network

The network command branch manages the whole of the network layer of a virtual device: the physical and logical interfaces, the IP addresses, the routing tables, the static routes, the firewall rules and the cluster IP services. In short, which traffic the device will carry from where and with which rule is defined here.

Command Map

Command	What it manages	Panel equivalent
network interface	The network interfaces: eth, VLAN, VXLAN, macvtap, veth, bond, LACP, bridge	The interface screen
network ip	The addresses defined on the interfaces; the interface address or the cluster address	The address screen
network namespace	The routing tables, DNS, the dynamic routing services and the network layer protections	The routing table screen
network route	The static routes: the target network and the gateway	The route screen
network fw-rule	The firewall rules: allow, block, SNAT and DNAT	The firewall screen
network cluster-ip-service	The state of the cluster IP services and their restarting	The cluster state screen

Every Command Starts with the Virtual Device

The network settings always belong to a certain virtual device. For this reason all the commands of the branch ask for the v-device field right after the action. This is not an option but a required field.

TR7 WEB-CLI · v-device in every command

admin@TR7LBWAF01> network ip list v-device Host

admin@TR7LBWAF01> network route show v-device Host <id>

admin@TR7LBWAF01> network interface add v-device Host type vlan name vlan100 …

admin@TR7LBWAF01> network fw-rule delete v-device Host <id>

admin@TR7LBWAF01>  

The v-device value is Host for the local device or the name of a defined virtual device; Tab lists the ones that can be used.

The Same Five Commands on Every Resource

Action	What it does	How the identifier is written
list	It lists the records	—
show <id>	It shows the detail of a single record	The identifier directly, without the field name being written
add <fields>	It creates a new record	—
update id <id> [fields]	It updates an existing record	With the id field
delete <id>	It deletes the record	The identifier directly

There are two resources that go outside the five: network ip additionally carries update-many, and network cluster-ip-service offers only status and restart instead of CRUD.

The rule of the field writing

The fields that do not start with -- are required and are asked for in order; the ones that start with -- are optional. When a field that starts with -- is added to the line, the required fields can be written with the -- prefix as well.

Setting Up the Network of a Device from Scratch

Step 1 Create the routing table

network namespace add v-device Host name DMZ

Step 2 Define the interface

network interface add v-device Host name vlan100 type vlan --vlanId 100 --vlanMasterId <interface> --namespace <table>

Step 3 Give an address

network ip add v-device Host interface <interface> ip 10.0.10.1 cidr 24

Step 4 Add the route

network route add v-device Host interface <interface> gateway 10.0.10.254

Step 5 Write the firewall rule

network fw-rule add v-device Host namespace <table> interface <interface> …

Things to Know

• The order matters. The interface is defined after the routing table it will be bound to; the address after the interface; and the route after the address.
• The deletion order is the reverse. Before an interface is deleted, the addresses on it and the routes and rules bound to that interface should be reviewed.
• The protection settings are in the routing table. The network layer DDoS and hardening switches are kept in the network namespace record.
• The cluster addresses carry a meaning on both devices. In the addresses for which --ipType cluster is selected, the address of the peer device and the backup role are written as well.