InterfaceGroup examplegroup
Members=exampleif1,exampleif2
Web Interface
1.
Go to Interfaces > Interface Groups > Add > InterfaceGroup
2.
Enter the following information to define the group:
•
Name: The name of the group to be used later
•
Security/Transport Equivalent: If enabled, the interface group can be used as a destination interface in
rules where connections might need to be moved between the interfaces.
•
Interfaces: Select the interfaces to be in the group
3.
Click OK
3.3.6. Interface Groups
Chapter 3. Fundamentals
111
Summary of Contents for NetDefend DFL-260E
Page 27: ...1 3 NetDefendOS State Engine Packet Flow Chapter 1 NetDefendOS Overview 27...
Page 79: ...2 7 3 Restore to Factory Defaults Chapter 2 Management and Maintenance 79...
Page 146: ...3 9 DNS Chapter 3 Fundamentals 146...
Page 227: ...4 7 5 Advanced Settings for Transparent Mode Chapter 4 Routing 227...
Page 241: ...5 4 IP Pools Chapter 5 DHCP Services 241...
Page 339: ...6 7 Blacklisting Hosts and Networks Chapter 6 Security Mechanisms 339...
Page 360: ...7 4 7 SAT and FwdFast Rules Chapter 7 Address Translation 360...
Page 382: ...8 3 Customizing HTML Pages Chapter 8 User Authentication 382...
Page 386: ...The TLS ALG 9 1 5 The TLS Alternative for VPN Chapter 9 VPN 386...
Page 439: ...Figure 9 3 PPTP Client Usage 9 5 4 PPTP L2TP Clients Chapter 9 VPN 439...
Page 450: ...9 7 6 Specific Symptoms Chapter 9 VPN 450...
Page 488: ...10 4 6 Setting Up SLB_SAT Rules Chapter 10 Traffic Management 488...
Page 503: ...11 6 HA Advanced Settings Chapter 11 High Availability 503...
Page 510: ...12 3 5 Limitations Chapter 12 ZoneDefense 510...
Page 533: ...13 9 Miscellaneous Settings Chapter 13 Advanced Settings 533...
