settings ip-tag

The settings ip-tag command manages the names the operator gives to single IP addresses and to network blocks in CIDR form, that is, the IP tags. Every record maps a single address or a single network block to a name. Its panel equivalent is the IP Tags screen.

Command Summary

TR7 WEB-CLI · settings ip-tag

# Tab after the command

admin@TR7LBWAF01> settings ip-tag

add delete list show update

 

admin@TR7LBWAF01> settings ip-tag list

admin@TR7LBWAF01> settings ip-tag add name <name> address <address>

admin@TR7LBWAF01> settings ip-tag update id <id> …

admin@TR7LBWAF01> settings ip-tag delete <id>

admin@TR7LBWAF01>  

Required Fields

In the add command the CLI asks for the required fields one by one in the order below and does not show the next one until one is written. The fields are written with the field name and the value together.

Order	Field	Status	Value
1	name	Required	The name of the tag; at least 1, at most 128 characters. The same name cannot be used in two tags
2	address	Required	A single IPv4 or IPv6 address (85.1.2.3) or a network in CIDR form (10.8.0.0/24). The same address cannot be used in two tags

In the update command the record to be edited is selected with id <id> and no field is required; only the fields that will change are written with the -- prefix. In the show and delete commands the identifier is written without the field name (settings ip-tag delete <id>). The identifiers are taken from the list output.

Optional Fields

Field	What it does	What is written after it
--description	Adds a description to the tag	A text; at most 512 characters (empty by default). A text containing spaces is put in quotes
--name	Changes the name of the tag in the update command	The new name; at most 128 characters
--address	Changes the address the tag covers in the update command	The new address or network; the writing rule is the same as in the add command

How the Address Is Stored

When the address is saved it is converted to the standard writing; it is displayed in this form in the list and show output.

Entered	Stored	Rule
10.0.0.1/32	10.0.0.1	A full-length prefix (/32 in IPv4, /128 in IPv6) is reduced to the single address
10.8.0.5/24	10.8.0.0/24	A host address written with a prefix is converted to the start address of the network
2001:DB8:0:0:0:0:0:1	2001:db8::1	An IPv6 address is brought to the lowercase, compressed form

The uniqueness check is done on this standard writing: while 10.0.0.1 is defined, 10.0.0.1/32 cannot be given to a separate tag. Nested blocks, on the other hand, are free; 172.16.0.0/16 and 172.16.101.0/24 inside it carry separate tags.

Limits and Error Messages

Rule	Limit	Message returned when exceeded
Number of tags	At most 1000	At most 1000 IP tags can be defined (<count> given)
Tag name	Unique; case-insensitive, leading and trailing spaces are ignored	Exactly the same name: Value must be unique, conflicts with '<id>' (path: …) · A name that differs only in letter case or in leading and trailing spaces: An IP tag named "<name of the existing tag>" already exists
Address	Unique; compared on the standard writing	Exactly the same writing: Value must be unique, conflicts with '<id>' (path: …) · An equivalent address written differently (10.0.0.1/32 while 10.0.0.1 is defined): <address> is already tagged as "<name of the existing tag>"
Name length	At most 128 characters	String must be at most 128 characters (path: …)
Description length	At most 512 characters	String must be at most 512 characters (path: …)

Examples

TR7 WEB-CLI · settings ip-tag

# a tag for a single address

admin@TR7LBWAF01> settings ip-tag add name Admins address 85.1.2.3

 

# a network block tag with a description

admin@TR7LBWAF01> settings ip-tag add name "VPN Pool" address 10.8.0.0/24 \

--description "Remote access users"

 

# an IPv6 network block

admin@TR7LBWAF01> settings ip-tag add name Servers address 2001:db8:10::/64

 

# displaying, changing and deleting an existing tag

admin@TR7LBWAF01> settings ip-tag list

admin@TR7LBWAF01> settings ip-tag show <id>

admin@TR7LBWAF01> settings ip-tag update id <id> --address 10.8.0.0/23

admin@TR7LBWAF01> settings ip-tag delete <id>

admin@TR7LBWAF01>  

Things to Know

• The tags are for display only. The traffic processing engine does not read the tags; adding or deleting a tag does not change the blocking of any request or the match of a rule. The tags are displayed on the screens where the address is shown and on the IP info card.
• The required fields do not take --. The name and address field names are written side by side with their values; --description is optional. The detail is on the API Commands page.
• Every tag covers a single address or a single network block. An address range or an address list is not written; separate tags are defined for more than one address.
• An address can match more than one tag. In nested blocks an address carries both its own tag and the tags of the blocks that cover it; the order is from the most specific to the widest.
• The changes are written to the user operation log. The records are in the IP tag "<name>" (<address>) is created, is edited and is deleted form.
• It is synchronized in the cluster. The tag list is transferred to the other device in the cluster.
• The address reputation is in a separate command. The update of the reputation database and the external sources are managed with the settings ip-intelligence command.