Smarter by Design.Simpler for Business
network namespace
The network namespace command manages the routing tables on the virtual device. The table carries not only the routing but also its own DNS servers, the dynamic routing services and the network layer protection settings. Its panel equivalent is the routing table screen in the network configuration.
Command Summary
# Tab after the command
admin@TR7LBWAF01> network namespace
add delete list show update
admin@TR7LBWAF01> network namespace list v-device <device> # list them all
admin@TR7LBWAF01> network namespace show v-device <device> <id> # show one
admin@TR7LBWAF01> network namespace add v-device <device> name <name> …
admin@TR7LBWAF01> network namespace update v-device <device> id <id> … # change
admin@TR7LBWAF01> network namespace delete v-device <device> <id> # delete
admin@TR7LBWAF01>
Required Fields
| Order | Field | Status | What it does | What is written after it |
|---|---|---|---|---|
| 1 | v-device | Required | Selects on which virtual device the table will be defined | The virtual device |
| 2 | name | Required | Gives a name to the routing table | The name of the table |
The list, show, update and delete commands also ask for v-device first: in the show and delete commands the identifier is written after this without the field name, and in the update command it is in the id <id> form.
All the remaining fields are optional; the ones that are not given are applied with their default values.
The Common Value Set of the Protection Switches
All of the network layer protections take one of the same six values. This gives more than the "on/off" pair: it is possible to monitor a protection first and then to take it into application.
| Value | What it does |
|---|---|
False | The protection is off (the default) |
monitor | It only records the matching traffic, it does not block |
True | It applies the protection with its default behavior |
drop | It drops the matching packet |
quarantine | It takes the source into quarantine |
addToBlacklist | It adds the source to the blacklist |
Monitor first, apply afterwards
Instead of making a new protection True directly, turning it on with monitor and looking at the records produced prevents the ordinary traffic from being blocked by mistake.
Name Resolution and Dynamic Routing
The routing table can have its own DNS servers and local name records.
| Field | What it does | What is written after it |
|---|---|---|
--dns.N | Determines the DNS servers to be used in this routing table | The IP address; each of them with its own index |
--hosts.N.ip | Determines the address to be added to the local name resolution | The IP address |
--hosts.N.domain | Determines the domain name that corresponds to that address | The domain name |
--isDynamic | Turns on the routing table being fed by the dynamic routing protocols | true · false (the default is false) |
The Routing Services
The options of the services to be run when the dynamic routing is turned on are given from here. The default of the ospf6d and ripngd fields is -A ::1, the others are empty.
| Field | What it does | What is written after it |
|---|---|---|
--bgpd | Carries the start options of this routing service | The option text to be given to the service. When it is left empty, the service is not run |
--ospfd | Carries the start options of this routing service | The option text to be given to the service. When it is left empty, the service is not run |
--ospf6d | Carries the start options of this routing service | The option text to be given to the service. When it is left empty, the service is not run |
--ripd | Carries the start options of this routing service | The option text to be given to the service. When it is left empty, the service is not run |
--ripngd | Carries the start options of this routing service | The option text to be given to the service. When it is left empty, the service is not run |
--isisd | Carries the start options of this routing service | The option text to be given to the service. When it is left empty, the service is not run |
--pimd | Carries the start options of this routing service | The option text to be given to the service. When it is left empty, the service is not run |
--ldpd | Carries the start options of this routing service | The option text to be given to the service. When it is left empty, the service is not run |
--nhrpd | Carries the start options of this routing service | The option text to be given to the service. When it is left empty, the service is not run |
--eigrpd | Carries the start options of this routing service | The option text to be given to the service. When it is left empty, the service is not run |
--babeld | Carries the start options of this routing service | The option text to be given to the service. When it is left empty, the service is not run |
--sharpd | Carries the start options of this routing service | The option text to be given to the service. When it is left empty, the service is not run |
--pbrd | Carries the start options of this routing service | The option text to be given to the service. When it is left empty, the service is not run |
--bfdd | Carries the start options of this routing service | The option text to be given to the service. When it is left empty, the service is not run |
--fabricd | Carries the start options of this routing service | The option text to be given to the service. When it is left empty, the service is not run |
--vrrpd | Carries the start options of this routing service | The option text to be given to the service. When it is left empty, the service is not run |
--pathd | Carries the start options of this routing service | The option text to be given to the service. When it is left empty, the service is not run |
The Protection Switches
All of the protections use the same value set; in the ones that have a threshold field the threshold is written separately.
| Field | What it does | What is written after it |
|---|---|---|
--limitTr7Ssh | Limits the connections coming to the SSH service of the device | False off (the default) · monitor only monitors · True on · drop drops the packet · quarantine takes the source into quarantine · addToBlacklist adds the source to the blacklist |
--tr7SshLimit | Determines the threshold value of the protection above | A number (the default is 5) |
--limitTr7Http | Limits the requests coming to the HTTP service of the device | False off (the default) · monitor only monitors · True on · drop drops the packet · quarantine takes the source into quarantine · addToBlacklist adds the source to the blacklist |
--tr7HttpLimit | Determines the threshold value of the protection above | A number (the default is 100) |
--limitTr7Https | Limits the requests coming to the HTTPS service of the device | False off (the default) · monitor only monitors · True on · drop drops the packet · quarantine takes the source into quarantine · addToBlacklist adds the source to the blacklist |
--tr7HttpsLimit | Determines the threshold value of the protection above | A number (the default is 100) |
--blockIpRepBlacklist | Blocks the traffic coming from the addresses in the reputation blacklist | False off (the default) · monitor only monitors · True on · drop drops the packet · quarantine takes the source into quarantine · addToBlacklist adds the source to the blacklist |
--allowIcmp | Determines whether the ICMP traffic will be allowed or not | False off (the default) · monitor only monitors · True on · drop drops the packet · quarantine takes the source into quarantine · addToBlacklist adds the source to the blacklist |
--limitIcmpPackets | Limits the ICMP packet rate | False off (the default) · monitor only monitors · True on · drop drops the packet · quarantine takes the source into quarantine · addToBlacklist adds the source to the blacklist |
--icmpPacketsLimit | Determines the threshold value of the protection above | A number (the default is 100) |
--limitTotalConnPerSrc | Limits the total number of connections per source address | False off (the default) · monitor only monitors · True on · drop drops the packet · quarantine takes the source into quarantine · addToBlacklist adds the source to the blacklist |
--totalConnPerSrcLimit | Determines the threshold value of the protection above | A number (the default is 1000) |
--limitSynFlood | Limits the connection opening rate against a SYN flood attack | False off (the default) · monitor only monitors · True on · drop drops the packet · quarantine takes the source into quarantine · addToBlacklist adds the source to the blacklist |
--synFloodLimit | Determines the threshold value of the protection above | A number (the default is 500) |
--dropNewNotSyn | Drops the new connection packets that do not carry the SYN flag | False off (the default) · monitor only monitors · True on · drop drops the packet · quarantine takes the source into quarantine · addToBlacklist adds the source to the blacklist |
--dropSynWithSuspiciousMss | Drops the SYN packets that carry a suspicious MSS value | False off (the default) · monitor only monitors · True on · drop drops the packet · quarantine takes the source into quarantine · addToBlacklist adds the source to the blacklist |
--synCookies | Protects the connection queue with SYN cookies | False off (the default) · monitor only monitors · True on · drop drops the packet · quarantine takes the source into quarantine · addToBlacklist adds the source to the blacklist |
--synBacklog | Determines the threshold value of the protection above | A number (the default is 4096) |
--limitUdpFlood | Limits the packet rate against a UDP flood attack | False off (the default) · monitor only monitors · True on · drop drops the packet · quarantine takes the source into quarantine · addToBlacklist adds the source to the blacklist |
--udpFloodLimit | Determines the threshold value of the protection above | A number (the default is 500) |
--limitDnsUdpFloodPerSrc | Limits the DNS UDP packet rate per source address | False off (the default) · monitor only monitors · True on · drop drops the packet · quarantine takes the source into quarantine · addToBlacklist adds the source to the blacklist |
--dnsUdpFloodPerSrcLimit | Determines the threshold value of the protection above | A number (the default is 200) |
--limitReflectedUdp | Limits the UDP traffic used in the reflection attacks | False off (the default) · monitor only monitors · True on · drop drops the packet · quarantine takes the source into quarantine · addToBlacklist adds the source to the blacklist |
--reflectedUdpLimit | Determines the threshold value of the protection above | A number (the default is 100) |
--blockZeroByteUdp | Blocks the UDP packets with an empty body | False off (the default) · monitor only monitors · True on · drop drops the packet · quarantine takes the source into quarantine · addToBlacklist adds the source to the blacklist |
--dropInvalidPackets | Drops the invalid packets that do not fit the connection state | False off (the default) · monitor only monitors · True on · drop drops the packet · quarantine takes the source into quarantine · addToBlacklist adds the source to the blacklist |
--dropLandAttack | Drops the LAND attack packets whose source and target are the same | False off (the default) · monitor only monitors · True on · drop drops the packet · quarantine takes the source into quarantine · addToBlacklist adds the source to the blacklist |
--dropMartians | Drops the packets with a spoofed source address that cannot be routed | False off (the default) · monitor only monitors · True on · drop drops the packet · quarantine takes the source into quarantine · addToBlacklist adds the source to the blacklist |
--dropSourceRoute | Drops the packets that carry the source routing option | False off (the default) · monitor only monitors · True on · drop drops the packet · quarantine takes the source into quarantine · addToBlacklist adds the source to the blacklist |
--dropBogus | Drops the packets that carry an invalid flag combination | False off (the default) · monitor only monitors · True on · drop drops the packet · quarantine takes the source into quarantine · addToBlacklist adds the source to the blacklist |
--dropNullScan | Drops the scan packets that carry no flag | False off (the default) · monitor only monitors · True on · drop drops the packet · quarantine takes the source into quarantine · addToBlacklist adds the source to the blacklist |
--dropChristmasTree | Drops the scan packets with all the flags on | False off (the default) · monitor only monitors · True on · drop drops the packet · quarantine takes the source into quarantine · addToBlacklist adds the source to the blacklist |
--dropPortScan | Drops the port scanning behavior | False off (the default) · monitor only monitors · True on · drop drops the packet · quarantine takes the source into quarantine · addToBlacklist adds the source to the blacklist |
--dropSmbNuke | Drops the attack packets directed at the SMB service | False off (the default) · monitor only monitors · True on · drop drops the packet · quarantine takes the source into quarantine · addToBlacklist adds the source to the blacklist |
--smbNukeLimit | Determines the threshold value of the protection above | A number (the default is 10) |
--limitZombieTcp | Limits the half-open TCP connections | False off (the default) · monitor only monitors · True on · drop drops the packet · quarantine takes the source into quarantine · addToBlacklist adds the source to the blacklist |
--limitTcpReset | Limits the rate of the TCP reset packets | False off (the default) · monitor only monitors · True on · drop drops the packet · quarantine takes the source into quarantine · addToBlacklist adds the source to the blacklist |
--tcpResetLimit | Determines the threshold value of the protection above | A number (the default is 20) |
--zombieTcpFinTimeout | Determines the related timeout in the half-open TCP connections | The second (the default is 10) |
--zombieTcpKeepaliveTime | Determines the related timeout in the half-open TCP connections | The second (the default is 30) |
--zombieTcpEstablishedTimeout | Determines the related timeout in the half-open TCP connections | The second (the default is 14400) |
The Quarantine and the Exemptions
In the protections for which the quarantine action is selected, it determines how long the source will stay in quarantine and who will be kept exempt.
| Field | What it does | What is written after it |
|---|---|---|
--quarantine | Turns on the quarantine behavior | true · false (the default is false) |
--quarantineTime.val | Determines how long the quarantine will last | A number |
--quarantineTime.unit | Determines the unit of the quarantine duration | The unit (the default is s) |
--quarantineWhitelist | Determines the ones to be kept exempt from the quarantine (the old form) | The exemption list text |
--ddosTrustKnownPeers | Keeps the traffic coming from the known peers exempt from the protections | true · false (the default is false) |
--ddosWhitelist.N.type | Selects the type of the exemption entry | ip the address · network the network · country the country |
--ddosWhitelist.N.value | Determines the value to be kept exempt | The address, network or country value |
--ddosWhitelist.N.note | Writes an explanation for the entry | Free text |
--ddosWhitelist.N.source | States where the entry comes from | manual added manually (the default) · advisor from a suggestion · system-default the system default |
--ddosWhitelist.N.addedAt | Carries the time at which the entry was added | The time stamp |
The Learning Mode
By observing the traffic, it produces suggestions for the protection thresholds.
| Field | What it does | What is written after it |
|---|---|---|
--learningMode | Selects the learning mode | False off · suggest it only produces suggestions (the default) · auto it applies the suggestions by itself |
--learningLookback.val | Determines how far back the learning will look | A number (the default is 1) |
--learningLookback.unit | Determines the unit of the look-back duration | The unit (the default is M) |
--learningModePromotion | Allows the learned rule to be promoted from the monitoring mode to the application mode | true · false (the default is false) |
--learningInterval | Determines with which interval the learning evaluation will be done | 1sa · 6sa · 12sa · 1g (the default) · 1ha |
The Field Locks
Every protection field has a lock: when the lock is turned on, that field is not changed by the learning and the suggestion, the manually given value is preserved.
| Field | What it does | What is written after it |
|---|---|---|
--ddosFieldLocks.allowIcmp | Prevents the allowIcmp field from being changed by the learning or the suggestion | true · false (the default is false) |
--ddosFieldLocks.blockIpRepBlacklist | Prevents the blockIpRepBlacklist field from being changed by the learning or the suggestion | true · false (the default is false) |
--ddosFieldLocks.blockZeroByteUdp | Prevents the blockZeroByteUdp field from being changed by the learning or the suggestion | true · false (the default is false) |
--ddosFieldLocks.ddosTrustKnownPeers | Prevents the ddosTrustKnownPeers field from being changed by the learning or the suggestion | true · false (the default is false) |
--ddosFieldLocks.ddosWhitelist | Prevents the ddosWhitelist field from being changed by the learning or the suggestion | true · false (the default is false) |
--ddosFieldLocks.dropBogus | Prevents the dropBogus field from being changed by the learning or the suggestion | true · false (the default is false) |
--ddosFieldLocks.dropChristmasTree | Prevents the dropChristmasTree field from being changed by the learning or the suggestion | true · false (the default is false) |
--ddosFieldLocks.dropInvalidPackets | Prevents the dropInvalidPackets field from being changed by the learning or the suggestion | true · false (the default is false) |
--ddosFieldLocks.dropLandAttack | Prevents the dropLandAttack field from being changed by the learning or the suggestion | true · false (the default is false) |
--ddosFieldLocks.dropMartians | Prevents the dropMartians field from being changed by the learning or the suggestion | true · false (the default is false) |
--ddosFieldLocks.dropNewNotSyn | Prevents the dropNewNotSyn field from being changed by the learning or the suggestion | true · false (the default is false) |
--ddosFieldLocks.dropNullScan | Prevents the dropNullScan field from being changed by the learning or the suggestion | true · false (the default is false) |
--ddosFieldLocks.dropPortScan | Prevents the dropPortScan field from being changed by the learning or the suggestion | true · false (the default is false) |
--ddosFieldLocks.dropSmbNuke | Prevents the dropSmbNuke field from being changed by the learning or the suggestion | true · false (the default is false) |
--ddosFieldLocks.dropSourceRoute | Prevents the dropSourceRoute field from being changed by the learning or the suggestion | true · false (the default is false) |
--ddosFieldLocks.dropSynWithSuspiciousMss | Prevents the dropSynWithSuspiciousMss field from being changed by the learning or the suggestion | true · false (the default is false) |
--ddosFieldLocks.limitDnsUdpFloodPerSrc | Prevents the limitDnsUdpFloodPerSrc field from being changed by the learning or the suggestion | true · false (the default is false) |
--ddosFieldLocks.limitIcmpPackets | Prevents the limitIcmpPackets field from being changed by the learning or the suggestion | true · false (the default is false) |
--ddosFieldLocks.limitReflectedUdp | Prevents the limitReflectedUdp field from being changed by the learning or the suggestion | true · false (the default is false) |
--ddosFieldLocks.limitSynFlood | Prevents the limitSynFlood field from being changed by the learning or the suggestion | true · false (the default is false) |
--ddosFieldLocks.limitTcpReset | Prevents the limitTcpReset field from being changed by the learning or the suggestion | true · false (the default is false) |
--ddosFieldLocks.limitTotalConnPerSrc | Prevents the limitTotalConnPerSrc field from being changed by the learning or the suggestion | true · false (the default is false) |
--ddosFieldLocks.limitTr7Http | Prevents the limitTr7Http field from being changed by the learning or the suggestion | true · false (the default is false) |
--ddosFieldLocks.limitTr7Https | Prevents the limitTr7Https field from being changed by the learning or the suggestion | true · false (the default is false) |
--ddosFieldLocks.limitTr7Ssh | Prevents the limitTr7Ssh field from being changed by the learning or the suggestion | true · false (the default is false) |
--ddosFieldLocks.limitUdpFlood | Prevents the limitUdpFlood field from being changed by the learning or the suggestion | true · false (the default is false) |
--ddosFieldLocks.limitZombieTcp | Prevents the limitZombieTcp field from being changed by the learning or the suggestion | true · false (the default is false) |
--ddosFieldLocks.quarantine | Prevents the quarantine field from being changed by the learning or the suggestion | true · false (the default is false) |
--ddosFieldLocks.quarantineTime | Prevents the quarantineTime field from being changed by the learning or the suggestion | true · false (the default is false) |
--ddosFieldLocks.quarantineWhitelist | Prevents the quarantineWhitelist field from being changed by the learning or the suggestion | true · false (the default is false) |
--ddosFieldLocks.synCookies | Prevents the synCookies field from being changed by the learning or the suggestion | true · false (the default is false) |
Examples
admin@TR7LBWAF01> network namespace add v-device Host name DMZ \
--dns.0 10.0.1.53 --dns.1 10.0.1.54 \
--hosts.0.ip 10.0.10.21 --hosts.0.domain portal.kurum.local
admin@TR7LBWAF01>
admin@TR7LBWAF01> network namespace update v-device Host id <id> \
--limitSynFlood monitor --synFloodLimit 800 \
--limitTotalConnPerSrc monitor --totalConnPerSrcLimit 2000 \
--dropInvalidPackets True --dropMartians True
# taking it into application after the records are looked at
admin@TR7LBWAF01> network namespace update v-device Host id <id> --limitSynFlood drop
admin@TR7LBWAF01>
admin@TR7LBWAF01> network namespace update v-device Host id <id> \
--limitTr7Ssh quarantine --tr7SshLimit 3 \
--quarantine true --quarantineTime.val 30 --quarantineTime.unit m \
--ddosWhitelist.0.type network --ddosWhitelist.0.value 10.0.0.0/8 --ddosWhitelist.0.note "internal network"
# let the learning not change this field
admin@TR7LBWAF01> network namespace update v-device Host id <id> --ddosFieldLocks.limitTr7Ssh true
admin@TR7LBWAF01>
admin@TR7LBWAF01> network namespace update v-device Host id <id> --isDynamic true --bgpd <options>
admin@TR7LBWAF01> network namespace update v-device Host id <id> \
--learningMode suggest --learningInterval 1g --learningLookback.val 2 --learningLookback.unit M
admin@TR7LBWAF01>
Things to Know
- The table does not carry only the routing. The DNS servers, the local name records, the dynamic routing services and the network layer protections are in the same record.
- The protections have six values. Instead of on/off there are also the monitoring, dropping, quarantine and blacklist options; a new protection should be turned on with
monitorfirst. - The threshold field is separate from the protection. The
--limitSynFlooddetermines the protection and the--synFloodLimitthe threshold; writing a threshold while the protection is off does not create an effect. - The lock is against the learning. When
--ddosFieldLocks.<field> trueis written, that field is not changed by the learning and the suggestion. - The dynamic routing services work with an option text. When the field of a service is left empty, that service is not run.
- The routing table is used by other records. Before it is deleted, the interface, address, firewall rule and backend records bound to it should be reviewed.
