mirror of
https://git.valherun.com/valherun/pxe_boot_alma.git
synced 2026-10-15 22:22:03 -04:00
andersenandClaude Fable 5
6d398b826a
- restructure boot/kickstarts/scripts/docs into homelab/ - docs: alma9->10 breaking changes, CIS hardening, kickstart changes - add find_cron_entries.sh helper and codex running memory notes Co-Authored-By: Claude Fable 5 <[email protected]>
29293 lines
1.4 MiB
Plaintext
29293 lines
1.4 MiB
Plaintext
<?xml version="1.0" encoding="utf-8"?>
|
|
<!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
|
|
<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="22" lastModified="1469457913" id="root">
|
|
<Library id="syslib000" color="#d4f8ff" name="Standard" comment="Standard objects" ro="True">
|
|
<AnyNetwork id="sysid0" name="Any" comment="Any Network" ro="False" address="0.0.0.0" netmask="0.0.0.0"/>
|
|
<AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service" ro="False"/>
|
|
<AnyInterval id="sysid2" days_of_week="0,1,2,3,4,5,6" from_day="-1" from_hour="-1" from_minute="-1" from_month="-1" from_weekday="-1" from_year="-1" to_day="-1" to_hour="-1" to_minute="-1" to_month="-1" to_weekday="-1" to_year="-1" name="Any" comment="Any Interval" ro="False"/>
|
|
<ObjectGroup id="stdid01" name="Objects" comment="" ro="False">
|
|
<ObjectGroup id="stdid16" name="Addresses" comment="" ro="False">
|
|
<IPv4 id="id2001X88798" name="all-hosts" comment="" ro="False" address="224.0.0.1" netmask="0.0.0.0"/>
|
|
<IPv4 id="id2002X88798" name="all-routers" comment="" ro="False" address="224.0.0.2" netmask="0.0.0.0"/>
|
|
<IPv4 id="id2003X88798" name="all DVMRP" comment="" ro="False" address="224.0.0.4" netmask="0.0.0.0"/>
|
|
<IPv4 id="id2117X88798" name="OSPF (all routers)" comment="RFC2328" ro="False" address="224.0.0.5" netmask="0.0.0.0"/>
|
|
<IPv4 id="id2128X88798" name="OSPF (designated routers)" comment="RFC2328" ro="False" address="224.0.0.6" netmask="0.0.0.0"/>
|
|
<IPv4 id="id2430X88798" name="RIP" comment="RFC1723" ro="False" address="224.0.0.9" netmask="0.0.0.0"/>
|
|
<IPv4 id="id2439X88798" name="EIGRP" comment="" ro="False" address="224.0.0.10" netmask="0.0.0.0"/>
|
|
<IPv4 id="id2446X88798" name="DHCP server, relay agent" comment="RFC 1884" ro="False" address="224.0.0.12" netmask="0.0.0.0"/>
|
|
<IPv4 id="id2455X88798" name="PIM" comment="" ro="False" address="224.0.0.13" netmask="0.0.0.0"/>
|
|
<IPv4 id="id2462X88798" name="RSVP" comment="" ro="False" address="224.0.0.14" netmask="0.0.0.0"/>
|
|
<IPv4 id="id2469X88798" name="VRRP" comment="RFC3768" ro="False" address="224.0.0.18" netmask="0.0.0.0"/>
|
|
<IPv4 id="id2777X88798" name="IGMP" comment="" ro="False" address="224.0.0.22" netmask="0.0.0.0"/>
|
|
<IPv4 id="id2784X88798" name="OSPFIGP-TE" comment="RFC4973" ro="False" address="224.0.0.24" netmask="0.0.0.0"/>
|
|
<IPv4 id="id3094X88798" name="HSRP" comment="" ro="False" address="224.0.0.102" netmask="0.0.0.0"/>
|
|
<IPv4 id="id3403X88798" name="mDNS" comment="" ro="False" address="224.0.0.251" netmask="0.0.0.0"/>
|
|
<IPv4 id="id3410X88798" name="LLMNR" comment="Link-Local Multicast Name Resolution, RFC4795" ro="False" address="224.0.0.252" netmask="0.0.0.0"/>
|
|
<IPv4 id="id3411X88798" name="Teredo" comment="" ro="False" address="224.0.0.253" netmask="0.0.0.0"/>
|
|
</ObjectGroup>
|
|
<ObjectGroup id="stdid17" name="DNS Names" comment="" ro="False"/>
|
|
<ObjectGroup id="stdid18" name="Address Tables" comment="" ro="False"/>
|
|
<ObjectGroup id="stdid04" name="Groups" comment="" ro="False">
|
|
<ObjectGroup id="id3DC75CE8" name="rfc1918-nets" comment="" ro="False">
|
|
<ObjectRef ref="id3DC75CE5"/>
|
|
<ObjectRef ref="id3DC75CE6"/>
|
|
<ObjectRef ref="id3DC75CE7"/>
|
|
</ObjectGroup>
|
|
<ObjectGroup id="id3292X75851" name="ipv6 private" comment="These are various ipv6 networks that should not be routed on the Internet " ro="False">
|
|
<ObjectRef ref="id2088X75851"/>
|
|
<ObjectRef ref="id2986X75851"/>
|
|
<ObjectRef ref="id2383X75851"/>
|
|
</ObjectGroup>
|
|
</ObjectGroup>
|
|
<ObjectGroup id="stdid02" name="Hosts" comment="" ro="False">
|
|
<Host id="id3D84EECE" name="internal server" comment="This host is used in examples and template objects" ro="False">
|
|
<Interface id="id3D84EED2" dedicated_failover="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<IPv4 id="id3D84EED3" name="ip" comment="" ro="False" address="192.168.1.10" netmask="255.255.255.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="192.168.1.10">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<HostOptions>
|
|
<Option name="snmp_contact"></Option>
|
|
<Option name="snmp_description"></Option>
|
|
<Option name="snmp_location"></Option>
|
|
<Option name="use_mac_addr">false</Option>
|
|
<Option name="use_mac_addr_filter">False</Option>
|
|
</HostOptions>
|
|
</Host>
|
|
<Host id="id3D84EECF" name="server on dmz" comment="This host is used in examples and template objects" ro="False">
|
|
<Interface id="id3D84EEE3" dedicated_failover="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<IPv4 id="id3D84EEE4" name="ip" comment="" ro="False" address="192.168.2.10" netmask="255.255.255.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="192.168.2.10">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<HostOptions>
|
|
<Option name="snmp_contact"></Option>
|
|
<Option name="snmp_description"></Option>
|
|
<Option name="snmp_location"></Option>
|
|
<Option name="use_mac_addr">false</Option>
|
|
<Option name="use_mac_addr_filter">False</Option>
|
|
</HostOptions>
|
|
</Host>
|
|
</ObjectGroup>
|
|
<ObjectGroup id="stdid03" name="Networks" comment="" ro="False">
|
|
<Network id="id3DC75CEC" name="all multicasts" comment="224.0.0.0/4 - This block, formerly known as the Class D address space, is allocated for use in IPv4 multicast address assignments. The IANA guidelines for assignments from this space are described in [RFC3171]. " ro="False" address="224.0.0.0" netmask="240.0.0.0"/>
|
|
<Network id="id3F4ECE3E" name="link-local" comment="169.254.0.0/16 - This is the "link local" block. It is allocated for communication between hosts on a single link. Hosts obtain these addresses by auto-configuration, such as when a DHCP server may not be found. " ro="False" address="169.254.0.0" netmask="255.255.0.0"/>
|
|
<Network id="id3F4ECE3D" name="loopback-net" comment="127.0.0.0/8 - This block is assigned for use as the Internet host loopback address. A datagram sent by a higher level protocol to an address anywhere within this block should loop back inside the host. This is ordinarily implemented using only 127.0.0.1/32 for loopback, but no addresses within this block should ever appear on any network anywhere [RFC1700, page 5]. " ro="False" address="127.0.0.0" netmask="255.0.0.0"/>
|
|
<Network id="id3DC75CE5" name="net-10.0.0.0" comment="10.0.0.0/8 - This block is set aside for use in private networks. Its intended use is documented in [RFC1918]. Addresses within this block should not appear on the public Internet." ro="False" address="10.0.0.0" netmask="255.0.0.0"/>
|
|
<Network id="id3DC75CE7" name="net-172.16.0.0" comment="172.16.0.0/12 - This block is set aside for use in private networks. Its intended use is documented in [RFC1918]. Addresses within this block should not appear on the public Internet. " ro="False" address="172.16.0.0" netmask="255.240.0.0"/>
|
|
<Network id="id3DC75CE6" name="net-192.168.0.0" comment="192.168.0.0/16 - This block is set aside for use in private networks. Its intended use is documented in [RFC1918]. Addresses within this block should not appear on the public Internet. " ro="False" address="192.168.0.0" netmask="255.255.0.0"/>
|
|
<Network id="id3F4ECE3F" name="test-net" comment="192.0.2.0/24 - This block is assigned as "TEST-NET" for use in documentation and example code. It is often used in conjunction with domain names example.com or example.net in vendor and protocol documentation. Addresses within this block should not appear on the public Internet. " ro="False" address="192.0.2.0" netmask="255.255.255.0"/>
|
|
<Network id="id3F4ECE40" name="this-net" comment="0.0.0.0/8 - Addresses in this block refer to source hosts on "this" network. Address 0.0.0.0/32 may be used as a source address for this host on this network; other addresses within 0.0.0.0/8 may be used to refer to specified hosts on this network [RFC1700, page 4]." ro="False" address="0.0.0.0" netmask="255.0.0.0"/>
|
|
<Network id="id3DC75CE7-1" name="net-192.168.1.0" comment="192.168.1.0/24 - Address often used for home and small office networks. " ro="False" address="192.168.1.0" netmask="255.255.255.0"/>
|
|
<Network id="id3DC75CE7-2" name="net-192.168.2.0" comment="192.168.2.0/24 - Address often used for home and small office networks. " ro="False" address="192.168.2.0" netmask="255.255.255.0"/>
|
|
<NetworkIPv6 id="id2088X75851" name="documentation net" comment="RFC3849" ro="False" address="2001:db8::" netmask="32"/>
|
|
<NetworkIPv6 id="id2383X75851" name="link-local ipv6" comment="RFC4291 Link-local unicast net" ro="False" address="fe80::" netmask="10"/>
|
|
<NetworkIPv6 id="id2685X75851" name="multicast ipv6" comment="RFC4291 ipv6 multicast addresses" ro="False" address="ff00::" netmask="8"/>
|
|
<NetworkIPv6 id="id2986X75851" name="experimental ipv6" comment="RFC2928, RFC4773 "The block of Sub-TLA IDs assigned to the IANA (i.e., 2001:0000::/29 - 2001:01F8::/29) is for assignment for testing and experimental usage to support activities such as the 6bone, and for new approaches like exchanges." [RFC2928] " ro="False" address="2001::" netmask="23"/>
|
|
<Network id="id3289X12564" name="TEST-NET-2" comment="RFC 5735 RFC 5737 " ro="False" address="198.51.100.0" netmask="255.255.255.0"/>
|
|
<Network id="id3300X12564" name="TEST-NET-3" comment="RFC 5735 RFC 5737" ro="False" address="203.0.113.0" netmask="255.255.255.0"/>
|
|
<Network id="id3311X12564" name="Benchmark tests network" comment="RFC 5735" ro="False" address="198.18.0.0" netmask="255.254.0.0"/>
|
|
<NetworkIPv6 id="id3326X12564" name="mapped-ipv4" comment="" ro="False" address="::ffff:0.0.0.0" netmask="96"/>
|
|
<NetworkIPv6 id="id3341X12564" name="translated-ipv4" comment="" ro="False" address="::ffff:0:0:0" netmask="96"/>
|
|
<NetworkIPv6 id="id3350X12564" name="Teredo" comment="" ro="False" address="2001::" netmask="32"/>
|
|
<NetworkIPv6 id="id3359X12564" name="unique-local" comment="" ro="False" address="fc00::" netmask="7"/>
|
|
</ObjectGroup>
|
|
<ObjectGroup id="stdid15" name="Address Ranges" comment="" ro="False">
|
|
<AddressRange id="id3F6D115C" name="broadcast" comment="" ro="False" start_address="255.255.255.255" end_address="255.255.255.255"/>
|
|
<AddressRange id="id3F6D115D" name="old-broadcast" comment="" ro="False" start_address="0.0.0.0" end_address="0.0.0.0"/>
|
|
</ObjectGroup>
|
|
</ObjectGroup>
|
|
<ServiceGroup id="stdid05" name="Services" comment="" ro="False">
|
|
<CustomService id="stdid14_1" name="ESTABLISHED" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv4">
|
|
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
|
|
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
|
|
<CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
|
|
<CustomServiceCommand platform="procurve_acl">established</CustomServiceCommand>
|
|
</CustomService>
|
|
<CustomService id="stdid14_2" name="ESTABLISHED ipv6" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv6">
|
|
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
|
|
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
|
|
<CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
|
|
<CustomServiceCommand platform="procurve_acl">established</CustomServiceCommand>
|
|
</CustomService>
|
|
<ServiceGroup id="stdid10" name="Groups" comment="" ro="False">
|
|
<ServiceGroup id="sg-DHCP" name="DHCP" comment="" ro="False">
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</ServiceGroup>
|
|
<ServiceGroup id="id3F530CC8" name="DNS" comment="" ro="False">
|
|
<ServiceRef ref="udp-DNS"/>
|
|
<ServiceRef ref="tcp-DNS"/>
|
|
</ServiceGroup>
|
|
<ServiceGroup id="id3CB1279B" name="IPSEC" comment="" ro="False">
|
|
<ServiceRef ref="id3CB12797"/>
|
|
<ServiceRef ref="ip-IPSEC"/>
|
|
</ServiceGroup>
|
|
<ServiceGroup id="sg-NETBIOS" name="NETBIOS" comment="" ro="False">
|
|
<ServiceRef ref="udp-netbios-dgm"/>
|
|
<ServiceRef ref="udp-netbios-ns"/>
|
|
<ServiceRef ref="id3E755609"/>
|
|
</ServiceGroup>
|
|
<ServiceGroup id="id3CB131CC" name="PCAnywhere" comment="" ro="False">
|
|
<ServiceRef ref="id3CB131CA"/>
|
|
<ServiceRef ref="id3CB131C8"/>
|
|
</ServiceGroup>
|
|
<ServiceGroup id="sg-Useful_ICMP" name="Useful_ICMP" comment="" ro="False">
|
|
<ServiceRef ref="icmp-Time_exceeded"/>
|
|
<ServiceRef ref="icmp-Time_exceeded_in_transit"/>
|
|
<ServiceRef ref="icmp-ping_reply"/>
|
|
<ServiceRef ref="icmp-Unreachables"/>
|
|
</ServiceGroup>
|
|
<ServiceGroup id="id1569X4889" name="Ipv6 unreachable messages" comment="" ro="False">
|
|
<ServiceRef ref="idE0D27650"/>
|
|
<ServiceRef ref="idCFE27650"/>
|
|
<ServiceRef ref="idE0B27650"/>
|
|
<ServiceRef ref="id1519Z388"/>
|
|
</ServiceGroup>
|
|
<ServiceGroup id="id3B4FEDD9" name="kerberos" comment="" ro="False">
|
|
<ServiceRef ref="id3B4FEDA5"/>
|
|
<ServiceRef ref="id3B4FEDA9"/>
|
|
<ServiceRef ref="id3B4FEDA7"/>
|
|
<ServiceRef ref="id3B4FEDAB"/>
|
|
<ServiceRef ref="id3B4FEDA3"/>
|
|
<ServiceRef ref="id3B4FEE21"/>
|
|
<ServiceRef ref="id3B4FEE23"/>
|
|
<ServiceRef ref="id3E7E3EA2"/>
|
|
</ServiceGroup>
|
|
<ServiceGroup id="id3B4FF35E" name="nfs" comment="" ro="False">
|
|
<ServiceRef ref="id3B4FEE7A"/>
|
|
<ServiceRef ref="id3B4FEE78"/>
|
|
</ServiceGroup>
|
|
<ServiceGroup id="id3B4FEFFA" name="quake" comment="" ro="False">
|
|
<ServiceRef ref="id3B4FEF7C"/>
|
|
<ServiceRef ref="id3B4FEF7E"/>
|
|
</ServiceGroup>
|
|
<ServiceGroup id="id3D703C9A" name="Real Player" comment="" ro="False">
|
|
<ServiceRef ref="id3D703C99"/>
|
|
<ServiceRef ref="id3D703C8B"/>
|
|
</ServiceGroup>
|
|
<ServiceGroup id="id3E7E3E95" name="WinNT" comment="" ro="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id3DC8C8BB"/>
|
|
<ServiceRef ref="id3E7E3D58"/>
|
|
</ServiceGroup>
|
|
<ServiceGroup id="id3E7E3E9A" name="Win2000" comment="" ro="False">
|
|
<ServiceRef ref="id3E7E3E95"/>
|
|
<ServiceRef ref="udp-DNS"/>
|
|
<ServiceRef ref="id3DC8C8BC"/>
|
|
<ServiceRef ref="id3E7E3EA2"/>
|
|
<ServiceRef ref="id3AECF778"/>
|
|
<ServiceRef ref="id3D703C90"/>
|
|
<ServiceRef ref="id3E7E4039"/>
|
|
<ServiceRef ref="id3E7E403A"/>
|
|
<ServiceRef ref="id3B4FEDA5"/>
|
|
<ServiceRef ref="tcp-DNS"/>
|
|
</ServiceGroup>
|
|
<ServiceGroup id="id41291786" name="UPnP" comment="" ro="False">
|
|
<ServiceRef ref="id41291784"/>
|
|
<ServiceRef ref="id41291785"/>
|
|
<ServiceRef ref="id41291783"/>
|
|
<ServiceRef ref="id412Z18A9"/>
|
|
</ServiceGroup>
|
|
</ServiceGroup>
|
|
<ServiceGroup id="stdid07" name="ICMP" comment="" ro="False">
|
|
<ICMPService id="icmp-Unreachables" code="-1" type="3" name="all ICMP unreachables" comment="" ro="False"/>
|
|
<ICMPService id="id3C20EEB5" code="-1" type="-1" name="any ICMP" comment="" ro="False"/>
|
|
<ICMPService id="icmp-Host_unreach" code="1" type="3" name="host_unreach" comment="" ro="False"/>
|
|
<ICMPService id="icmp-ping_reply" code="0" type="0" name="ping reply" comment="" ro="False"/>
|
|
<ICMPService id="icmp-ping_request" code="0" type="8" name="ping request" comment="" ro="False"/>
|
|
<ICMPService id="icmp-Port_unreach" code="3" type="3" name="port unreach" comment="Port unreachable" ro="False"/>
|
|
<ICMPService id="icmp-Time_exceeded" code="0" type="11" name="time exceeded" comment="ICMP messages of this type are needed for traceroute" ro="False"/>
|
|
<ICMPService id="icmp-Time_exceeded_in_transit" code="1" type="11" name="time exceeded in transit" comment="" ro="False"/>
|
|
<ICMP6Service id="ipv6-icmp-ping_request" code="0" type="128" name="ipv6 ping request" comment="IPv6 ping request" ro="False"/>
|
|
<ICMP6Service id="ipv6-icmp-ping_reply" code="0" type="129" name="ipv6 ping reply" comment="IPv6 ping reply" ro="False"/>
|
|
<ICMP6Service id="ipv6-icmp-routersol" code="0" type="133" name="ipv6 routersol" comment="IPv6 router solicitation" ro="False"/>
|
|
<ICMP6Service id="ipv6-icmp-routeradv" code="0" type="134" name="ipv6 routeradv" comment="IPv6 router advertisement" ro="False"/>
|
|
<ICMP6Service id="ipv6-icmp-neighbrsol" code="0" type="135" name="ipv6 neighbrsol" comment="IPv6 neighbor solicitation" ro="False"/>
|
|
<ICMP6Service id="ipv6-icmp-neighbradv" code="0" type="136" name="ipv6 neighbradv" comment="IPv6 neighbor advertisement" ro="False"/>
|
|
<ICMP6Service id="ipv6-icmp-redir" code="0" type="137" name="ipv6 redir" comment="IPv6 redirect: shorter route exists" ro="False"/>
|
|
<ICMP6Service id="id1519Z388" code="-1" type="4" name="ipv6 parameter problem" comment="IPv6 Parameter Problem: RFC4443" ro="False"/>
|
|
<ICMP6Service id="idCFE27650" code="0" type="3" name="ipv6 time exceeded" comment="Time exceeded in transit" ro="False"/>
|
|
<ICMP6Service id="idCFF27650" code="1" type="3" name="ipv6 time exceeded in reassembly" comment="Time exceeded in reassembly" ro="False"/>
|
|
<ICMP6Service id="idE0B27650" code="-1" type="2" name="ipv6 packet too big" comment="" ro="False"/>
|
|
<ICMP6Service id="idE0D27650" code="-1" type="1" name="ipv6 all dest unreachable" comment="All icmpv6 codes for type "destination unreachable" " ro="False"/>
|
|
<ICMP6Service id="idCFE27660" code="-1" type="-1" name="ipv6 any ICMP6" comment="any ICMPv6" ro="False"/>
|
|
</ServiceGroup>
|
|
<ServiceGroup id="stdid06" name="IP" comment="" ro="False">
|
|
<IPService id="id3CB12797" fragm="False" lsrr="False" protocol_num="51" rr="False" short_fragm="False" ssrr="False" ts="False" name="AH" comment="IPSEC Authentication Header Protocol" ro="False"/>
|
|
<IPService id="ip-IPSEC" fragm="False" lsrr="False" protocol_num="50" rr="False" short_fragm="False" ssrr="False" ts="False" name="ESP" comment="IPSEC Encapsulating Security Payload Protocol" ro="False"/>
|
|
<IPService id="ip-RR" fragm="False" lsrr="False" protocol_num="0" rr="True" short_fragm="False" ssrr="False" ts="False" name="RR" comment="Route recording packets" ro="False"/>
|
|
<IPService id="ip-SRR" fragm="False" lsrr="True" protocol_num="0" rr="False" short_fragm="False" ssrr="True" ts="False" name="SRR" comment="All sorts of Source Routing Packets" ro="False"/>
|
|
<IPService id="ip-IP_Fragments" fragm="False" lsrr="False" protocol_num="0" rr="False" short_fragm="True" ssrr="False" ts="False" name="ip_fragments" comment="'Short' fragments" ro="False"/>
|
|
<IPService id="id3D703C8E" fragm="False" lsrr="False" protocol_num="57" rr="False" short_fragm="False" ssrr="False" ts="False" name="SKIP" comment="IPSEC Simple Key Management for Internet Protocols" ro="False"/>
|
|
<IPService id="id3D703C8F" fragm="False" lsrr="False" protocol_num="47" rr="False" short_fragm="False" ssrr="False" ts="False" name="GRE" comment="Generic Routing Encapsulation " ro="False"/>
|
|
<IPService id="id3D703C95" fragm="False" lsrr="False" protocol_num="112" rr="False" short_fragm="False" ssrr="False" ts="False" name="vrrp" comment="Virtual Router Redundancy Protocol" ro="False"/>
|
|
<IPService id="ip-IGMP" fragm="False" lsrr="False" protocol_num="2" rr="False" rtralt="True" rtralt_value="0" short_fragm="False" ssrr="False" ts="False" name="IGMP" comment="Internet Group Management Protocol, Version 3, RFC 3376" ro="False"/>
|
|
<IPService id="ip-PIM" fragm="False" lsrr="False" protocol_num="103" rr="False" rtralt="False" rtralt_value="0" short_fragm="False" ssrr="False" ts="False" name="PIM" comment="Protocol Independent Multicast - Dense Mode (PIM-DM), RFC 3973, or Protocol Independent Multicast-Sparse Mode (PIM-SM) RFC 2362" ro="False"/>
|
|
</ServiceGroup>
|
|
<ServiceGroup id="stdid09" name="TCP" comment="" ro="False">
|
|
<TCPService id="tcp-ALL_TCP_Masqueraded" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ALL TCP Masqueraded" comment="ipchains used to use this range of port numbers for masquerading. " ro="False" src_range_start="61000" src_range_end="65095" dst_range_start="0" dst_range_end="0"/>
|
|
<TCPService id="id3D703C94" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="AOL" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5190" dst_range_end="5190"/>
|
|
<TCPService id="tcp-All_TCP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="All TCP" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
|
|
<TCPService id="id3CB131C4" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="Citrix-ICA" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1494" dst_range_end="1494"/>
|
|
<TCPService id="id3D703C91" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="Entrust-Admin" comment="Entrust CA Administration Service" ro="False" src_range_start="0" src_range_end="0" dst_range_start="709" dst_range_end="709"/>
|
|
<TCPService id="id3D703C92" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="Entrust-KeyMgmt" comment="Entrust CA Key Management Service" ro="False" src_range_start="0" src_range_end="0" dst_range_start="710" dst_range_end="710"/>
|
|
<TCPService id="id3AEDBEAC" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="H323" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1720" dst_range_end="1720"/>
|
|
<TCPService id="id412Z18A9" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="icslap" comment="Sometimes this protocol is called icslap, but Microsoft does not call it that and just says that DSPP uses port 2869 in Windows XP SP2" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2869" dst_range_end="2869"/>
|
|
<TCPService id="id3E7E4039" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="LDAP GC" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3268" dst_range_end="3268"/>
|
|
<TCPService id="id3E7E403A" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="LDAP GC SSL" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3269" dst_range_end="3269"/>
|
|
<TCPService id="id3D703C83" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="OpenWindows" comment="Open Windows" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2000" dst_range_end="2000"/>
|
|
<TCPService id="id3CB131C8" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="PCAnywhere-data" comment="data channel for PCAnywhere v7.52 and later " ro="False" src_range_start="0" src_range_end="0" dst_range_start="5631" dst_range_end="5631"/>
|
|
<TCPService id="id3D703C8B" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="Real-Audio" comment="RealNetworks PNA Protocol" ro="False" src_range_start="0" src_range_end="0" dst_range_start="7070" dst_range_end="7070"/>
|
|
<TCPService id="id3D703C93" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="RealSecure" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2998" dst_range_end="2998"/>
|
|
<TCPService id="id3DC8C8BC" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="SMB" comment="SMB over TCP (without NETBIOS) " ro="False" src_range_start="0" src_range_end="0" dst_range_start="445" dst_range_end="445"/>
|
|
<TCPService id="id3D703C8D" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="TACACSplus" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="49" dst_range_end="49"/>
|
|
<TCPService id="id3D703C84" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="TCP high ports" comment="TCP high ports" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1024" dst_range_end="65535"/>
|
|
<TCPService id="id3E7E3D58" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="WINS replication" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="42" dst_range_end="42"/>
|
|
<TCPService id="id3D703C82" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="X11" comment="X Window System" ro="False" src_range_start="0" src_range_end="0" dst_range_start="6000" dst_range_end="6063"/>
|
|
<TCPService id="tcp-Auth" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="auth" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="113" dst_range_end="113"/>
|
|
<TCPService id="id3AEDBE6E" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="daytime" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="13" dst_range_end="13"/>
|
|
<TCPService id="tcp-DNS" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="domain" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="53" dst_range_end="53"/>
|
|
<TCPService id="id3B4FEDA3" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="eklogin" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2105" dst_range_end="2105"/>
|
|
<TCPService id="id3AECF774" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="finger" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="79" dst_range_end="79"/>
|
|
<TCPService id="tcp-FTP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ftp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="21" dst_range_end="21"/>
|
|
<TCPService id="tcp-FTP_data" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ftp data" comment="FTP data channel. Note: FTP protocol does not really require server to use source port 20 for the data channel, but many ftp server implementations do so." ro="False" src_range_start="20" src_range_end="20" dst_range_start="1024" dst_range_end="65535"/>
|
|
<TCPService id="id3E7553BC" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ftp data passive" comment="FTP data channel for passive mode transfers " ro="False" src_range_start="0" src_range_end="0" dst_range_start="20" dst_range_end="20"/>
|
|
<TCPService id="tcp-HTTP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="http" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="80" dst_range_end="80"/>
|
|
<TCPService id="id3B4FED69" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="https" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="443" dst_range_end="443"/>
|
|
<TCPService id="id3AECF776" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="imap" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="143" dst_range_end="143"/>
|
|
<TCPService id="id3B4FED9F" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="imaps" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="993" dst_range_end="993"/>
|
|
<TCPService id="id3B4FF13C" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="irc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="6667" dst_range_end="6667"/>
|
|
<TCPService id="id3E7E3EA2" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="kerberos" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="88" dst_range_end="88"/>
|
|
<TCPService id="id3B4FEE21" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="klogin" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="543" dst_range_end="543"/>
|
|
<TCPService id="id3B4FEE23" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ksh" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="544" dst_range_end="544"/>
|
|
<TCPService id="id3AECF778" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ldap" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="389" dst_range_end="389"/>
|
|
<TCPService id="id3D703C90" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ldaps" comment="Lightweight Directory Access Protocol over TLS/SSL" ro="False" src_range_start="0" src_range_end="0" dst_range_start="636" dst_range_end="636"/>
|
|
<TCPService id="id3B4FF000" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="linuxconf" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="98" dst_range_end="98"/>
|
|
<TCPService id="id3D703C97" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="lpr" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="515" dst_range_end="515"/>
|
|
<TCPService id="id3DC8C8BB" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="microsoft-rpc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="135" dst_range_end="135"/>
|
|
<TCPService id="id3D703C98" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ms-sql" comment="Microsoft SQL Server" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1433" dst_range_end="1433"/>
|
|
<TCPService id="id3B4FEEEE" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="mysql" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3306" dst_range_end="3306"/>
|
|
<TCPService id="id3E755609" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="netbios-ssn" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="139" dst_range_end="139"/>
|
|
<TCPService id="id3B4FEE7A" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="nfs" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2049" dst_range_end="2049"/>
|
|
<TCPService id="tcp-NNTP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="nntp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="119" dst_range_end="119"/>
|
|
<TCPService id="id3E7553BB" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="nntps" comment="NNTP over SSL" ro="False" src_range_start="0" src_range_end="0" dst_range_start="563" dst_range_end="563"/>
|
|
<TCPService id="id3B4FEE1D" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="pop3" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="110" dst_range_end="110"/>
|
|
<TCPService id="id3E7553BA" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="pop3s" comment="POP-3 over SSL" ro="False" src_range_start="0" src_range_end="0" dst_range_start="995" dst_range_end="995"/>
|
|
<TCPService id="id3B4FF0EA" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="postgres" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5432" dst_range_end="5432"/>
|
|
<TCPService id="id3AECF782" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="printer" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="515" dst_range_end="515"/>
|
|
<TCPService id="id3B4FEF7C" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="quake" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="26000" dst_range_end="26000"/>
|
|
<TCPService id="id3AECF77A" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rexec" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="512" dst_range_end="512"/>
|
|
<TCPService id="id3AECF77C" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rlogin" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="513" dst_range_end="513"/>
|
|
<TCPService id="id3AECF77E" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rshell" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="514" dst_range_end="514"/>
|
|
<TCPService id="id3D703C99" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rtsp" comment="Real Time Streaming Protocol" ro="False" src_range_start="0" src_range_end="0" dst_range_start="554" dst_range_end="554"/>
|
|
<TCPService id="id3B4FEF34" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rwhois" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="4321" dst_range_end="4321"/>
|
|
<TCPService id="id3D703C89" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="securidprop" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5510" dst_range_end="5510"/>
|
|
<TCPService id="tcp-SMTP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="smtp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="25" dst_range_end="25"/>
|
|
<TCPService id="id3B4FF04C" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="smtps" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="465" dst_range_end="465"/>
|
|
<TCPService id="id3B4FEE76" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="socks" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1080" dst_range_end="1080"/>
|
|
<TCPService id="id3D703C87" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="sqlnet1" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1521" dst_range_end="1521"/>
|
|
<TCPService id="id3B4FF09A" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="squid" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3128" dst_range_end="3128"/>
|
|
<TCPService id="tcp-SSH" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ssh" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="22" dst_range_end="22"/>
|
|
<TCPService id="id3AEDBE00" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="sunrpc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="111" dst_range_end="111"/>
|
|
<TCPService id="tcp-TCP-SYN" ack_flag="False" ack_flag_mask="True" fin_flag="False" fin_flag_mask="True" psh_flag="False" psh_flag_mask="True" rst_flag="False" rst_flag_mask="True" syn_flag="True" syn_flag_mask="True" urg_flag="False" urg_flag_mask="True" name="tcp-syn" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
|
|
<TCPService id="tcp-Telnet" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="telnet" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="23" dst_range_end="23"/>
|
|
<TCPService id="tcp-uucp" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="uucp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="540" dst_range_end="540"/>
|
|
<TCPService id="id3CB131C6" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="winterm" comment="Windows Terminal Services" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3389" dst_range_end="3389"/>
|
|
<TCPService id="id3B4FF1B8" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="xfs" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="7100" dst_range_end="7100"/>
|
|
<TCPService id="id3C685B2B" ack_flag="True" ack_flag_mask="True" fin_flag="True" fin_flag_mask="True" psh_flag="True" psh_flag_mask="True" rst_flag="True" rst_flag_mask="True" syn_flag="True" syn_flag_mask="True" urg_flag="True" urg_flag_mask="True" name="xmas scan - full" comment="This service object matches TCP packet with all six flags set." ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
|
|
<TCPService id="id4127E949" ack_flag="False" ack_flag_mask="True" fin_flag="True" fin_flag_mask="True" psh_flag="True" psh_flag_mask="True" rst_flag="False" rst_flag_mask="True" syn_flag="False" syn_flag_mask="True" urg_flag="True" urg_flag_mask="True" name="xmas scan" comment="This service object matches TCP packet with flags FIN, PSH and URG set and other flags cleared. This is a "christmas scan" as defined in snort rules. Nmap can generate this scan, too." ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
|
|
<TCPService id="id4127EA72" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rsync" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="873" dst_range_end="873"/>
|
|
<TCPService id="id4127EBAC" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="distcc" comment="distributed compiler" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3632" dst_range_end="3632"/>
|
|
<TCPService id="id4127ECF1" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="cvspserver" comment="CVS client/server operations" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2401" dst_range_end="2401"/>
|
|
<TCPService id="id4127ECF2" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="cvsup" comment="CVSup file transfer/John Polstra/FreeBSD" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5999" dst_range_end="5999"/>
|
|
<TCPService id="id4127ED5E" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="afp" comment="AFP (Apple file sharing) over TCP" ro="False" src_range_start="0" src_range_end="0" dst_range_start="548" dst_range_end="548"/>
|
|
<TCPService id="id4127EDF6" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="whois" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="43" dst_range_end="43"/>
|
|
<TCPService id="id4127F04F" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="bgp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="179" dst_range_end="179"/>
|
|
<TCPService id="id4127F146" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="radius" comment="Radius protocol" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1812" dst_range_end="1812"/>
|
|
<TCPService id="id4127F147" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="radius acct" comment="Radius Accounting" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1813" dst_range_end="1813"/>
|
|
<TCPService id="id41291784" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="upnp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5000" dst_range_end="5000"/>
|
|
<TCPService id="id41291785" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="upnp-5431" comment="Although UPnP specification say it should use TCP port 5000, Linksys running Sveasoft firmware listens on port 5431" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5431" dst_range_end="5431"/>
|
|
<TCPService id="id41291787" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="vnc-java-0" comment="Java VNC viewer, display 0" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5800" dst_range_end="5800"/>
|
|
<TCPService id="id41291788" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="vnc-0" comment="Regular VNC viewer, display 0" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5900" dst_range_end="5900"/>
|
|
<TCPService id="id41291887" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="vnc-java-1" comment="Java VNC viewer, display 1" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5801" dst_range_end="5801"/>
|
|
<TCPService id="id41291888" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="vnc-1" comment="Regular VNC viewer, display 1" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5901" dst_range_end="5901"/>
|
|
<TCPService id="id463FE5FE11008" ack_flag="False" ack_flag_mask="False" established="True" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="All TCP established" comment="Some firewall platforms can match TCP packets with flags ACK or RST set; the option is usually called "established". Note that you can use this object only in the policy rules of the firewall that supports this option. If you need to match reply packets for a specific TCP service and wish to use option "established", make a copy of this object and set source port range to match the service. " ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
|
|
<TCPService id="id1577X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rtmp" comment="Real Time Messaging Protocol" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1935" dst_range_end="1935"/>
|
|
<TCPService id="id1590X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="xmpp-client" comment="Extensible Messaging and Presence Protocol (XMPP) RFC3920 " ro="False" src_range_start="0" src_range_end="0" dst_range_start="5222" dst_range_end="5222"/>
|
|
<TCPService id="id1609X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="xmpp-server" comment="Extensible Messaging and Presence Protocol (XMPP) RFC3920 " ro="False" src_range_start="0" src_range_end="0" dst_range_start="5269" dst_range_end="5269"/>
|
|
<TCPService id="id1622X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="xmpp-client-ssl" comment="Extensible Messaging and Presence Protocol (XMPP) RFC3920 " ro="False" src_range_start="0" src_range_end="0" dst_range_start="5223" dst_range_end="5223"/>
|
|
<TCPService id="id1631X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="xmpp-server-ssl" comment="Extensible Messaging and Presence Protocol (XMPP) RFC3920 " ro="False" src_range_start="0" src_range_end="0" dst_range_start="5270" dst_range_end="5270"/>
|
|
<TCPService id="id1644X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="nrpe" comment="NRPE add-on for Nagios http://www.nagios.org/ " ro="False" src_range_start="0" src_range_end="0" dst_range_start="5666" dst_range_end="5666"/>
|
|
</ServiceGroup>
|
|
<ServiceGroup id="stdid08" name="UDP" comment="" ro="False">
|
|
<UDPService id="udp-ALL_UDP_Masqueraded" name="ALL UDP Masqueraded" comment="ipchains used to use this port range for masqueraded packets" ro="False" src_range_start="61000" src_range_end="65095" dst_range_start="0" dst_range_end="0"/>
|
|
<UDPService id="udp-All_UDP" name="All UDP" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
|
|
<UDPService id="id3D703C96" name="ICQ" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="4000" dst_range_end="4000"/>
|
|
<UDPService id="id3CB129D2" name="IKE" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="500" dst_range_end="500"/>
|
|
<UDPService id="id3CB131CA" name="PCAnywhere-status" comment="status channel for PCAnywhere v7.52 and later" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5632" dst_range_end="5632"/>
|
|
<UDPService id="id3AED0D6B" name="RIP" comment="routing protocol RIP" ro="False" src_range_start="0" src_range_end="0" dst_range_start="520" dst_range_end="520"/>
|
|
<UDPService id="id3D703C8C" name="Radius" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1645" dst_range_end="1645"/>
|
|
<UDPService id="id3D703C85" name="UDP high ports" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1024" dst_range_end="65535"/>
|
|
<UDPService id="id3D703C86" name="Who" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="513" dst_range_end="513"/>
|
|
<UDPService id="id3B4FEDA1" name="afs" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="7000" dst_range_end="7009"/>
|
|
<UDPService id="udp-bootpc" name="bootpc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="68" dst_range_end="68"/>
|
|
<UDPService id="udp-bootps" name="bootps" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="67" dst_range_end="67"/>
|
|
<UDPService id="id3AEDBE70" name="daytime" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="13" dst_range_end="13"/>
|
|
<UDPService id="udp-DNS" name="domain" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="53" dst_range_end="53"/>
|
|
<UDPService id="id3D703C8A" name="interphone" comment="VocalTec Internet Phone" ro="False" src_range_start="0" src_range_end="0" dst_range_start="22555" dst_range_end="22555"/>
|
|
<UDPService id="id3B4FEDA5" name="kerberos" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="88" dst_range_end="88"/>
|
|
<UDPService id="id3B4FEDA9" name="kerberos-adm" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="749" dst_range_end="750"/>
|
|
<UDPService id="id3B4FEDA7" name="kpasswd" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="464" dst_range_end="464"/>
|
|
<UDPService id="id3B4FEDAB" name="krb524" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="4444" dst_range_end="4444"/>
|
|
<UDPService id="id3F865B0D" name="microsoft-rpc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="135" dst_range_end="135"/>
|
|
<UDPService id="udp-netbios-dgm" name="netbios-dgm" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="138" dst_range_end="138"/>
|
|
<UDPService id="udp-netbios-ns" name="netbios-ns" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="137" dst_range_end="137"/>
|
|
<UDPService id="udp-netbios-ssn" name="netbios-ssn" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="139" dst_range_end="139"/>
|
|
<UDPService id="id3B4FEE78" name="nfs" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2049" dst_range_end="2049"/>
|
|
<UDPService id="udp-ntp" name="ntp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="123" dst_range_end="123"/>
|
|
<UDPService id="id3B4FEF7E" name="quake" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="26000" dst_range_end="26000"/>
|
|
<UDPService id="id3D703C88" name="secureid-udp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1024" dst_range_end="1024"/>
|
|
<UDPService id="udp-SNMP" name="snmp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="161" dst_range_end="161"/>
|
|
<UDPService id="id3AED0D69" name="snmp-trap" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="162" dst_range_end="162"/>
|
|
<UDPService id="id3AEDBE19" name="sunrpc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="111" dst_range_end="111"/>
|
|
<UDPService id="id3AECF780" name="syslog" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="514" dst_range_end="514"/>
|
|
<UDPService id="id3AED0D67" name="tftp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="69" dst_range_end="69"/>
|
|
<UDPService id="id3AED0D8C" name="traceroute" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="33434" dst_range_end="33524"/>
|
|
<UDPService id="id4127EA73" name="rsync" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="873" dst_range_end="873"/>
|
|
<UDPService id="id41291783" name="SSDP" comment="Simple Service Discovery Protocol (used for UPnP)" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1900" dst_range_end="1900"/>
|
|
<UDPService id="id41291883" name="OpenVPN" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1194" dst_range_end="1194"/>
|
|
</ServiceGroup>
|
|
<ServiceGroup id="stdid13" name="Custom" comment="" ro="False">
|
|
<CustomService id="id3B64EEA8" name="rpc" comment="works in iptables and requires patch-o-matic. For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
|
|
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="ipf"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="ipfw"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="iptables">-m record_rpc</CustomServiceCommand>
|
|
<CustomServiceCommand platform="pf"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="pix"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="unknown"></CustomServiceCommand>
|
|
</CustomService>
|
|
<CustomService id="id3B64EF4E" name="irc-conn" comment="IRC connection tracker, supports DCC. Works on iptables and requires patch-o-matic. For more information look for patch-o-matic on http://www.netfilter.org/ " ro="False" protocol="any" address_family="ipv4">
|
|
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="ipf"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="ipfw"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="iptables">-m irc</CustomServiceCommand>
|
|
<CustomServiceCommand platform="pf"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="pix"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="unknown"></CustomServiceCommand>
|
|
</CustomService>
|
|
<CustomService id="id3B64EF50" name="psd" comment="Port scan detector, works only on iptables and requires patch-o-matic For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
|
|
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="ipf"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="ipfw"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="iptables">-m psd --psd-weight-threshold 5 --psd-delay-threshold 10000</CustomServiceCommand>
|
|
<CustomServiceCommand platform="pf"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="pix"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="unknown"></CustomServiceCommand>
|
|
</CustomService>
|
|
<CustomService id="id3B64EF52" name="string" comment="Matches a string in a whole packet, works in iptables and requires patch-o-matic. For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
|
|
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="ipf"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="ipfw"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="iptables">-m string --string test_pattern</CustomServiceCommand>
|
|
<CustomServiceCommand platform="pf"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="pix"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="unknown"></CustomServiceCommand>
|
|
</CustomService>
|
|
<CustomService id="id3B64EF54" name="talk" comment="Talk protocol support. Works in iptables and requires patch-o-matic. For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
|
|
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="ipf"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="ipfw"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="iptables">-m talk</CustomServiceCommand>
|
|
<CustomServiceCommand platform="pf"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="pix"></CustomServiceCommand>
|
|
<CustomServiceCommand platform="unknown"></CustomServiceCommand>
|
|
</CustomService>
|
|
</ServiceGroup>
|
|
<ServiceGroup id="stdid19" name="TagServices" comment="" ro="False"/>
|
|
<ServiceGroup id="stdid20" name="UserServices" comment="" ro="False"/>
|
|
</ServiceGroup>
|
|
<ObjectGroup id="stdid12" name="Firewalls" comment="" ro="False"/>
|
|
<ObjectGroup id="stdid21" name="Clusters" comment="" ro="False"/>
|
|
<IntervalGroup id="stdid11" name="Time" comment="" ro="False">
|
|
<Interval id="int-workhours" days_of_week="1,2,3,4,5" from_day="-1" from_hour="9" from_minute="0" from_month="-1" from_weekday="1" from_year="-1" to_day="-1" to_hour="17" to_minute="0" to_month="-1" to_weekday="5" to_year="-1" name="workhours" comment="any day, 9:00am through 5:00pm" ro="False"/>
|
|
<Interval id="int-weekends" days_of_week="6,0" from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="6" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="0" to_year="-1" name="weekends" comment="weekends: Saturday 0:00 through Sunday 23:59 " ro="False"/>
|
|
<Interval id="int-afterhours" days_of_week="0,1,2,3,4,5,6" from_day="-1" from_hour="18" from_minute="0" from_month="-1" from_weekday="-1" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="-1" to_year="-1" name="afterhours" comment="any day 6:00pm - 12:00am" ro="False"/>
|
|
<Interval id="id3C63479C" days_of_week="6" from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="6" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="6" to_year="-1" name="Sat" comment="" ro="False"/>
|
|
<Interval id="id3C63479E" days_of_week="0" from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="0" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="0" to_year="-1" name="Sun" comment="" ro="False"/>
|
|
</IntervalGroup>
|
|
<ObjectGroup id="stdid01_clusters" name="Clusters" comment="" ro="False"/>
|
|
</Library>
|
|
<Library id="sysid99" name="Deleted Objects" comment="" ro="False">
|
|
<Interface id="id47DFE59A1934" dedicated_failover="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="New Interface" comment="" ro="False"/>
|
|
<ObjectGroup id="id47DFE8B01934" name="IG Monitor" comment="" ro="False"/>
|
|
<IPv4 id="id47E28F8F27246" name="New Address" comment="" ro="False" address="0.0.0.0" netmask="0.0.0.0"/>
|
|
<Interface id="id47E28F9027246" dedicated_failover="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="New Interface" comment="" ro="False"/>
|
|
<IPv4 id="id47DFE57C1934" name="probe:eth0:ip" comment="" ro="False" address="192.168.1.10" netmask="255.255.255.240"/>
|
|
<TCPService id="id47E2913F27246" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="billingListener-1" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5502" dst_range_end="5502"/>
|
|
<ObjectGroup id="id47E2913E27246" name="billing" comment="" ro="False"/>
|
|
<IPv4 id="id47E2901827246" name="probe:eth0:ip" comment="" ro="False" address="192.168.0.0" netmask="255.255.0.0"/>
|
|
<Interface id="id47E2BAED28332" dedicated_failover="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="eth1" comment="" ro="False"/>
|
|
<Interface id="id47E2CD5D28713" dedicated_failover="False" dyn="True" label="eth4" mgmt="False" security_level="0" unnum="False" unprotected="False" name="eth4" comment="" ro="False"/>
|
|
<Interface id="id47E2CD5E28713" dedicated_failover="False" dyn="True" label="eth5" mgmt="False" security_level="0" unnum="False" unprotected="False" name="eth5" comment="" ro="False"/>
|
|
<AddressRange id="id47E2DC8128713" name="New Address Range" comment="" ro="False" start_address="0.0.0.0" end_address="0.0.0.0"/>
|
|
<Interface id="id47E2CD5B28713" dedicated_failover="False" dyn="True" label="eth2" mgmt="False" security_level="0" unnum="False" unprotected="False" name="eth2" comment="" ro="False"/>
|
|
<Interface id="id47E2CD5C28713" dedicated_failover="False" dyn="True" label="eth3" mgmt="False" security_level="0" unnum="False" unprotected="False" name="eth3" comment="" ro="False"/>
|
|
<AddressTable id="id480E63749882" filename="" run_time="False" name="New Address Table" comment="" ro="False"/>
|
|
<AddressRange id="id480E63759882" name="New Address Range" comment="" ro="False" start_address="0.0.0.0" end_address="0.0.0.0"/>
|
|
<Firewall id="id480E63769882" host_OS="linux24" inactive="False" lastCompiled="1209410638" lastInstalled="0" lastModified="1209410906" platform="iptables" version="" name="listener-2P-default-test" comment="" ro="False">
|
|
<NAT id="id480E63E09882" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id480E637C9882" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id480E637D9882" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480E63899882" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480E63959882" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480E63A59882" disabled="False" group="" log="False" position="3" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="tcp-SMTP"/>
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="udp-ntp"/>
|
|
<ServiceRef ref="id3F530CC8"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480E63C89882" disabled="False" group="" log="False" position="4" action="Deny" direction="Inbound" comment="Ignore multicast traffic">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480E63D49882" disabled="False" group="" log="True" position="5" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id480E63E19882" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id480E63E29882" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False"/>
|
|
<Interface id="id480E63E39882" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id480E63E59882" name="listener-2P-default-test:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
</Interface>
|
|
<Interface id="id480E63E69882" dedicated_failover="False" dyn="False" label="eth1" mgmt="False" security_level="100" unnum="True" unprotected="False" name="eth1" comment="" ro="False"/>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id48051C3C8981" host_OS="linux24" inactive="False" lastCompiled="1208356334" lastInstalled="0" lastModified="1209412345" platform="iptables" version="" name="probe-4P-ftp-billing" comment="" ro="False">
|
|
<NAT id="id48051CB98981" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id48051C428981" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id48051C438981" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id48051C4F8981" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id48051C5B8981" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id48051C678981" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
<ServiceRef ref="id47E2913D27246"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id48051C7A8981" disabled="False" group="" log="False" position="4" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id48051CA18981" disabled="False" group="" log="False" position="5" action="Deny" direction="Inbound" comment="Ignore chatty windoze">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id48051CAD8981" disabled="False" group="" log="True" position="6" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id48051CBA8981" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id48051CBB8981" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False"/>
|
|
<Interface id="id48051CBC8981" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id48051CBE8981" name="probe-4P-ftp-billing:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
</Interface>
|
|
<Interface id="id48051CBF8981" dedicated_failover="False" dyn="True" label="eth1" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth1" comment="" ro="False"/>
|
|
<Interface id="id48051CC08981" dedicated_failover="False" dyn="True" label="eth2" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth2" comment="" ro="False"/>
|
|
<Interface id="id48051CC18981" dedicated_failover="False" dyn="True" label="eth3" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth3" comment="" ro="False"/>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Interface id="id480F00EA9882" dedicated_failover="False" dyn="True" label="eth2" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth2" comment="" ro="False"/>
|
|
<Interface id="id480F00EB9882" dedicated_failover="False" dyn="True" label="eth3" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth3" comment="" ro="False"/>
|
|
<Firewall id="id480EB9C79882" host_OS="linux24" inactive="False" lastCompiled="1211558434" lastInstalled="0" lastModified="1211564146" platform="iptables" version="" name="iprobe002-pangaea" comment="" ro="False">
|
|
<NAT id="id480EBA319882" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id480EB9CD9882" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id480EB9CE9882" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480EB9DA9882" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480EB9E69882" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="Allow services in eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480EF0C19882" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480EC2139882" disabled="False" group="" log="False" position="4" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480EBA259882" disabled="False" group="" log="True" position="5" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id480EBA329882" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id480EBA339882" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False"/>
|
|
<Interface id="id480EBA349882" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id480EBA369882" name="iprobe002-pangaea:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
</Interface>
|
|
<Interface id="id480EBA379882" dedicated_failover="False" dyn="True" label="eth1" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth1" comment="" ro="False"/>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<TCPService id="id487E85368872" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="New TCP Service-1" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
|
|
<Firewall id="id48051CC78981" host_OS="linux24" inactive="False" lastCompiled="1216906958" lastInstalled="0" lastModified="1224613475" platform="iptables" version="" name="probe-4P-ftp" comment="" ro="False">
|
|
<NAT id="id48051D448981" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id48051CCD8981" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id48051CCE8981" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id48051CDA8981" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id48051CE68981" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id48051CF28981" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id48051D058981" disabled="False" group="" log="False" position="4" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id48051D2C8981" disabled="False" group="" log="False" position="5" action="Deny" direction="Inbound" comment="Ignore chatty windoze">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480E93DF9882" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore Multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id48051D388981" disabled="False" group="" log="True" position="7" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id48051D458981" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id48051D468981" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False"/>
|
|
<Interface id="id48051D478981" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id48051D498981" name="probe-4P-ftp:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
</Interface>
|
|
<Interface id="id48051D4A8981" dedicated_failover="False" dyn="True" label="eth1" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth1" comment="" ro="False"/>
|
|
<Interface id="id48051D4B8981" dedicated_failover="False" dyn="True" label="eth2" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth2" comment="" ro="False"/>
|
|
<Interface id="id48051D4C8981" dedicated_failover="False" dyn="True" label="eth3" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth3" comment="" ro="False"/>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id4805168E8981" host_OS="linux24" inactive="False" lastCompiled="1216906956" lastInstalled="0" lastModified="1224614387" platform="iptables" version="" name="probe-4P-billing" comment="" ro="False">
|
|
<NAT id="id4805170B8981" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id480516948981" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id480516958981" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480516A18981" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480516AD8981" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480516B98981" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
<ServiceRef ref="id47E2913D27246"/>
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480516CC8981" disabled="False" group="" log="False" position="4" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480516F38981" disabled="False" group="" log="False" position="5" action="Deny" direction="Inbound" comment="Ignore chatty windoze">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480E8DA19882" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore Multicasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480516FF8981" disabled="False" group="" log="True" position="7" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id4805170C8981" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id4805170D8981" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False"/>
|
|
<Interface id="id4805170E8981" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id480517108981" name="probe-4P-billing:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
</Interface>
|
|
<Interface id="id480517118981" dedicated_failover="False" dyn="True" label="eth1" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth1" comment="" ro="False"/>
|
|
<Interface id="id480517128981" dedicated_failover="False" dyn="True" label="eth2" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth2" comment="" ro="False"/>
|
|
<Interface id="id480517138981" dedicated_failover="False" dyn="True" label="eth3" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth3" comment="" ro="False"/>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id48FE35F4602" host_OS="linux24" inactive="False" lastCompiled="1224512312" lastInstalled="0" lastModified="1224614396" platform="iptables" version="" name="probe-4P-default-1" comment="" ro="False">
|
|
<NAT id="id48FE3684602" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id48FE35FA602" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id48FE35FB602" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id48FE3607602" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id48FE3613602" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id48FE3621602" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
<ServiceRef ref="id47E2913D27246"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id48FE3634602" disabled="False" group="" log="False" position="4" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id48FE3643602" disabled="False" group="" log="True" position="5" action="Accept" direction="Both" comment="Let the DNCS talk">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id48FCA47321983"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id48FE3650602" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id48FE365C602" disabled="False" group="" log="False" position="7" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id48FE366C602" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id48FE3678602" disabled="False" group="" log="True" position="9" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id48FE3685602" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id48FE3686602" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False"/>
|
|
<Interface id="id48FE3687602" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id48FE3689602" name="probe-4P-default-1:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
</Interface>
|
|
<Interface id="id48FE368A602" dedicated_failover="False" dyn="True" label="eth1" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth1" comment="" ro="False"/>
|
|
<Interface id="id48FE368B602" dedicated_failover="False" dyn="True" label="eth2" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth2" comment="" ro="False"/>
|
|
<Interface id="id48FE368C602" dedicated_failover="False" dyn="True" label="eth3" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth3" comment="" ro="False"/>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id4852940A1213" host_OS="linux24" inactive="False" lastCompiled="1216838315" lastInstalled="0" lastModified="1224615923" platform="iptables" version="" name="server-2P-brain" comment="" ro="False">
|
|
<NAT id="id485294631213" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id485294101213" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id485294111213" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id4852941D1213" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id485294291213" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id485294391213" disabled="False" group="" log="False" position="3" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="tcp-SMTP"/>
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="udp-ntp"/>
|
|
<ServiceRef ref="id3F530CC8"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id485317D81213"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="id486B9DAD32621"/>
|
|
<ServiceRef ref="id3AECF778"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id486B8D4032621" disabled="False" group="" log="False" position="4" action="Deny" direction="Inbound" comment="netapp spits this stuff out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id4852944B1213" disabled="False" group="" log="False" position="5" action="Deny" direction="Inbound" comment="Ignore multicast traffic">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id485294571213" disabled="False" group="" log="True" position="6" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id485294641213" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id485294651213" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False"/>
|
|
<Interface id="id485294661213" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id485294681213" name="server-2P-brain:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
</Interface>
|
|
<Interface id="id485294691213" dedicated_failover="False" dyn="False" label="eth1" mgmt="False" security_level="100" unnum="True" unprotected="False" name="eth1" comment="" ro="False"/>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id4852DCBD1213" host_OS="linux24" inactive="False" lastCompiled="1216906959" lastInstalled="0" lastModified="1224615941" platform="iptables" version="" name="probe-4P-iprobe001" comment="" ro="False">
|
|
<NAT id="id4852DD331213" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id4852DCC31213" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id4852DCC41213" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id4852DCD01213" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id4852DCDC1213" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id4852DCEA1213" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id4852DCFD1213" disabled="False" group="" log="False" position="4" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id4852DD0B1213" disabled="False" group="" log="False" position="5" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id4852DD1B1213" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id4852DD271213" disabled="False" group="" log="True" position="7" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id4852DD341213" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id4852DD351213" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False"/>
|
|
<Interface id="id4852DD361213" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id4852DD381213" name="probe-4P-iprobe001:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
</Interface>
|
|
<Interface id="id4852DD391213" dedicated_failover="False" dyn="True" label="eth1" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth1" comment="" ro="False"/>
|
|
<Interface id="id4852DD3A1213" dedicated_failover="False" dyn="True" label="eth2" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth2" comment="" ro="False"/>
|
|
<Interface id="id4852DD3B1213" dedicated_failover="False" dyn="True" label="eth3" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth3" comment="" ro="False"/>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<AddressTable id="id49D4C8E726647" filename="" run_time="False" name="New Address Table" comment="" ro="False"/>
|
|
<Host id="id49D4C8E926647" name="dncs" comment="" ro="False">
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<HostOptions/>
|
|
</Host>
|
|
<Interface id="id7477X13908" dedicated_failover="False" dyn="True" label="eth1-vlan1569" mgmt="False" security_level="100" unnum="False" unprotected="False" name="vlan1569" comment="" ro="False"/>
|
|
<Interface id="id7062X11714" dedicated_failover="False" dyn="True" label="eth3" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth3" comment="" ro="False"/>
|
|
<Interface id="id7061X11714" dedicated_failover="False" dyn="True" label="eth2" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth2" comment="" ro="False"/>
|
|
<Interface id="id7060X11714" dedicated_failover="False" dyn="True" label="eth1" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth1" comment="" ro="False"/>
|
|
<Interface id="id7403X29410" dedicated_failover="False" dyn="True" label="eth2" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth2" comment="" ro="False"/>
|
|
<Interface id="id7404X29410" dedicated_failover="False" dyn="True" label="eth3" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth3" comment="" ro="False"/>
|
|
<AddressTable id="id14811X21016" filename="" run_time="False" name="New Address Table" comment="" ro="False"/>
|
|
<AddressTable id="id94519X21016" filename="" run_time="False" name="New Address Table" comment="" ro="False"/>
|
|
<IPService id="id48FCA47221983" protocol_num="" name="New IP Service" comment="" ro="False"/>
|
|
<Firewall id="id8571X28505" host_OS="linux24" inactive="False" lastCompiled="0" lastInstalled="0" lastModified="1271096876" platform="iptables" version="" name="probe-1P-DS-TEST" comment="" ro="False">
|
|
<NAT id="id8688X28505" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id8577X28505" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id8578X28505" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id8590X28505" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id8602X28505" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id24376X21016"/>
|
|
<ObjectRef ref="id11245X6767"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id8621X28505" disabled="False" group="" log="False" position="3" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id8636X28505" disabled="False" group="" log="False" position="4" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id8648X28505" disabled="False" group="" log="False" position="5" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id8664X28505" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id8676X28505" disabled="False" group="" log="True" position="7" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id8689X28505" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id8690X28505" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False"/>
|
|
<Interface id="id8691X28505" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id8693X28505" name="probe-1P-DS-TEST:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id8704X28505" host_OS="linux24" inactive="False" lastCompiled="1271096992" lastInstalled="0" lastModified="1271097202" platform="iptables" version="" name="probe-1P-DS-TEST" comment="" ro="False">
|
|
<NAT id="id8832X28505" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id8710X28505" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id8711X28505" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id8723X28505" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id8735X28505" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id8747X28505" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id11245X6767"/>
|
|
<ObjectRef ref="id24376X21016"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id8765X28505" disabled="False" group="" log="False" position="4" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id8780X28505" disabled="False" group="" log="False" position="5" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id8792X28505" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id8808X28505" disabled="False" group="" log="False" position="7" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id8820X28505" disabled="False" group="" log="True" position="8" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id8833X28505" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id8834X28505" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False"/>
|
|
<Interface id="id8835X28505" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id8837X28505" name="probe-1P-DS-TEST:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Interface id="id10804X4966" dedicated_failover="False" dyn="True" label="eth3" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth3" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id10801X4966" dedicated_failover="False" dyn="True" label="eth2" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth2" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id11128X1243" dedicated_failover="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="Interface" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<AddressTable id="id11568X1243" filename="" run_time="False" name="Address Table" comment="" ro="False"/>
|
|
<Network id="id13111X2193" name="schol-192.168.2" comment="" ro="False" address="192.168.2.0" netmask="255.255.255.0"/>
|
|
<Network id="id12441X13976" name="schol-192.168.10" comment="" ro="False" address="192.168.10.0" netmask="255.255.255.0"/>
|
|
<Network id="id13039X31664" name="schol-172.16.2" comment="" ro="False" address="172.16.2.0" netmask="255.255.255.0"/>
|
|
<Interface id="id18577X21207" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id18585X21207" dedicated_failover="False" dyn="True" label="eth1" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth1" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id18588X21207" dedicated_failover="False" dyn="True" label="eth2" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth2" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id18591X21207" dedicated_failover="False" dyn="True" label="eth3" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth3" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id21486X12596" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p1" comment="eth2" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id21489X12596" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p2" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id23730X12596" dedicated_failover="False" dyn="False" label="" security_level="0" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Host id="id23728X12596" name="mbeam" comment="" ro="False">
|
|
<Interface id="id23821X12596" dedicated_failover="False" dyn="False" label="" security_level="0" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<HostOptions/>
|
|
</Host>
|
|
<UDPService id="id23618X9161" name="UDP High Ports dst" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
|
|
<Firewall id="id23425X12651" host_OS="linux24" inactive="False" lastCompiled="1335380907" lastInstalled="0" lastModified="1339177674" platform="iptables" version="" name="probe-4P-em-144" comment="" ro="False">
|
|
<NAT id="id23808X12651" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id23450X12651" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id23452X12651" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id23480X12651" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id23508X12651" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id13034X25856"/>
|
|
<ServiceRef ref="sg-DHCP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id23540X12651" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id23575X12651" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow ftp">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id23604X12651" disabled="False" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Allow billingListener">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E2913D27246"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id23632X12651" disabled="False" group="" log="False" position="6" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
<ServiceRef ref="id23850X12651"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id23663X12651" disabled="False" group="" log="False" position="7" action="Accept" direction="Both" comment="Let the DNCS talk">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id49D4C8EC26647"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id23691X12651" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id23719X12651" disabled="False" group="" log="False" position="9" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id23751X12651" disabled="False" group="" log="False" position="10" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id23779X12651" disabled="False" group="" log="True" position="11" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id23811X12651" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id23433X12651" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id23436X12651" name="probe-4P-em-144:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id23438X12651" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em1" comment="eth0" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id23441X12651" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em2" comment="eth1" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id23444X12651" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p1" comment="eth2" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id23447X12651" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p2" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<AddressRange id="id24378X9674" name="Address Range" comment="" ro="False" start_address="0.0.0.0" end_address="0.0.0.0"/>
|
|
<Interface id="id25667X22214" dedicated_failover="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="bond1" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id25711X22214" dedicated_failover="False" dyn="False" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="bond1" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Firewall id="id25050X22214" host_OS="linux24" inactive="False" lastCompiled="1323976160" lastInstalled="0" lastModified="1362427944" platform="iptables" version="" name="probe-4P-160" comment="" ro="False">
|
|
<NAT id="id25432X22214" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id25075X22214" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id25435X22214" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id25058X22214" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id25061X22214" name="probe-4P-160:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id25063X22214" dedicated_failover="False" dyn="True" label="eth2" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth2" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id25066X22214" dedicated_failover="False" dyn="True" label="eth3" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth3" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id25069X22214" dedicated_failover="False" dyn="True" label="eth1" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth1" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id25072X22214" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id25525X22214" dedicated_failover="False" dyn="True" label="eth4" mgmt="False" security_level="0" unnum="False" unprotected="False" name="eth4" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id25575X22214" dedicated_failover="False" dyn="True" label="eth5" mgmt="False" security_level="0" unnum="False" unprotected="False" name="eth5" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id25617X22214" dedicated_failover="False" dyn="True" label="bond0" mgmt="False" security_level="0" unnum="False" unprotected="False" name="bond0" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
<Interface id="id25697X22214" dedicated_failover="False" dyn="True" label="bond0.20" mgmt="False" security_level="0" unnum="False" unprotected="False" name="bond0.20" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">8021q</Option>
|
|
<Option name="vlan_id">20</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id25741X22214" dedicated_failover="False" dyn="True" label="bond0.300" mgmt="False" security_level="0" unnum="False" unprotected="False" name="bond0.300" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">8021q</Option>
|
|
<Option name="vlan_id">300</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="add_mgmt_ssh_rule_when_stoped">False</Option>
|
|
<Option name="add_rules_for_ipv6_neighbor_discovery">False</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="clear_unknown_interfaces">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_bonding_interfaces">False</Option>
|
|
<Option name="configure_bridge_interfaces">False</Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="configure_vlan_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script">echo "Checking to see if tunnel needs to be opened up"
|
|
if [ $(iptables -L -n 2>&1 |grep -Ec '^ACCEPT|^DROP|^LOG') -gt 0 ]; then
|
|
echo -n "Firewall looks to be running"
|
|
if ip -o -4 addr |grep -q tun0; then
|
|
echo -n ", found tun0"
|
|
if [ -x /sbin/phoneHome ]; then
|
|
echo ", so running 'phoneHome -O'"
|
|
/sbin/phoneHome -O
|
|
else
|
|
echo ", but no phoneHome found"
|
|
fi
|
|
else
|
|
echo " but no tun0 interface"
|
|
fi
|
|
else
|
|
echo "Firewall not running"
|
|
fi
|
|
</Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="ipv4_6_order">ipv4_first</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="scpArgs"></Option>
|
|
<Option name="script_name_on_firewall"></Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_m_set">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<ObjectGroup id="id27894X19093" name="Object Group" comment="" ro="False"/>
|
|
<Firewall id="id30143X32244" host_OS="linux24" inactive="False" lastCompiled="1422547730" lastInstalled="0" lastModified="1422547719" platform="iptables" version="" name="probe-4P-em-027" comment="" ro="False">
|
|
<NAT id="id30527X32244" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id30168X32244" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id30170X32244" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id30198X32244" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id30226X32244" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id13034X25856"/>
|
|
<ServiceRef ref="sg-DHCP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id30258X32244" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id30350X32244" disabled="False" group="" log="False" position="4" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
<ServiceRef ref="id12009X8217"/>
|
|
<ServiceRef ref="id30713X32244"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id30382X32244" disabled="True" group="" log="False" position="5" action="Accept" direction="Both" comment="Let the DNCS talk">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id49D4C8EC26647"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id30410X32244" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id30438X32244" disabled="False" group="" log="False" position="7" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id30470X32244" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id30498X32244" disabled="False" group="" log="True" position="9" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id30530X32244" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id30151X32244" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id30154X32244" name="probe-4P-em-027:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id30156X32244" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em1" comment="eth0" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id30159X32244" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em2" comment="eth1" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id30162X32244" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p1" comment="eth2" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id30165X32244" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p2" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id31832X2792" host_OS="linux24" inactive="False" lastCompiled="1251311005" lastInstalled="0" lastModified="1423078374" platform="iptables" version="" name="probe-4P-igbr-tun" comment="" ro="False">
|
|
<NAT id="id32249X2792" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id31862X2792" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id31864X2792" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id31892X2792" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id31920X2792" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id31950X2792" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="Remote probe ssh tunnel">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id11245X6767"/>
|
|
<ObjectRef ref="id11253X6767"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id11245X6767"/>
|
|
<ObjectRef ref="id11253X6767"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id31981X2792" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id32016X2792" disabled="True" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Allow ftp">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id32045X2792" disabled="True" group="" log="False" position="6" action="Accept" direction="Inbound" comment="Allow billingListener">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E2913D27246"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id32073X2792" disabled="False" group="" log="False" position="7" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id32104X2792" disabled="False" group="" log="False" position="8" action="Accept" direction="Both" comment="Let the DNCS talk">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id49D4C8EC26647"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id32132X2792" disabled="False" group="" log="False" position="9" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id32160X2792" disabled="False" group="" log="False" position="10" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id32192X2792" disabled="False" group="" log="False" position="11" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id32220X2792" disabled="False" group="" log="True" position="12" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id32252X2792" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id31840X2792" dedicated_failover="False" dyn="True" label="em2" mgmt="False" security_level="100" unnum="False" unprotected="False" name="em2" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id31843X2792" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id31846X2792" name="probe-4P-igbr-tun:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id31848X2792" dedicated_failover="False" dyn="True" label="em1" mgmt="True" security_level="100" unnum="False" unprotected="False" name="em1" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id31851X2792" dedicated_failover="False" dyn="True" label="p1p1" mgmt="False" security_level="100" unnum="False" unprotected="False" name="p1p1" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id31854X2792" dedicated_failover="False" dyn="True" label="p1p2" mgmt="False" security_level="100" unnum="False" unprotected="False" name="p1p2" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id31857X2792" dedicated_failover="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False" name="tun0" comment="" ro="False">
|
|
<IPv4 id="id31860X2792" name="probe-4P-igbr-tun:tun0:ip" comment="" ro="False" address="192.168.184.1" netmask="255.255.255.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Interface id="id32686X2792" dedicated_failover="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="Interface" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id33155X2792" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="igbr2" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Firewall id="id59684X12503" host_OS="linux24" lastCompiled="0" lastInstalled="0" lastModified="0" platform="iptables" name="probe-4P-igbr-198" comment="" ro="False">
|
|
<NAT id="id59688X12503" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id59686X12503" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id59690X12503" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">true</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">true</Option>
|
|
<Option name="check_shading">true</Option>
|
|
<Option name="configure_interfaces">true</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">true</Option>
|
|
<Option name="flush_and_set_default_policy">True</Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_ip_forward">1</Option>
|
|
<Option name="load_modules">true</Option>
|
|
<Option name="local_nat">false</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">RULE %N -- %A </Option>
|
|
<Option name="loopback_interface">lo</Option>
|
|
<Option name="manage_virtual_addr">true</Option>
|
|
<Option name="modules_dir">/lib/modules/`uname -r`/kernel/net/</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="verify_interfaces">true</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id37632X21917" host_OS="linux24" inactive="False" lastCompiled="1339424998" lastInstalled="0" lastModified="1339424931" platform="iptables" version="" name="probe-4P-igbr-1" comment="" ro="False">
|
|
<NAT id="id38020X21917" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id37660X21917" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id37662X21917" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id37690X21917" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id37718X21917" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id13034X25856"/>
|
|
<ServiceRef ref="sg-DHCP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id37751X21917" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id37786X21917" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow ftp">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id37815X21917" disabled="False" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Allow billingListener">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E2913D27246"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id37843X21917" disabled="False" group="" log="False" position="6" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
<ServiceRef ref="id23850X12651"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id37875X21917" disabled="False" group="" log="False" position="7" action="Accept" direction="Both" comment="Let the DNCS talk">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id49D4C8EC26647"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id37903X21917" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id37931X21917" disabled="False" group="" log="False" position="9" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id37963X21917" disabled="False" group="" log="False" position="10" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id37991X21917" disabled="False" group="" log="True" position="11" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id38023X21917" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id37640X21917" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id37643X21917" name="probe-4P-igbr:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id37645X21917" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em1" comment="eth0" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id37648X21917" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em2" comment="eth1" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id37651X21917" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p1" comment="eth2" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id37654X21917" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p2" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id37657X21917" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="igbr1" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id59713X12503" host_OS="linux24" inactive="False" lastCompiled="1469107510" lastInstalled="0" lastModified="1469107504" platform="iptables" version="" name="probe-4P-igbr-198" comment="" ro="False">
|
|
<NAT id="id60101X12503" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id59741X12503" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id59743X12503" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id59771X12503" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id59799X12503" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id13034X25856"/>
|
|
<ServiceRef ref="sg-DHCP"/>
|
|
<ServiceRef ref="id3AECF776"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id59832X12503" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
<ServiceRef ref="tcp-SMTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id59867X12503" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow ftp">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id59896X12503" disabled="False" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Allow billingListener">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E2913D27246"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id59924X12503" disabled="False" group="" log="False" position="6" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
<ServiceRef ref="id23850X12651"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id59956X12503" disabled="False" group="" log="False" position="7" action="Accept" direction="Both" comment="Let the DNCS talk">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id49D4C8EC26647"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id59984X12503" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id60012X12503" disabled="False" group="" log="False" position="9" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id60044X12503" disabled="False" group="" log="False" position="10" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id60072X12503" disabled="False" group="" log="True" position="11" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id60104X12503" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id59721X12503" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id59724X12503" name="probe-4P-igbr-198:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id59726X12503" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em1" comment="eth0" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id59729X12503" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em2" comment="eth1" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id59732X12503" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p1" comment="eth2" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id59735X12503" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p2" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id59738X12503" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="igbr1" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
</Library>
|
|
<Library id="id47DFE1831934" color="#d2ffd0" name="User" comment="" ro="False">
|
|
<ObjectGroup id="id47DFE1841934_clusters" name="Clusters" comment="" ro="False"/>
|
|
<ObjectGroup id="id47DFE1841934" name="Objects" comment="" ro="False">
|
|
<ObjectGroup id="id47DFE1851934" name="Addresses" comment="" ro="False">
|
|
<IPv4 id="id48FCA47321983" name="dncs-10-253-0-1" comment="" ro="False" address="10.253.0.1" netmask="255.255.255.255"/>
|
|
<IPv4 id="id49D4C8E826647" name="dncs-192-168-2-1" comment="" ro="False" address="192.168.2.1" netmask="255.255.255.255"/>
|
|
<IPv4 id="id21203X13908" name="dncs-172-17-16-20" comment="" ro="False" address="172.17.16.20" netmask="0.0.0.0"/>
|
|
<IPv4 id="id8544X28494" name="iprobe092" comment="" ro="False" address="172.17.16.28" netmask="0.0.0.0"/>
|
|
<IPv4 id="id11890X4885" name="dncs-192-168.100.1" comment="" ro="False" address="192.168.100.1" netmask="0.0.0.0"/>
|
|
<IPv4 id="id12001X31433" name="smu-ftp-src" comment="" ro="False" address="66.43.198.86" netmask="0.0.0.0"/>
|
|
<IPv4 id="id13139X31664" name="schol-ftp" comment="old was - 192.168.10.2" ro="False" address="172.16.49.1" netmask="0.0.0.0"/>
|
|
<IPv4 id="id24359X9674" name="amu-billing" comment="" ro="False" address="69.57.22.89" netmask="0.0.0.0"/>
|
|
<IPv4 id="id24668X9674" name="amu-cmts" comment="" ro="False" address="173.215.118.250" netmask="0.0.0.0"/>
|
|
<IPv4 id="id28932X29908" name="twc-ral-pix" comment="" ro="False" address="10.20.192.250" netmask="0.0.0.0"/>
|
|
<IPv4 id="id36425X8920" name="billing-server" comment="" ro="False" address="24.129.208.10" netmask="0.0.0.0"/>
|
|
<IPv4 id="id35775X1817" name="cinbell-DCM7" comment="" ro="False" address="172.17.17.236" netmask="0.0.0.0"/>
|
|
<IPv4 id="id36960X22383" name="spider01a" comment="" ro="False" address="192.168.176.2" netmask="0.0.0.0"/>
|
|
<IPv4 id="id36967X22383" name="spider01b" comment="" ro="False" address="192.168.175.2" netmask="0.0.0.0"/>
|
|
<IPv4 id="id36974X22383" name="spider01o" comment="" ro="False" address="192.168.177.2" netmask="0.0.0.0"/>
|
|
</ObjectGroup>
|
|
<ObjectGroup id="id47DFE1861934" name="DNS Names" comment="" ro="False"/>
|
|
<ObjectGroup id="id47DFE1871934" name="Address Tables" comment="" ro="False"/>
|
|
<ObjectGroup id="id47DFE1881934" name="Groups" comment="" ro="False">
|
|
<ObjectGroup id="id49D4C8EC26647" name="dncs" comment="" ro="False">
|
|
<ObjectRef ref="id48FCA47321983"/>
|
|
<ObjectRef ref="id49D4C8E826647"/>
|
|
</ObjectGroup>
|
|
<ObjectGroup id="id11245X6767" name="iGlass Internal" comment="" ro="False">
|
|
<ObjectRef ref="id11246X6767"/>
|
|
<ObjectRef ref="id11247X6767"/>
|
|
<ObjectRef ref="id11244X6767"/>
|
|
</ObjectGroup>
|
|
<ObjectGroup id="id14813X21016" name="andycable" comment="" ro="False">
|
|
<ObjectRef ref="id14812X21016"/>
|
|
<ObjectRef ref="id113450X21016"/>
|
|
<ObjectRef ref="id32697X13923"/>
|
|
<ObjectRef ref="id32724X13923"/>
|
|
<ObjectRef ref="id36425X8920"/>
|
|
</ObjectGroup>
|
|
<ObjectGroup id="id24376X21016" name="iGlass External" comment="" ro="False">
|
|
<ObjectRef ref="id21186X21016"/>
|
|
<ObjectRef ref="id21185X21016"/>
|
|
<ObjectRef ref="id24375X21016"/>
|
|
<ObjectRef ref="id61499X7114"/>
|
|
</ObjectGroup>
|
|
<ObjectRef ref="id113450X21016"/>
|
|
<ObjectGroup id="id13056X31664" name="schol" comment="" ro="False"/>
|
|
<ObjectGroup id="id24390X9674" name="amu-billing" comment="" ro="False">
|
|
<ObjectRef ref="id24381X9674"/>
|
|
<ObjectRef ref="id24359X9674"/>
|
|
</ObjectGroup>
|
|
<ObjectGroup id="id27919X19093" name="noven-clusters" comment="" ro="False">
|
|
<ObjectRef ref="id27908X19093"/>
|
|
<ObjectRef ref="id27897X19093"/>
|
|
</ObjectGroup>
|
|
<ObjectGroup id="id36985X22383" name="spider01" comment="" ro="False">
|
|
<ObjectRef ref="id36960X22383"/>
|
|
<ObjectRef ref="id36967X22383"/>
|
|
<ObjectRef ref="id36974X22383"/>
|
|
</ObjectGroup>
|
|
</ObjectGroup>
|
|
<ObjectGroup id="id47DFE1891934" name="Hosts" comment="" ro="False">
|
|
<Host id="id11426X1243" name="iprobe002" comment="" ro="False">
|
|
<Interface id="id11428X1243" dedicated_failover="False" dyn="False" label="" security_level="0" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<IPv4 id="id11429X1243" name="iprobe002:eth0:ip" comment="" ro="False" address="192.168.185.113" netmask="255.255.255.240"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<HostOptions/>
|
|
</Host>
|
|
<Host id="id11434X1243" name="iprobe007-wi-tun4" comment="" ro="False">
|
|
<Interface id="id11436X1243" dedicated_failover="False" dyn="False" label="" security_level="0" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<IPv4 id="id11437X1243" name="iprobe007-wi-tun4:eth0:ip" comment="" ro="False" address="192.168.179.1" netmask="255.255.255.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id11438X1243" dedicated_failover="False" dyn="False" label="" security_level="0" unnum="False" unprotected="False" name="tun4" comment="" ro="False">
|
|
<IPv4 id="id11439X1243" name="iprobe007-wi-tun4:tun4:ip" comment="" ro="False" address="192.168.179.115" netmask="255.255.255.255"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<HostOptions>
|
|
<Option name="use_mac_addr_filter">False</Option>
|
|
</HostOptions>
|
|
</Host>
|
|
<Host id="id23352X12596" name="slug" comment="Marc's PC" ro="False">
|
|
<Interface id="id23354X12596" dedicated_failover="False" dyn="False" label="" security_level="0" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<IPv4 id="id23355X12596" name="slug:eth0:ip" comment="" ro="False" address="192.168.174.176" netmask="255.255.255.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<HostOptions>
|
|
<Option name="use_mac_addr_filter">False</Option>
|
|
</HostOptions>
|
|
</Host>
|
|
<Host id="id23831X12596" name="mbeam" comment="" ro="False">
|
|
<Interface id="id23833X12596" dedicated_failover="False" dyn="False" label="" security_level="0" unnum="False" unprotected="False" name="etho" comment="" ro="False">
|
|
<IPv4 id="id23834X12596" name="mbeam:etho:ip" comment="" ro="False" address="192.168.177.59" netmask="255.255.255.0"/>
|
|
<IPv4 id="id23835X12596" name="mbeam:etho:ip" comment="" ro="False" address="192.168.177.58" netmask="255.255.255.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<HostOptions/>
|
|
</Host>
|
|
<Host id="id36359X8920" name="billing-server" comment="This host is used in examples and template objects" ro="False">
|
|
<Interface id="id36361X8920" dedicated_failover="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<IPv4 id="id36362X8920" name="billing-server:eth0:ip" comment="" ro="False" address="192.168.1.10" netmask="255.255.255.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="192.168.1.10">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<HostOptions>
|
|
<Option name="snmp_contact"></Option>
|
|
<Option name="snmp_description"></Option>
|
|
<Option name="snmp_location"></Option>
|
|
<Option name="use_mac_addr">false</Option>
|
|
<Option name="use_mac_addr_filter">False</Option>
|
|
</HostOptions>
|
|
</Host>
|
|
</ObjectGroup>
|
|
<ObjectGroup id="id47DFE18A1934" name="Networks" comment="" ro="False">
|
|
<Network id="id11244X6767" name="Office" comment="" ro="False" address="192.168.177.0" netmask="255.255.255.0"/>
|
|
<Network id="id11246X6767" name="Colo A" comment="" ro="False" address="192.168.176.0" netmask="255.255.255.0"/>
|
|
<Network id="id11247X6767" name="Colo B" comment="" ro="False" address="192.168.175.0" netmask="255.255.255.0"/>
|
|
<Network id="id11253X6767" name="probe" comment="" ro="False" address="192.168.184.0" netmask="255.255.255.240"/>
|
|
<Network id="id113450X21016" name="andycable-cmts-internal" comment="" ro="False" address="192.168.50.0" netmask="255.255.255.0"/>
|
|
<Network id="id11100X4966" name="probe-179" comment="" ro="False" address="192.168.179.0" netmask="255.255.255.0"/>
|
|
<Network id="id11389X1243" name="Colo B - DMZ" comment="" ro="False" address="192.168.185.112" netmask="255.255.255.240"/>
|
|
<Network id="id11270X6398" name="smu-cmts" comment="" ro="False" address="66.43.198.0" netmask="255.255.255.0"/>
|
|
<Network id="id18562X23767" name="192.168.50.0 - ivrnet" comment="" ro="False" address="192.168.50.0" netmask="255.255.255.0"/>
|
|
<Network id="id24381X9674" name="amu-billing" comment="" ro="False" address="209.74.236.0" netmask="255.255.255.0"/>
|
|
<Network id="id27897X19093" name="noven-10.101.210" comment="" ro="False" address="10.101.210.0" netmask="255.255.255.0"/>
|
|
<Network id="id27908X19093" name="noven-10.10.11" comment="" ro="False" address="10.10.11.0" netmask="255.255.255.0"/>
|
|
<Network id="id28894X9776" name="WWE Cluster Network" comment="" ro="False" address="10.10.1.0" netmask="255.255.255.0"/>
|
|
<Network id="id34996X11372" name="10 Network" comment="" ro="False" address="10.0.0.0" netmask="255.0.0.0"/>
|
|
</ObjectGroup>
|
|
<ObjectGroup id="id47DFE18B1934" name="Address Ranges" comment="" ro="False">
|
|
<AddressRange id="id14812X21016" name="andycable-cmts" comment="" ro="False" start_address="64.130.96.1" end_address="64.130.96.30"/>
|
|
<AddressRange id="id21185X21016" name="Colo B External" comment="" ro="False" start_address="216.134.202.52" end_address="216.134.202.62"/>
|
|
<AddressRange id="id21186X21016" name="Colo A External" comment="" ro="False" start_address="70.62.110.170" end_address="70.62.110.174"/>
|
|
<AddressRange id="id24375X21016" name="Office TWC" comment="" ro="False" start_address="70.62.110.169" end_address="70.62.110.174"/>
|
|
<AddressRange id="id32697X13923" name="andycable-cmts-2" comment="Old ip 10.254.0.1" ro="False" start_address="64.130.125.10" end_address="64.130.125.10"/>
|
|
<AddressRange id="id32724X13923" name="andycable-cmts-3" comment="" ro="False" start_address="24.129.208.2" end_address="24.129.208.3"/>
|
|
<AddressRange id="id61499X7114" name="Office Celito" comment="" ro="False" start_address="74.113.229.130" end_address="74.113.229.134"/>
|
|
<AddressRange id="id36249X8626" name="coeo-sbc-core-5210" comment="" ro="False" start_address="10.12.12.39" end_address="10.12.12.41"/>
|
|
</ObjectGroup>
|
|
</ObjectGroup>
|
|
<ServiceGroup id="id47DFE18C1934" name="Services" comment="" ro="False">
|
|
<ServiceGroup id="id47DFE18C1934_userservices" name="Users" comment="" ro="False"/>
|
|
<ServiceGroup id="id47DFE18D1934" name="Groups" comment="" ro="False">
|
|
<ServiceGroup id="id47E2914027246" name="billing" comment="" ro="False">
|
|
<ServiceRef ref="id47E2913D27246"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
</ServiceGroup>
|
|
<ServiceGroup id="id47E2C92728661" name="Useful_ICMP" comment="" ro="False">
|
|
<ServiceRef ref="icmp-Time_exceeded"/>
|
|
<ServiceRef ref="icmp-Time_exceeded_in_transit"/>
|
|
<ServiceRef ref="icmp-ping_reply"/>
|
|
<ServiceRef ref="icmp-Unreachables"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
</ServiceGroup>
|
|
<ServiceGroup id="id485317D81213" name="netapp nfs" comment="netapp nfs stuff" ro="False">
|
|
<ServiceRef ref="id3AEDBE19"/>
|
|
<ServiceRef ref="id3AEDBE00"/>
|
|
<ServiceRef ref="id485337E71213"/>
|
|
<ServiceRef ref="id485347F51213"/>
|
|
<ServiceRef ref="id485347F91213"/>
|
|
<ServiceRef ref="id485347F81213"/>
|
|
<ServiceRef ref="id485347F61213"/>
|
|
<ServiceRef ref="id485347FA1213"/>
|
|
<ServiceRef ref="id485347FB1213"/>
|
|
<ServiceRef ref="id485347F71213"/>
|
|
<ServiceRef ref="id3B4FEE7A"/>
|
|
<ServiceRef ref="id3B4FEE78"/>
|
|
</ServiceGroup>
|
|
<ServiceGroup id="id487E59658872" name="postgres" comment="" ro="False">
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id486B9DAD32621"/>
|
|
</ServiceGroup>
|
|
<ServiceGroup id="id20218X25006" name="mshvlm" comment="Microsoft Hyper-V Live" ro="False">
|
|
<ServiceRef ref="id20187X25006"/>
|
|
<ServiceRef ref="id20134X25006"/>
|
|
</ServiceGroup>
|
|
</ServiceGroup>
|
|
<ServiceGroup id="id47DFE18E1934" name="ICMP" comment="" ro="False"/>
|
|
<ServiceGroup id="id47DFE18F1934" name="IP" comment="" ro="False"/>
|
|
<ServiceGroup id="id47DFE1901934" name="TCP" comment="" ro="False">
|
|
<TCPService id="id47E28F0727246" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="below10k" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1" dst_range_end="9999"/>
|
|
<TCPService id="id47E2913D27246" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="billingListener" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5502" dst_range_end="5502"/>
|
|
<TCPService id="id47E325C828713" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="davicListener" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1306" dst_range_end="1306"/>
|
|
<TCPService id="id48050B3C8981" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="syslogmux" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1207" dst_range_end="1207"/>
|
|
<TCPService id="id480EABB89882" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="NDMP" comment="Network Data Management Protocol" ro="False" src_range_start="0" src_range_end="0" dst_range_start="10000" dst_range_end="10000"/>
|
|
<TCPService id="id480EAF3C9882" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="echo" comment="TCP Ping echo" ro="False" src_range_start="0" src_range_end="0" dst_range_start="7" dst_range_end="7"/>
|
|
<TCPService id="id485299531213" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="Port Forwarding" comment="For Tim's ssh port forwarding" ro="False" src_range_start="0" src_range_end="0" dst_range_start="8001" dst_range_end="8010"/>
|
|
<TCPService id="id485347F51213" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="mountd" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="603" dst_range_end="603"/>
|
|
<TCPService id="id485347F81213" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="status" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="605" dst_range_end="605"/>
|
|
<TCPService id="id485347F91213" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="nlockmgr" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="607" dst_range_end="607"/>
|
|
<TCPService id="id486B9DAD32621" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="postgres-src" comment="Postgres Source Port" ro="False" src_range_start="5432" src_range_end="5432" dst_range_start="0" dst_range_end="0"/>
|
|
<TCPService id="id487E59648872" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="New TCP Service" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
|
|
<TCPService id="id48FCA00F21791" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="port-1022" comment="Needed in rsh to dncs" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1022" dst_range_end="1022"/>
|
|
<TCPService id="id10683X14198" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="WWE jde" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="12001" dst_range_end="12001"/>
|
|
<TCPService id="id10667X20313" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="10k1" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="10001" dst_range_end="10001"/>
|
|
<TCPService id="id12009X8217" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="12000 ping range" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="12000" dst_range_end="12016"/>
|
|
<TCPService id="id13034X25856" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="windows pf" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3389" dst_range_end="3389"/>
|
|
<TCPService id="id20134X25006" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="mshvlm" comment="Microsoft Hyper-V Live " ro="False" src_range_start="0" src_range_end="0" dst_range_start="6600" dst_range_end="6600"/>
|
|
<TCPService id="id21485X19810" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="55883" comment="schol mysql" ro="False" src_range_start="0" src_range_end="0" dst_range_start="55883" dst_range_end="55883"/>
|
|
<TCPService id="id24575X12596" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="mongo" comment="Mongo DB" ro="False" src_range_start="0" src_range_end="0" dst_range_start="27017" dst_range_end="27017"/>
|
|
<TCPService id="id23850X12651" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="sara" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="65434" dst_range_end="65434"/>
|
|
<TCPService id="id25038X9128" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="digi-52407" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="52407"/>
|
|
<TCPService id="id25047X9128" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="digi-50611" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="50611"/>
|
|
<TCPService id="id27270X22214" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="memcached" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="11211" dst_range_end="11211"/>
|
|
<TCPService id="id27123X10319" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="goodman-gnplessbase4" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="19000" dst_range_end="19000"/>
|
|
<TCPService id="id27370X29239" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ifby-10082" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="10082" dst_range_end="10082"/>
|
|
<TCPService id="id28879X4933" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="math-55672" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="55672" dst_range_end="55672"/>
|
|
<TCPService id="id28884X27061" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ifby-55672" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="55672" dst_range_end="55672"/>
|
|
<TCPService id="id28889X18774" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ifby-15672" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="15672" dst_range_end="15672"/>
|
|
<TCPService id="id30138X12637" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tinyproxy" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="8888" dst_range_end="8888"/>
|
|
<TCPService id="id36878X8920" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="nemours-10080" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="10080" dst_range_end="10080"/>
|
|
<TCPService id="id35251X8179" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="TCP 12259" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="12259" dst_range_end="12259"/>
|
|
</ServiceGroup>
|
|
<ServiceGroup id="id47DFE1911934" name="UDP" comment="" ro="False">
|
|
<UDPService id="id47E28F0A27246" name="below10k" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1" dst_range_end="9999"/>
|
|
<UDPService id="id47E3235028713" name="netflow" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="9991" dst_range_end="9991"/>
|
|
<UDPService id="id480E4A4B9882" name="unknwnBroadcast6157" comment="Some unknown broadcast flooding in twc-natl" ro="False" src_range_start="0" src_range_end="0" dst_range_start="6157" dst_range_end="6157"/>
|
|
<UDPService id="id480E5BDA9882" name="x500ms" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5757" dst_range_end="5757"/>
|
|
<UDPService id="id485337E71213" name="PANA Messages" comment="Protocol for Carrying Authentication for Network Access (PANA)" ro="False" src_range_start="0" src_range_end="0" dst_range_start="716" dst_range_end="716"/>
|
|
<UDPService id="id485347F61213" name="mountd" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="602" dst_range_end="602"/>
|
|
<UDPService id="id485347F71213" name="status" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="604" dst_range_end="604"/>
|
|
<UDPService id="id485347FA1213" name="nlockmgr" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="606" dst_range_end="606"/>
|
|
<UDPService id="id485347FB1213" name="rquotad" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="608" dst_range_end="608"/>
|
|
<UDPService id="id487E69D18872" name="snmp-src" comment="" ro="False" src_range_start="161" src_range_end="161" dst_range_start="0" dst_range_end="0"/>
|
|
<UDPService id="id20094X25006" name="ha-cluster" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="694" dst_range_end="694"/>
|
|
<UDPService id="id20187X25006" name="mshvlm" comment="Microsoft Hyper-V Live" ro="False" src_range_start="0" src_range_end="0" dst_range_start="6600" dst_range_end="6600"/>
|
|
<UDPService id="id30713X32244" name="10000 snmp range" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="10000" dst_range_end="10020"/>
|
|
<UDPService id="id33511X6465" name="cpb snmp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="16100" dst_range_end="16100"/>
|
|
<UDPService id="id35290X8179" name="UDP 10009" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="10009" dst_range_end="10009"/>
|
|
</ServiceGroup>
|
|
<ServiceGroup id="id47DFE1921934" name="Custom" comment="" ro="False"/>
|
|
<ServiceGroup id="id47DFE1931934" name="TagServices" comment="" ro="False">
|
|
<TagService id="id24415X12596" tagcode="1" name="rateLimit" comment="" ro="False"/>
|
|
</ServiceGroup>
|
|
</ServiceGroup>
|
|
<ObjectGroup id="id47DFE1941934" name="Firewalls" comment="" ro="False">
|
|
<Firewall id="id47DFE51B1934" host_OS="linux24" inactive="False" lastCompiled="1211564271" lastInstalled="0" lastModified="1211564237" platform="iptables" version="" name="listener-2P-default" comment="" ro="False">
|
|
<NAT id="id47DFE5781934" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id47DFE5211934" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id47DFE52E1934" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id47DFE57D1934"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id47E2C47F28626" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id47DFE51B1934"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id47E2901927246" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id47DFE51B1934"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id47DFE57A1934"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id47DFE8B11934" disabled="False" group="" log="False" position="3" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id47DFE51B1934"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="tcp-SMTP"/>
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="udp-ntp"/>
|
|
<ServiceRef ref="id3F530CC8"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id47DFE57A1934"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id47E2D82128713" disabled="False" group="" log="False" position="4" action="Deny" direction="Inbound" comment="Ignore chatty windoze">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id47DFE51B1934"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480E51B39882" disabled="False" group="" log="False" position="5" action="Deny" direction="Inbound" comment="Ignore multicast traffic">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id47DFE56C1934" disabled="False" group="" log="True" position="6" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id47DFE5791934" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id47DFE57A1934" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id47DFE57D1934" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id47DFE57F1934" name="listener-2P-default:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id47E2CD5A28713" dedicated_failover="False" dyn="False" label="eth1" mgmt="False" security_level="100" unnum="True" unprotected="False" name="eth1" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id4804F7E18981" host_OS="linux24" inactive="False" lastCompiled="1323976160" lastInstalled="0" lastModified="1326824134" platform="iptables" version="" name="probe-4P" comment="" ro="False">
|
|
<NAT id="id4804F85E8981" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id4804F7E78981" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id4804F7E88981" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id4804F8618981"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id4804F7F48981" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id4804F7E18981"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id4804F8008981" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id13034X25856"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id4804F8608981"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id4804F80C8981" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id4804F7E18981"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id48FE36A3602" disabled="True" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow ftp">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id4804F7E18981"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id48FE3696602" disabled="True" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Allow billingListener">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id4804F7E18981"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E2913D27246"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id4804F81F8981" disabled="False" group="" log="False" position="6" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id4804F7E18981"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id48FCA46621983" disabled="False" group="" log="False" position="7" action="Accept" direction="Both" comment="Let the DNCS talk">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id49D4C8EC26647"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id4804F7E18981"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id487E95B18872" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id4804F8468981" disabled="False" group="" log="False" position="9" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id4804F7E18981"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480E7E979882" disabled="False" group="" log="False" position="10" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id4804F8528981" disabled="False" group="" log="True" position="11" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id4804F85F8981" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id4804F8618981" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id4804F8638981" name="probe-4P:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id4804F8658981" dedicated_failover="False" dyn="True" label="eth2" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth2" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id4804F8668981" dedicated_failover="False" dyn="True" label="eth3" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth3" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id4804F8648981" dedicated_failover="False" dyn="True" label="eth1" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth1" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id4804F8608981" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id480E9D409882" host_OS="linux24" inactive="False" lastCompiled="1247773867" lastInstalled="0" lastModified="1247836777" platform="iptables" version="" name="spider02" comment="" ro="False">
|
|
<NAT id="id480E9DAA9882" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id480E9D469882" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id480E9D479882" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id480E9DAD9882"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480E9D539882" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id480E9D409882"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480E9D5F9882" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id480E9D409882"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="tcp-HTTP"/>
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480E9D6F9882" disabled="False" group="" log="False" position="3" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id480E9D409882"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="tcp-SMTP"/>
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="udp-ntp"/>
|
|
<ServiceRef ref="id3F530CC8"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="tcp-HTTP"/>
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480E9D929882" disabled="False" group="" log="False" position="4" action="Deny" direction="Inbound" comment="Ignore multicast traffic">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480E9D9E9882" disabled="False" group="" log="True" position="5" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id480E9DAB9882" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id480E9DAC9882" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id480E9DAD9882" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id480E9DAF9882" name="spider02:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id480E9DB09882" dedicated_failover="False" dyn="False" label="eth1" mgmt="False" security_level="100" unnum="True" unprotected="False" name="eth1" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id480F006E9882" host_OS="linux24" inactive="False" lastCompiled="1216906954" lastInstalled="0" lastModified="1248707918" platform="iptables" version="" name="probe-2P-default" comment="" ro="False">
|
|
<NAT id="id480F00E39882" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id480F00749882" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id480F00759882" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id480F00E69882"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480F00819882" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id480F006E9882"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480F008D9882" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id480F00E59882"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480F00999882" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id480F006E9882"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480F00AD9882" disabled="False" group="" log="False" position="4" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id480F006E9882"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480F00BB9882" disabled="False" group="" log="False" position="5" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id480F006E9882"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480F00CB9882" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id480F00D79882" disabled="False" group="" log="True" position="7" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id480F00E49882" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id480F00E59882" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id480F00E69882" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id480F00E89882" name="probe-2P-default:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id480F00E99882" dedicated_failover="False" dyn="True" label="eth1" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth1" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id4A3BCC7031883" host_OS="linux24" inactive="False" lastCompiled="1245428149" lastInstalled="0" lastModified="1338907986" platform="iptables" version="" name="probe-4P-040" comment="" ro="False">
|
|
<NAT id="id4A3BCD1931883" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id4A3BCC7631883" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id4A3BCC7731883" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id4A3BCD1C31883"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id4A3BCC8331883" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id4A3BCC7031883"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id4A3BCC8F31883" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id4A3BCD2031883"/>
|
|
<ObjectRef ref="id4A3BCD1F31883"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id4A3BCC9D31883" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id4A3BCC7031883"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id4A3BCCB031883" disabled="True" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow ftp">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id4A3BCC7031883"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id4A3BCCBD31883" disabled="True" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Allow billingListener">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id4A3BCC7031883"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E2913D27246"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id4A3BCCC931883" disabled="False" group="" log="False" position="6" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id4A3BCC7031883"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id4A3BCCD831883" disabled="False" group="" log="False" position="7" action="Accept" direction="Both" comment="Let the DNCS talk">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id49D4C8EC26647"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id4A3BCC7031883"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id4A3BCCE531883" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id4A3BCCF131883" disabled="False" group="" log="False" position="9" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id4A3BCC7031883"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id4A3BCD0131883" disabled="False" group="" log="False" position="10" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id4A3BCD0D31883" disabled="False" group="" log="True" position="11" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id4A3BCD1A31883" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id4A3BCD1B31883" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id4A3BCD1C31883" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id4A3BCD1E31883" name="probe-4P-040:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id4A3BCD1F31883" dedicated_failover="False" dyn="True" label="eth1" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth1" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id4A3BCD2031883" dedicated_failover="False" dyn="True" label="eth2" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth2" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id4A3BCD2131883" dedicated_failover="False" dyn="True" label="eth3" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth3" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id11089X13908" host_OS="linux24" inactive="False" lastCompiled="1456850321" lastInstalled="0" lastModified="1456850306" platform="iptables" version="" name="probe-4P-091" comment="" ro="False">
|
|
<NAT id="id11259X13908" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id11095X13908" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id11096X13908" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id11262X13908"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11108X13908" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id11089X13908"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id35784X1817" disabled="False" group="" log="False" position="2" action="Deny" direction="Inbound" comment="">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id35775X1817"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id8545X28494" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id11261X13908"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11120X13908" disabled="False" group="" log="False" position="4" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id8544X28494"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id11089X13908"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id3F530CC8"/>
|
|
<ServiceRef ref="udp-ntp"/>
|
|
<ServiceRef ref="tcp-SMTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id11268X13908"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11135X13908" disabled="False" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id11089X13908"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11154X13908" disabled="False" group="" log="False" position="6" action="Accept" direction="Inbound" comment="Allow ftp">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id11089X13908"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11167X13908" disabled="False" group="" log="False" position="7" action="Accept" direction="Inbound" comment="Allow billingListener">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id11089X13908"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E2913D27246"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11179X13908" disabled="False" group="" log="False" position="8" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id11089X13908"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11194X13908" disabled="False" group="" log="False" position="9" action="Accept" direction="Both" comment="Let the DNCS talk">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id21203X13908"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id11089X13908"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11207X13908" disabled="False" group="" log="False" position="10" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11219X13908" disabled="False" group="" log="False" position="11" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id11089X13908"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11235X13908" disabled="False" group="" log="False" position="12" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11247X13908" disabled="False" group="" log="True" position="13" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id11260X13908" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id11261X13908" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id11262X13908" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id11264X13908" name="probe-4P-091:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id11265X13908" dedicated_failover="False" dyn="True" label="eth1" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth1" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id11266X13908" dedicated_failover="False" dyn="True" label="eth2" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth2" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id11267X13908" dedicated_failover="False" dyn="True" label="eth3" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth3" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id11268X13908" dedicated_failover="False" dyn="True" label="eth1-vlan1569" mgmt="False" security_level="100" unnum="False" unprotected="False" name="vlan1569" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id6066X11005" host_OS="linux24" inactive="False" lastCompiled="1247154775" lastInstalled="0" lastModified="1248707918" platform="iptables" version="" name="probe-4P-086" comment="" ro="False">
|
|
<NAT id="id6235X11005" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id6072X11005" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id6073X11005" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id6238X11005"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id6085X11005" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id6066X11005"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id6097X11005" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id6237X11005"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id6111X11005" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id6066X11005"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
<ServiceRef ref="udp-ntp"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id6130X11005" disabled="True" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow ftp">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id6066X11005"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id6143X11005" disabled="True" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Allow billingListener">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id6066X11005"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E2913D27246"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id6155X11005" disabled="False" group="" log="False" position="6" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id6066X11005"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id6170X11005" disabled="False" group="" log="False" position="7" action="Accept" direction="Both" comment="Let the DNCS talk">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id49D4C8EC26647"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id6066X11005"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id6183X11005" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id6195X11005" disabled="False" group="" log="False" position="9" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id6066X11005"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id6211X11005" disabled="False" group="" log="False" position="10" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id6223X11005" disabled="False" group="" log="True" position="11" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id6236X11005" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id6237X11005" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id6238X11005" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id6240X11005" name="probe-4P-086:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id6241X11005" dedicated_failover="False" dyn="True" label="eth1" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth1" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id6242X11005" dedicated_failover="False" dyn="True" label="eth2" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth2" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id6243X11005" dedicated_failover="False" dyn="True" label="eth3" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth3" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id11047X6767" host_OS="linux24" inactive="False" lastCompiled="1251311005" lastInstalled="0" lastModified="1292441018" platform="iptables" version="" name="probe-4P-tun" comment="" ro="False">
|
|
<NAT id="id11215X6767" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id11053X6767" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id11054X6767" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id11218X6767"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11066X6767" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id11047X6767"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11078X6767" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id11217X6767"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11230X6767" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="Remote probe ssh tunnel">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id11245X6767"/>
|
|
<ObjectRef ref="id11253X6767"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id11245X6767"/>
|
|
<ObjectRef ref="id11253X6767"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id11229X6767"/>
|
|
<ObjectRef ref="id11217X6767"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11092X6767" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id11047X6767"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11111X6767" disabled="True" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Allow ftp">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id11047X6767"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11124X6767" disabled="True" group="" log="False" position="6" action="Accept" direction="Inbound" comment="Allow billingListener">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id11047X6767"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E2913D27246"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11136X6767" disabled="False" group="" log="False" position="7" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id11047X6767"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11151X6767" disabled="False" group="" log="False" position="8" action="Accept" direction="Both" comment="Let the DNCS talk">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id49D4C8EC26647"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id11047X6767"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11163X6767" disabled="False" group="" log="False" position="9" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11175X6767" disabled="False" group="" log="False" position="10" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id11047X6767"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11191X6767" disabled="False" group="" log="False" position="11" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11203X6767" disabled="False" group="" log="True" position="12" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id11216X6767" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id11217X6767" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id11218X6767" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id11220X6767" name="probe-4P-tun:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id11221X6767" dedicated_failover="False" dyn="True" label="eth1" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth1" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id11222X6767" dedicated_failover="False" dyn="True" label="eth2" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth2" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id11223X6767" dedicated_failover="False" dyn="True" label="eth3" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth3" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id11229X6767" dedicated_failover="False" dyn="False" label="" mgmt="False" security_level="100" unnum="False" unprotected="False" name="tun0" comment="" ro="False">
|
|
<IPv4 id="id16004X6767" name="probe-4P-tun:tun0:ip" comment="" ro="False" address="192.168.184.1" netmask="255.255.255.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id6886X11714" host_OS="linux24" inactive="False" lastCompiled="1264785542" lastInstalled="0" lastModified="1451582445" platform="iptables" version="" name="probe-1P-DS" comment="" ro="False">
|
|
<NAT id="id7054X11714" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id6892X11714" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id6893X11714" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id7057X11714"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id6905X11714" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id6886X11714"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id6931X11714" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id24376X21016"/>
|
|
<ObjectRef ref="id11245X6767"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id6886X11714"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id6975X11714" disabled="False" group="" log="False" position="3" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id6886X11714"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id7002X11714" disabled="False" group="" log="False" position="4" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id7014X11714" disabled="False" group="" log="False" position="5" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id6886X11714"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id7030X11714" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id7042X11714" disabled="False" group="" log="True" position="7" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id7055X11714" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id7056X11714" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id7057X11714" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id7059X11714" name="probe-1P-DS:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="add_mgmt_ssh_rule_when_stoped">False</Option>
|
|
<Option name="add_rules_for_ipv6_neighbor_discovery">False</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="clear_unknown_interfaces">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_bonding_interfaces">False</Option>
|
|
<Option name="configure_bridge_interfaces">False</Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="configure_vlan_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script">echo "Checking to see if tunnel needs to be opened up"
|
|
if [ $(iptables -L -n 2>&1 |grep -Ec '^ACCEPT|^DROP|^LOG') -gt 0 ]; then
|
|
echo -n "Firewall looks to be running"
|
|
if ip -o -4 addr |grep -q tun0; then
|
|
echo -n ", found tun0"
|
|
if [ -x /sbin/phoneHome ]; then
|
|
echo ", so running 'phoneHome -O'"
|
|
/sbin/phoneHome -O
|
|
else
|
|
echo ", but no phoneHome found"
|
|
fi
|
|
else
|
|
echo " but no tun0 interface"
|
|
fi
|
|
else
|
|
echo "Firewall not running"
|
|
fi
|
|
</Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="ipv4_6_order">ipv4_first</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="scpArgs"></Option>
|
|
<Option name="script_name_on_firewall"></Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_m_set">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id7228X29410" host_OS="linux24" inactive="False" lastCompiled="1252681916" lastInstalled="0" lastModified="1252681940" platform="iptables" version="" name="probe-2P-093" comment="" ro="False">
|
|
<NAT id="id7396X29410" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id7234X29410" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id7235X29410" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id7399X29410"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id7247X29410" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id7228X29410"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id7259X29410" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id7398X29410"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id7273X29410" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id7228X29410"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id7292X29410" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow ftp">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id7228X29410"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id7305X29410" disabled="True" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Allow billingListener">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id7228X29410"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E2913D27246"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id7317X29410" disabled="False" group="" log="False" position="6" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id7228X29410"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id7332X29410" disabled="False" group="" log="False" position="7" action="Accept" direction="Both" comment="Let the DNCS talk">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id49D4C8EC26647"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id7228X29410"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id7344X29410" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id7356X29410" disabled="False" group="" log="False" position="9" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id7228X29410"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id7372X29410" disabled="False" group="" log="False" position="10" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id7384X29410" disabled="False" group="" log="True" position="11" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id7397X29410" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id7398X29410" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id7399X29410" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id7401X29410" name="probe-2P-093:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id7402X29410" dedicated_failover="False" dyn="True" label="eth1" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth1" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id7600X29384" host_OS="linux24" inactive="False" lastCompiled="1259680053" lastInstalled="0" lastModified="1259679996" platform="iptables" version="" name="probe-4P-001" comment="" ro="False">
|
|
<NAT id="id7768X29384" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id7606X29384" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id7607X29384" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id7771X29384"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id7619X29384" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id7600X29384"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id7631X29384" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id7770X29384"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id7645X29384" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id7600X29384"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id7689X29384" disabled="False" group="" log="False" position="4" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id7600X29384"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id7716X29384" disabled="False" group="" log="False" position="5" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id7728X29384" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id7600X29384"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id7744X29384" disabled="False" group="" log="False" position="7" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id7756X29384" disabled="False" group="" log="True" position="8" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id7769X29384" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id7770X29384" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id7771X29384" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id7773X29384" name="probe-4P-001:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id7774X29384" dedicated_failover="False" dyn="True" label="eth1" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth1" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id7775X29384" dedicated_failover="False" dyn="True" label="eth2" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth2" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id7776X29384" dedicated_failover="False" dyn="True" label="eth3" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth3" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id7898X15585" host_OS="linux24" inactive="False" lastCompiled="1260371676" lastInstalled="0" lastModified="1260371593" platform="iptables" version="" name="probe-4P-041" comment="" ro="False">
|
|
<NAT id="id8066X15585" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id7904X15585" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id7905X15585" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id8069X15585"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id7917X15585" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id7898X15585"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id7929X15585" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id3F530CC8"/>
|
|
<ServiceRef ref="udp-ntp"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id8068X15585"/>
|
|
<ObjectRef ref="id8072X15585"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id7943X15585" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id7898X15585"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id7962X15585" disabled="True" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow ftp">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id7898X15585"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id7975X15585" disabled="True" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Allow billingListener">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id7898X15585"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E2913D27246"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id7987X15585" disabled="False" group="" log="False" position="6" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id7898X15585"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id8002X15585" disabled="False" group="" log="False" position="7" action="Accept" direction="Both" comment="Let the DNCS talk">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id49D4C8EC26647"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id7898X15585"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id8014X15585" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id8026X15585" disabled="False" group="" log="False" position="9" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id7898X15585"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id8042X15585" disabled="False" group="" log="False" position="10" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id8054X15585" disabled="False" group="" log="True" position="11" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id8067X15585" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id8068X15585" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id8069X15585" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id8071X15585" name="probe-4P-041:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id8072X15585" dedicated_failover="False" dyn="True" label="eth1" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth1" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id8073X15585" dedicated_failover="False" dyn="True" label="eth2" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth2" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id8074X15585" dedicated_failover="False" dyn="True" label="eth3" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth3" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id8279X21016" host_OS="linux24" inactive="False" lastCompiled="1451586208" lastInstalled="0" lastModified="1451582445" platform="iptables" version="" name="probe-1P-DS-097" comment="" ro="False">
|
|
<NAT id="id8431X21016" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id8285X21016" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id8286X21016" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id8434X21016"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id8298X21016" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id8279X21016"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks"></Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id8310X21016" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id14813X21016"/>
|
|
<ObjectRef ref="id11245X6767"/>
|
|
<ObjectRef ref="id24376X21016"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id8279X21016"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id8352X21016" disabled="False" group="" log="False" position="3" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id8279X21016"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id8379X21016" disabled="False" group="" log="False" position="4" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id8391X21016" disabled="False" group="" log="False" position="5" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id8279X21016"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id8407X21016" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id8419X21016" disabled="False" group="" log="True" position="7" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="classification">False</Option>
|
|
<Option name="classify_str"></Option>
|
|
<Option name="connlimit_above_not">False</Option>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks"></Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_mode_dstip">False</Option>
|
|
<Option name="hashlimit_mode_dstport">False</Option>
|
|
<Option name="hashlimit_mode_srcip">False</Option>
|
|
<Option name="hashlimit_mode_srcport">False</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="ipt_continue">False</Option>
|
|
<Option name="ipt_gw"></Option>
|
|
<Option name="ipt_iif"></Option>
|
|
<Option name="ipt_mark_connections">False</Option>
|
|
<Option name="ipt_oif"></Option>
|
|
<Option name="ipt_tee">False</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="limit_value_not">False</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="routing">False</Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="tagging">False</Option>
|
|
<Option name="tagobject_id"></Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id8432X21016" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id8433X21016" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id8434X21016" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id8436X21016" name="probe-1P-DS-097:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id9774X4351" host_OS="linux24" inactive="False" lastCompiled="1288363142" lastInstalled="0" lastModified="1288363113" platform="iptables" version="" name="probe-4P-083" comment="" ro="False">
|
|
<NAT id="id9962X4351" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id9799X4351" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id9800X4351" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id9785X4351"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id9812X4351" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id9774X4351"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id9824X4351" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id3AECF776"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id9782X4351"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id9838X4351" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id9774X4351"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="tcp-SMTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id9882X4351" disabled="False" group="" log="False" position="4" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id9774X4351"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id9909X4351" disabled="False" group="" log="False" position="5" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id9921X4351" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id9774X4351"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id9937X4351" disabled="False" group="" log="False" position="7" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id9949X4351" disabled="False" group="" log="True" position="8" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id9964X4351" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id9782X4351" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id9785X4351" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id9788X4351" name="probe-4P-083:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id9790X4351" dedicated_failover="False" dyn="True" label="eth1" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth1" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id9793X4351" dedicated_failover="False" dyn="True" label="eth2" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth2" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id9796X4351" dedicated_failover="False" dyn="True" label="eth3" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth3" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id10422X14198" host_OS="linux24" inactive="False" lastCompiled="1411413684" lastInstalled="0" lastModified="1411413669" platform="iptables" version="" name="probe-4P-094" comment="" ro="False">
|
|
<NAT id="id10610X14198" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id10447X14198" name="Policy" comment="" ro="False" ipv4_rule_set="True" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id10448X14198" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id10433X14198"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id10460X14198" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id10422X14198"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id10472X14198" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id10430X14198"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id28903X9776" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow walks to cluster return on different address">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id28894X9776"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id10422X14198"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id487E69D18872"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id10486X14198" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id10422X14198"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id10530X14198" disabled="False" group="" log="False" position="5" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id10422X14198"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
<ServiceRef ref="id10683X14198"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id10557X14198" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id10569X14198" disabled="False" group="" log="False" position="7" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id10422X14198"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id10585X14198" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id10597X14198" disabled="False" group="" log="True" position="9" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions>
|
|
<Option name="mangle_only_rule_set">False</Option>
|
|
</RuleSetOptions>
|
|
</Policy>
|
|
<Routing id="id10612X14198" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id10430X14198" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id10433X14198" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id10436X14198" name="probe-4P-094:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id10438X14198" dedicated_failover="False" dyn="True" label="eth1" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth1" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id10441X14198" dedicated_failover="False" dyn="True" label="eth2" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth2" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id10444X14198" dedicated_failover="False" dyn="True" label="eth3" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth3" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id10415X20313" host_OS="linux24" inactive="False" lastCompiled="1286377687" lastInstalled="0" lastModified="1286377647" platform="iptables" version="" name="probe-4P-101" comment="" ro="False">
|
|
<NAT id="id10603X20313" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id10440X20313" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id10441X20313" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id10426X20313"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id10453X20313" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id10415X20313"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id10465X20313" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id10423X20313"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id10479X20313" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id10415X20313"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id10498X20313" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow ftp">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id10415X20313"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id10523X20313" disabled="False" group="" log="False" position="5" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id10415X20313"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
<ServiceRef ref="id10667X20313"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id10550X20313" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id10562X20313" disabled="False" group="" log="False" position="7" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id10415X20313"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id10578X20313" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id10590X20313" disabled="False" group="" log="True" position="9" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id10605X20313" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id10423X20313" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id10426X20313" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id10429X20313" name="probe-4P-101:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id10431X20313" dedicated_failover="False" dyn="True" label="eth1" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth1" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id10434X20313" dedicated_failover="False" dyn="True" label="eth2" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth2" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id10437X20313" dedicated_failover="False" dyn="True" label="eth3" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth3" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id10782X4966" host_OS="linux24" inactive="False" lastCompiled="1377715533" lastInstalled="0" lastModified="1451582445" platform="iptables" version="" name="probe-2P-tun-116" comment="" ro="False">
|
|
<NAT id="id10990X4966" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id10812X4966" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id10813X4966" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id10793X4966"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id10825X4966" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id10782X4966"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11203X1243" disabled="False" group="" log="True" position="2" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id24376X21016"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id10782X4966"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id10790X4966"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11274X28966" disabled="False" group="" log="True" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id10782X4966"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AECF780"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id10790X4966"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id10866X4966" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id10782X4966"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id10798X4966"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id10910X4966" disabled="False" group="" log="False" position="5" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id10782X4966"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
<ServiceRef ref="id12009X8217"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id10937X4966" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id10949X4966" disabled="False" group="" log="False" position="7" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id10782X4966"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id10965X4966" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id10977X4966" disabled="False" group="" log="True" position="9" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id10992X4966" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id10790X4966" dedicated_failover="False" dyn="False" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<IPv4 id="id11153X1243" name="probe-2P-tun-116:eth0:ip" comment="" ro="False" address="64.151.122.72" netmask="255.255.255.224"/>
|
|
<InterfaceOptions>
|
|
<Option name="bonding_policy"></Option>
|
|
<Option name="bondng_driver_options"></Option>
|
|
<Option name="enable_stp">False</Option>
|
|
<Option name="type">ethernet</Option>
|
|
<Option name="vlan_id">0</Option>
|
|
<Option name="xmit_hash_policy"></Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id10793X4966" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id10796X4966" name="probe-2P-tun-116:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id10798X4966" dedicated_failover="False" dyn="False" label="eth1" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth1" comment="" ro="False">
|
|
<IPv4 id="id11142X1243" name="probe-2P-tun-116:eth1:ip" comment="" ro="False" address="192.168.1.151" netmask="255.255.255.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id10807X4966" dedicated_failover="False" dyn="False" label="tun0" mgmt="False" security_level="100" unnum="False" unprotected="False" name="tun0" comment="" ro="False">
|
|
<IPv4 id="id10810X4966" name="probe-2P-tun-116:tun0:ip" comment="" ro="False" address="192.168.179.15" netmask="255.255.255.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="64.151.122.72">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="add_mgmt_ssh_rule_when_stoped">False</Option>
|
|
<Option name="add_rules_for_ipv6_neighbor_discovery">False</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="clear_unknown_interfaces">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_bonding_interfaces">False</Option>
|
|
<Option name="configure_bridge_interfaces">False</Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="configure_vlan_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="ipv4_6_order">ipv4_first</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="scpArgs"></Option>
|
|
<Option name="script_name_on_firewall"></Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_m_set">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id11281X6398" host_OS="linux24" inactive="False" lastCompiled="1451588986" lastInstalled="0" lastModified="1451582445" platform="iptables" version="" name="probe-1P-DS-117" comment="" ro="False">
|
|
<NAT id="id11409X6398" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id11297X6398" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id11298X6398" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id11292X6398"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11310X6398" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id11281X6398"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11606X6398" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id11270X6398"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id12010X31433" disabled="False" group="" log="True" position="3" action="Accept" direction="Inbound" comment="">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id12001X31433"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id11281X6398"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11322X6398" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id24376X21016"/>
|
|
<ObjectRef ref="id11245X6767"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id11281X6398"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11341X6398" disabled="False" group="" log="False" position="5" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id11281X6398"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11356X6398" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11368X6398" disabled="False" group="" log="False" position="7" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id11281X6398"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11384X6398" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11396X6398" disabled="False" group="" log="True" position="9" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id11411X6398" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id11289X6398" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id11292X6398" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id11295X6398" name="probe-1P-DS-117:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id11572X4885" host_OS="linux24" inactive="False" lastCompiled="1299077518" lastInstalled="0" lastModified="1299077471" platform="iptables" version="" name="probe-4P-053" comment="" ro="False">
|
|
<NAT id="id11760X4885" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id11597X4885" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id11598X4885" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id11583X4885"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11610X4885" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id11572X4885"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11622X4885" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id11580X4885"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11636X4885" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id11572X4885"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="udp-DNS"/>
|
|
<ServiceRef ref="udp-ntp"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11655X4885" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow ftp">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id11572X4885"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11668X4885" disabled="False" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Allow billingListener">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id11572X4885"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E2913D27246"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11680X4885" disabled="False" group="" log="False" position="6" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id11572X4885"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11695X4885" disabled="False" group="" log="False" position="7" action="Accept" direction="Both" comment="Let the DNCS talk">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id49D4C8EC26647"/>
|
|
<ObjectRef ref="id11890X4885"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id11572X4885"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_above_not">False</Option>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks"></Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode_dstip">False</Option>
|
|
<Option name="hashlimit_mode_dstport">False</Option>
|
|
<Option name="hashlimit_mode_srcip">False</Option>
|
|
<Option name="hashlimit_mode_srcport">False</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="limit_value_not">False</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11707X4885" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11719X4885" disabled="False" group="" log="False" position="9" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id11572X4885"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11735X4885" disabled="False" group="" log="False" position="10" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id11747X4885" disabled="False" group="" log="True" position="11" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id11762X4885" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id11580X4885" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id11583X4885" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id11586X4885" name="probe-4P-053:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id11588X4885" dedicated_failover="False" dyn="True" label="eth1" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth1" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id11591X4885" dedicated_failover="False" dyn="True" label="eth2" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth2" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id11594X4885" dedicated_failover="False" dyn="True" label="eth3" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth3" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id12014X8095" host_OS="linux24" inactive="False" lastCompiled="1455044446" lastInstalled="0" lastModified="1455044422" platform="iptables" version="" name="probe-4P-112" comment="" ro="False">
|
|
<NAT id="id12202X8095" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id12039X8095" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id12040X8095" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id12025X8095"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id12052X8095" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id12014X8095"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id12338X8095" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="DNS proxy for remote probes">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id12014X8095"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3F530CC8"/>
|
|
<ServiceRef ref="udp-ntp"/>
|
|
<ServiceRef ref="tcp-SMTP"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id30138X12637"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id12030X8095"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id12064X8095" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="udp-ntp"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id12022X8095"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id12078X8095" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id12014X8095"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id12097X8095" disabled="False" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Allow ftp">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id12014X8095"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id12110X8095" disabled="True" group="" log="False" position="6" action="Accept" direction="Inbound" comment="Allow billingListener">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id12014X8095"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E2913D27246"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id12122X8095" disabled="False" group="" log="False" position="7" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id12014X8095"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id12137X8095" disabled="False" group="" log="False" position="8" action="Accept" direction="Both" comment="Let the DNCS talk">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id49D4C8EC26647"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id12014X8095"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id12149X8095" disabled="False" group="" log="False" position="9" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id12161X8095" disabled="False" group="" log="False" position="10" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id12014X8095"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id12177X8095" disabled="False" group="" log="False" position="11" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id12189X8095" disabled="False" group="" log="True" position="12" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id12204X8095" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id12022X8095" dedicated_failover="False" dyn="True" label="igbr1" mgmt="True" security_level="100" unnum="False" unprotected="False" name="igbr1" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id12025X8095" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id12028X8095" name="probe-4P-112:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id12030X8095" dedicated_failover="False" dyn="True" label="em2" mgmt="False" security_level="100" unnum="False" unprotected="False" name="em2" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id12033X8095" dedicated_failover="False" dyn="True" label="p1p1" mgmt="False" security_level="100" unnum="False" unprotected="False" name="p1p1" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id12036X8095" dedicated_failover="False" dyn="True" label="p1p2" mgmt="False" security_level="100" unnum="False" unprotected="False" name="p1p2" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id12458X13976" host_OS="linux24" inactive="False" lastCompiled="1335290130" lastInstalled="0" lastModified="1451582445" platform="iptables" version="" name="probe-2P-DS-118" comment="" ro="False">
|
|
<NAT id="id12586X13976" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id12474X13976" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id12475X13976" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id12469X13976"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id12487X13976" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id12458X13976"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id20807X19810" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id12458X13976"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id12499X13976" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id24376X21016"/>
|
|
<ObjectRef ref="id11245X6767"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id12458X13976"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id12688X13976" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow traps in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id13139X31664"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id12458X13976"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id12518X13976" disabled="False" group="" log="False" position="5" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id12458X13976"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
<ServiceRef ref="id21485X19810"/>
|
|
<ServiceRef ref="id24575X12596"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id12533X13976" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id12545X13976" disabled="False" group="" log="False" position="7" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id12458X13976"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id12561X13976" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id12573X13976" disabled="False" group="" log="True" position="9" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id12588X13976" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id12466X13976" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id12469X13976" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id12472X13976" name="probe-2P-DS-118:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id12650X13976" dedicated_failover="False" dyn="True" label="eth1" mgmt="False" security_level="0" unnum="False" unprotected="False" name="eth1" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="add_mgmt_ssh_rule_when_stoped">False</Option>
|
|
<Option name="add_rules_for_ipv6_neighbor_discovery">False</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="clear_unknown_interfaces">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_bonding_interfaces">False</Option>
|
|
<Option name="configure_bridge_interfaces">False</Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="configure_vlan_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script">echo "Checking to see if tunnel needs to be opened up"
|
|
if [ $(iptables -L -n 2>&1 |grep -Ec '^ACCEPT|^DROP|^LOG') -gt 0 ]; then
|
|
echo -n "Firewall looks to be running"
|
|
if ip -o -4 addr |grep -q tun0; then
|
|
echo -n ", found tun0"
|
|
if [ -x /sbin/phoneHome ]; then
|
|
echo ", so running 'phoneHome -O'"
|
|
/sbin/phoneHome -O
|
|
else
|
|
echo ", but no phoneHome found"
|
|
fi
|
|
else
|
|
echo " but no tun0 interface"
|
|
fi
|
|
else
|
|
echo "Firewall not running"
|
|
fi
|
|
</Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="ipv4_6_order">ipv4_first</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="scpArgs"></Option>
|
|
<Option name="script_name_on_firewall"></Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_m_set">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id12747X20089" host_OS="linux24" inactive="False" lastCompiled="1451663046" lastInstalled="0" lastModified="1451582445" platform="iptables" version="" name="probe-1P-DS-130" comment="" ro="False">
|
|
<NAT id="id12875X20089" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id12763X20089" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id12764X20089" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id12758X20089"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id12776X20089" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id12747X20089"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id12788X20089" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id24376X21016"/>
|
|
<ObjectRef ref="id11245X6767"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id12747X20089"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id487E59658872"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id12807X20089" disabled="False" group="" log="False" position="3" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id12747X20089"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id12822X20089" disabled="False" group="" log="False" position="4" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id12834X20089" disabled="False" group="" log="False" position="5" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id12747X20089"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id12850X20089" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id12862X20089" disabled="False" group="" log="True" position="7" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id12877X20089" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id12755X20089" dedicated_failover="False" dyn="True" label="em1" mgmt="True" security_level="100" unnum="False" unprotected="False" name="em1" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id12758X20089" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id12761X20089" name="probe-1P-DS-130:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id33083X20469" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="igbr1" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id18154X23767" host_OS="linux24" inactive="False" lastCompiled="1325707369" lastInstalled="0" lastModified="1451582445" platform="iptables" version="" name="probe-1P-DS-134" comment="" ro="False">
|
|
<NAT id="id18411X23767" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id18170X23767" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id18172X23767" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id18165X23767"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id18200X23767" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id18154X23767"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id18228X23767" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id24376X21016"/>
|
|
<ObjectRef ref="id11245X6767"/>
|
|
<ObjectRef ref="id18562X23767"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id18154X23767"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id18263X23767" disabled="False" group="" log="False" position="3" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id18154X23767"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id18294X23767" disabled="False" group="" log="False" position="4" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id18322X23767" disabled="False" group="" log="False" position="5" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id18154X23767"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id18354X23767" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id18382X23767" disabled="False" group="" log="True" position="7" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id18414X23767" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id18162X23767" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id18165X23767" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id18168X23767" name="probe-1P-DS-134:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id18569X21207" host_OS="linux24" inactive="False" lastCompiled="1339177729" lastInstalled="0" lastModified="1339177712" platform="iptables" version="" name="probe-4P-em" comment="" ro="False">
|
|
<NAT id="id18951X21207" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id18594X21207" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id18596X21207" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id18580X21207"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id18624X21207" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id18569X21207"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks"></Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id18652X21207" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id13034X25856"/>
|
|
<ServiceRef ref="sg-DHCP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id19057X21207"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id18683X21207" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id18569X21207"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id18718X21207" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow ftp">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id18569X21207"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id18747X21207" disabled="False" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Allow billingListener">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id18569X21207"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E2913D27246"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id18775X21207" disabled="False" group="" log="False" position="6" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id18569X21207"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
<ServiceRef ref="id23850X12651"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id18806X21207" disabled="False" group="" log="False" position="7" action="Accept" direction="Both" comment="Let the DNCS talk">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id49D4C8EC26647"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id18569X21207"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id18834X21207" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id18862X21207" disabled="False" group="" log="False" position="9" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id18569X21207"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id18894X21207" disabled="False" group="" log="False" position="10" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id18922X21207" disabled="False" group="" log="True" position="11" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks"></Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id18954X21207" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id18580X21207" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id18583X21207" name="probe-4P-em:lo:ip-1" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id19057X21207" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em1" comment="eth0" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id19091X21207" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em2" comment="eth1" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id19125X21207" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p1" comment="eth2" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id19221X21207" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p2" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id19189X2307" host_OS="linux24" inactive="False" lastCompiled="1336396459" lastInstalled="0" lastModified="1451582445" platform="iptables" version="" name="probe-1P-DS-132" comment="" ro="False">
|
|
<NAT id="id19446X2307" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id19205X2307" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id19207X2307" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id19200X2307"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id19235X2307" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id19189X2307"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id19512X2307" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id19189X2307"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id19263X2307" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id24376X21016"/>
|
|
<ObjectRef ref="id11245X6767"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id19189X2307"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id19298X2307" disabled="False" group="" log="False" position="4" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id19189X2307"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id19329X2307" disabled="False" group="" log="False" position="5" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id19357X2307" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id19189X2307"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id19389X2307" disabled="False" group="" log="False" position="7" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id19417X2307" disabled="False" group="" log="True" position="8" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id19449X2307" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id19197X2307" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id19200X2307" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id19203X2307" name="probe-1P-DS-132:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="add_mgmt_ssh_rule_when_stoped">False</Option>
|
|
<Option name="add_rules_for_ipv6_neighbor_discovery">False</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="clear_unknown_interfaces">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_bonding_interfaces">False</Option>
|
|
<Option name="configure_bridge_interfaces">False</Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="configure_vlan_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script">echo "Checking to see if tunnel needs to be opened up"
|
|
if [ $(iptables -L -n 2>&1 |grep -Ec '^ACCEPT|^DROP|^LOG') -gt 0 ]; then
|
|
echo -n "Firewall looks to be running"
|
|
if ip -o -4 addr |grep -q tun0; then
|
|
echo -n ", found tun0"
|
|
if [ -x /sbin/phoneHome ]; then
|
|
echo ", so running 'phoneHome -O'"
|
|
/sbin/phoneHome -O
|
|
else
|
|
echo ", but no phoneHome found"
|
|
fi
|
|
else
|
|
echo " but no tun0 interface"
|
|
fi
|
|
else
|
|
echo "Firewall not running"
|
|
fi
|
|
</Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="ipv4_6_order">ipv4_first</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="scpArgs"></Option>
|
|
<Option name="script_name_on_firewall"></Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_m_set">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id19638X25006" host_OS="linux24" inactive="False" lastCompiled="1328296304" lastInstalled="0" lastModified="1328296290" platform="iptables" version="" name="probe-4P-115" comment="" ro="False">
|
|
<NAT id="id20020X25006" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id19663X25006" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id19665X25006" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id19646X25006"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id19693X25006" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id19638X25006"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id19721X25006" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id13034X25856"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id19660X25006"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id19752X25006" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id19638X25006"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id19787X25006" disabled="True" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow ftp">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id19638X25006"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id19816X25006" disabled="True" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Allow billingListener">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id19638X25006"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E2913D27246"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id19844X25006" disabled="False" group="" log="False" position="6" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id19638X25006"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id19875X25006" disabled="False" group="" log="False" position="7" action="Accept" direction="Both" comment="Let the DNCS talk">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id49D4C8EC26647"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id19638X25006"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id19903X25006" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id19931X25006" disabled="False" group="" log="False" position="9" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
<ServiceRef ref="id20094X25006"/>
|
|
<ServiceRef ref="id20218X25006"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id19963X25006" disabled="False" group="" log="False" position="10" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id19991X25006" disabled="False" group="" log="True" position="11" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id20023X25006" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id19646X25006" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id19649X25006" name="probe-4P-115:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id19651X25006" dedicated_failover="False" dyn="True" label="eth2" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth2" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id19654X25006" dedicated_failover="False" dyn="True" label="eth3" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth3" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id19657X25006" dedicated_failover="False" dyn="True" label="eth1" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth1" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id19660X25006" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id20258X23985" host_OS="linux24" inactive="False" lastCompiled="1328624203" lastInstalled="0" lastModified="1351021044" platform="iptables" version="" name="probe-4P-em-139" comment="" ro="False">
|
|
<NAT id="id20640X23985" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id20283X23985" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id20285X23985" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id20266X23985"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id20313X23985" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id20258X23985"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id20341X23985" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id13034X25856"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id20271X23985"/>
|
|
<ObjectRef ref="id20706X23985"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id20372X23985" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id20258X23985"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id20464X23985" disabled="False" group="" log="False" position="4" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id20258X23985"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
<ServiceRef ref="id25047X9128"/>
|
|
<ServiceRef ref="id25038X9128"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id20523X23985" disabled="False" group="" log="False" position="5" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id20551X23985" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id20258X23985"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id20583X23985" disabled="False" group="" log="False" position="7" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id20611X23985" disabled="False" group="" log="True" position="8" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id20643X23985" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id20266X23985" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id20269X23985" name="probe-4P-em-139:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id20271X23985" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em1" comment="eth0" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id20274X23985" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em2" comment="eth1" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id20277X23985" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p1" comment="eth2" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id20280X23985" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p2" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id20706X23985" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="igbr1" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id20985X19810" host_OS="linux24" inactive="False" lastCompiled="1339424998" lastInstalled="0" lastModified="1339424931" platform="iptables" version="" name="probe-4P-igbr" comment="" ro="False">
|
|
<NAT id="id21368X19810" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id21010X19810" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id21012X19810" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id20993X19810"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id21040X19810" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id20985X19810"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id21068X19810" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id13034X25856"/>
|
|
<ServiceRef ref="sg-DHCP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id20998X19810"/>
|
|
<ObjectRef ref="id21434X19810"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id21100X19810" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id20985X19810"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id21135X19810" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow ftp">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id20985X19810"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id21164X19810" disabled="False" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Allow billingListener">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id20985X19810"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E2913D27246"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id21192X19810" disabled="False" group="" log="False" position="6" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id20985X19810"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
<ServiceRef ref="id23850X12651"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id21223X19810" disabled="False" group="" log="False" position="7" action="Accept" direction="Both" comment="Let the DNCS talk">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id49D4C8EC26647"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id20985X19810"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id21251X19810" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id21279X19810" disabled="False" group="" log="False" position="9" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id20985X19810"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id21311X19810" disabled="False" group="" log="False" position="10" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id21339X19810" disabled="False" group="" log="True" position="11" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id21371X19810" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id20993X19810" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id20996X19810" name="probe-4P-igbr:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id20998X19810" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em1" comment="eth0" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id21001X19810" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em2" comment="eth1" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id21004X19810" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p1" comment="eth2" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id21007X19810" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p2" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id21434X19810" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="igbr1" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id34102X4345" host_OS="linux24" lastCompiled="0" lastInstalled="0" lastModified="0" platform="iptables" name="test" comment="" ro="False">
|
|
<NAT id="id34106X4345" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id34104X4345" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id34108X4345" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id34110X4345" dedicated_failover="False" dyn="True" label="" security_level="0" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">true</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">true</Option>
|
|
<Option name="check_shading">true</Option>
|
|
<Option name="configure_interfaces">true</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">true</Option>
|
|
<Option name="flush_and_set_default_policy">True</Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_ip_forward">1</Option>
|
|
<Option name="load_modules">true</Option>
|
|
<Option name="local_nat">false</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">RULE %N -- %A </Option>
|
|
<Option name="loopback_interface">lo</Option>
|
|
<Option name="manage_virtual_addr">true</Option>
|
|
<Option name="modules_dir">/lib/modules/`uname -r`/kernel/net/</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="verify_interfaces">true</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id21467X12596" host_OS="linux24" inactive="False" lastCompiled="1332529622" lastInstalled="0" lastModified="1332529585" platform="iptables" version="" name="probe-4P-igbr-120" comment="Has network card but not showing up 3/22/2021" ro="False">
|
|
<NAT id="id21854X12596" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id21495X12596" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id21497X12596" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id21475X12596"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id21525X12596" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id21467X12596"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id21553X12596" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id13034X25856"/>
|
|
<ServiceRef ref="sg-DHCP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id21480X12596"/>
|
|
<ObjectRef ref="id21492X12596"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id21586X12596" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id21467X12596"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id21678X12596" disabled="False" group="" log="False" position="4" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id21467X12596"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id21737X12596" disabled="False" group="" log="False" position="5" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id21765X12596" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id21467X12596"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id21797X12596" disabled="False" group="" log="False" position="7" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id21825X12596" disabled="False" group="" log="True" position="8" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id21857X12596" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id21475X12596" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id21478X12596" name="probe-4P-igbr-120:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id21480X12596" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em1" comment="eth0" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id21483X12596" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em2" comment="eth1" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id21492X12596" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="igbr1" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id21947X12596" host_OS="linux24" inactive="False" lastCompiled="1333120104" lastInstalled="0" lastModified="1333119955" platform="iptables" version="" name="sponge01A" comment="" ro="False">
|
|
<NAT id="id22204X12596" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id21963X12596" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id22994X12596" disabled="False" group="" log="True" position="0" action="Accept" direction="Both" comment="Rate limit if not Colo A">
|
|
<Src neg="True">
|
|
<ObjectRef ref="id11246X6767"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id21947X12596"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id21955X12596"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="classification">True</Option>
|
|
<Option name="classify_str">1:10</Option>
|
|
<Option name="connlimit_above_not">False</Option>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks"></Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode_dstip">False</Option>
|
|
<Option name="hashlimit_mode_dstport">False</Option>
|
|
<Option name="hashlimit_mode_srcip">False</Option>
|
|
<Option name="hashlimit_mode_srcport">False</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="ipt_continue">False</Option>
|
|
<Option name="ipt_gw"></Option>
|
|
<Option name="ipt_iif"></Option>
|
|
<Option name="ipt_mark_connections">False</Option>
|
|
<Option name="ipt_oif"></Option>
|
|
<Option name="ipt_tee">False</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="limit_value_not">False</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="routing">False</Option>
|
|
<Option name="stateless">False</Option>
|
|
<Option name="tagging">False</Option>
|
|
<Option name="tagobject_id"></Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id22021X12596" disabled="False" group="" log="True" position="1" action="Accept" direction="Both" comment="Rate limit if not Colo A">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id21947X12596"/>
|
|
</Src>
|
|
<Dst neg="True">
|
|
<ObjectRef ref="id11246X6767"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id21955X12596"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="classification">True</Option>
|
|
<Option name="classify_str">1:10</Option>
|
|
<Option name="connlimit_above_not">False</Option>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks"></Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode_dstip">False</Option>
|
|
<Option name="hashlimit_mode_dstport">False</Option>
|
|
<Option name="hashlimit_mode_srcip">False</Option>
|
|
<Option name="hashlimit_mode_srcport">False</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="ipt_continue">False</Option>
|
|
<Option name="ipt_gw"></Option>
|
|
<Option name="ipt_iif"></Option>
|
|
<Option name="ipt_mark_connections">False</Option>
|
|
<Option name="ipt_oif"></Option>
|
|
<Option name="ipt_tee">False</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="limit_value_not">False</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="routing">False</Option>
|
|
<Option name="stateless">False</Option>
|
|
<Option name="tagging">False</Option>
|
|
<Option name="tagobject_id"></Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id22175X12596" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="At Colo allow everything">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks"></Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id22207X12596" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id21955X12596" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id21958X12596" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id21961X12596" name="sponge01A:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="add_mgmt_ssh_rule_when_stoped">False</Option>
|
|
<Option name="add_rules_for_ipv6_neighbor_discovery">False</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="clear_unknown_interfaces">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_bonding_interfaces">False</Option>
|
|
<Option name="configure_bridge_interfaces">False</Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="configure_vlan_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"># rates are in mbit/sec
|
|
|
|
RATE_DEFAULT=1000
|
|
RATE_GARNTD=3
|
|
RATE_LIMIT=4
|
|
|
|
tc qdisc del dev eth0 root >/dev/null 2>&1
|
|
tc qdisc add dev eth0 root handle 1: htb default 90
|
|
tc class add dev eth0 parent 1: classid 1:1 htb rate ${RATE_DEFAULT}mbit ceil ${RATE_DEFAULT}mbit
|
|
tc class add dev eth0 parent 1:1 classid 1:10 htb rate ${RATE_GARNTD}mbit ceil ${RATE_LIMIT}mbit</Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="ipv4_6_order">ipv4_first</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="scpArgs"></Option>
|
|
<Option name="script_name_on_firewall"></Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_m_set">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id23183X12596" host_OS="linux24" inactive="False" lastCompiled="1333133699" lastInstalled="0" lastModified="1333133678" platform="iptables" version="" name="mbeam" comment="" ro="False">
|
|
<NAT id="id23286X12596" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id23199X12596" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id23201X12596" disabled="False" group="" log="True" position="0" action="Accept" direction="Both" comment="Rate limit test">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id23352X12596"/>
|
|
<ObjectRef ref="id23183X12596"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id23183X12596"/>
|
|
<ObjectRef ref="id23352X12596"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id23191X12596"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="classification">True</Option>
|
|
<Option name="classify_str">1:10</Option>
|
|
<Option name="connlimit_above_not">False</Option>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks"></Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode_dstip">False</Option>
|
|
<Option name="hashlimit_mode_dstport">False</Option>
|
|
<Option name="hashlimit_mode_srcip">False</Option>
|
|
<Option name="hashlimit_mode_srcport">False</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="ipt_continue">False</Option>
|
|
<Option name="ipt_gw"></Option>
|
|
<Option name="ipt_iif"></Option>
|
|
<Option name="ipt_mark_connections">False</Option>
|
|
<Option name="ipt_oif"></Option>
|
|
<Option name="ipt_tee">False</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="limit_value_not">False</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="routing">False</Option>
|
|
<Option name="stateless">False</Option>
|
|
<Option name="tagging">False</Option>
|
|
<Option name="tagobject_id"></Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id23257X12596" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="Allow everything">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks"></Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id23289X12596" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id23191X12596" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id23194X12596" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id23197X12596" name="mbeam:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="add_mgmt_ssh_rule_when_stoped">False</Option>
|
|
<Option name="add_rules_for_ipv6_neighbor_discovery">False</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="clear_unknown_interfaces">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_bonding_interfaces">False</Option>
|
|
<Option name="configure_bridge_interfaces">False</Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="configure_vlan_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"># rates are in mbit/sec
|
|
|
|
RATE_DEFAULT=100
|
|
RATE_GARNTD=1
|
|
RATE_LIMIT=2
|
|
|
|
tc qdisc del dev eth0 root >/dev/null 2>&1
|
|
tc qdisc add dev eth0 root handle 1: htb default 90
|
|
tc class add dev eth0 parent 1: classid 1:1 htb rate ${RATE_DEFAULT}mbit ceil ${RATE_DEFAULT}mbit
|
|
tc class add dev eth0 parent 1:1 classid 1:10 htb rate ${RATE_GARNTD}mbit ceil ${RATE_LIMIT}mbit</Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="ipv4_6_order">ipv4_first</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="scpArgs"></Option>
|
|
<Option name="script_name_on_firewall"></Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_m_set">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id23585X12596" host_OS="linux24" inactive="False" lastCompiled="1333993373" lastInstalled="0" lastModified="1333993357" platform="iptables" version="" name="obelisk" comment="" ro="False">
|
|
<NAT id="id23662X12596" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id23601X12596" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id23603X12596" disabled="False" group="" log="True" position="0" action="Accept" direction="Both" comment="Rate limit test (Epilog tc script, stateless)">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id23585X12596"/>
|
|
<ObjectRef ref="id23831X12596"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id23585X12596"/>
|
|
<ObjectRef ref="id23831X12596"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="classification">False</Option>
|
|
<Option name="classify_str"></Option>
|
|
<Option name="connlimit_above_not">False</Option>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks"></Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode_dstip">False</Option>
|
|
<Option name="hashlimit_mode_dstport">False</Option>
|
|
<Option name="hashlimit_mode_srcip">False</Option>
|
|
<Option name="hashlimit_mode_srcport">False</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="ipt_continue">False</Option>
|
|
<Option name="ipt_gw"></Option>
|
|
<Option name="ipt_iif"></Option>
|
|
<Option name="ipt_mark_connections">False</Option>
|
|
<Option name="ipt_oif"></Option>
|
|
<Option name="ipt_tee">False</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="limit_value_not">False</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="routing">False</Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="tagging">True</Option>
|
|
<Option name="tagobject_id">id24415X12596</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id23633X12596" disabled="False" group="" log="False" position="1" action="Accept" direction="Both" comment="Allow everything">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks"></Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id23665X12596" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id23593X12596" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id23596X12596" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id23599X12596" name="obelisk:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="add_mgmt_ssh_rule_when_stoped">False</Option>
|
|
<Option name="add_rules_for_ipv6_neighbor_discovery">False</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="clear_unknown_interfaces">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_bonding_interfaces">False</Option>
|
|
<Option name="configure_bridge_interfaces">False</Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="configure_vlan_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"># rates are in mbit/sec
|
|
|
|
DEV=eth0
|
|
RATE_DEFAULT=100
|
|
RATE_GARNTD=20
|
|
RATE_LIMIT=10
|
|
|
|
tc qdisc del dev $DEV root >/dev/null 2>&1
|
|
|
|
# Only works on egress
|
|
# tc qdisc add dev $DEV root handle 1: htb default 30
|
|
# tc class add dev $DEV parent 1:1 classid 1:10 htb rate 3mbit ceil 6mbit burst 15k
|
|
# tc class add dev $DEV parent 1:1 classid 1:30 htb rate 50bit ceil 100mbit burst 15k
|
|
# tc qdisc add dev $DEV parent 1:10 handle 10: sfq perturb 10
|
|
# tc qdisc add dev $DEV parent 1:30 handle 30: sfq perturb 10
|
|
|
|
tc qdisc del dev $DEV ingress >/dev/null 2>&1
|
|
tc qdisc add dev eth0 handle ffff:fff1 ingress
|
|
tc filter add dev eth0 parent ffff:fff1 protocol ip prio 50 handle 1 fw police rate 3mbit burst 18k drop flowid :1
|
|
</Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="ipv4_6_order">ipv4_first</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="scpArgs"></Option>
|
|
<Option name="script_name_on_firewall"></Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_m_set">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id22486X20645" host_OS="linux24" inactive="False" lastCompiled="1338489724" lastInstalled="0" lastModified="1451582445" platform="iptables" version="" name="probe-1P-DS-igbr" comment="" ro="False">
|
|
<NAT id="id22743X20645" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id22502X20645" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id22504X20645" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id22497X20645"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id22532X20645" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id22486X20645"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id22560X20645" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id24376X21016"/>
|
|
<ObjectRef ref="id11245X6767"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id22486X20645"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id22595X20645" disabled="False" group="" log="False" position="3" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id22486X20645"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id22626X20645" disabled="False" group="" log="False" position="4" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id22654X20645" disabled="False" group="" log="False" position="5" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id22486X20645"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id22686X20645" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id22714X20645" disabled="False" group="" log="True" position="7" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id22746X20645" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id22494X20645" dedicated_failover="False" dyn="True" label="igbr1" mgmt="True" security_level="100" unnum="False" unprotected="False" name="igbr1" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id22497X20645" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id22500X20645" name="probe-1P-DS-igbr:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="add_mgmt_ssh_rule_when_stoped">False</Option>
|
|
<Option name="add_rules_for_ipv6_neighbor_discovery">False</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="clear_unknown_interfaces">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_bonding_interfaces">False</Option>
|
|
<Option name="configure_bridge_interfaces">False</Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="configure_vlan_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script">echo "Checking to see if tunnel needs to be opened up"
|
|
if [ $(iptables -L -n 2>&1 |grep -Ec '^ACCEPT|^DROP|^LOG') -gt 0 ]; then
|
|
echo -n "Firewall looks to be running"
|
|
if ip -o -4 addr |grep -q tun0; then
|
|
echo -n ", found tun0"
|
|
if [ -x /sbin/phoneHome ]; then
|
|
echo ", so running 'phoneHome -O'"
|
|
/sbin/phoneHome -O
|
|
else
|
|
echo ", but no phoneHome found"
|
|
fi
|
|
else
|
|
echo " but no tun0 interface"
|
|
fi
|
|
else
|
|
echo "Firewall not running"
|
|
fi
|
|
</Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="ipv4_6_order">ipv4_first</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="scpArgs"></Option>
|
|
<Option name="script_name_on_firewall"></Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_m_set">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id22992X9161" host_OS="linux24" inactive="False" lastCompiled="1338909057" lastInstalled="0" lastModified="1338908987" platform="iptables" version="" name="probe-4P-igbr-140" comment="" ro="False">
|
|
<NAT id="id23379X9161" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id23020X9161" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id23022X9161" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id23000X9161"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id23050X9161" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id22992X9161"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id23078X9161" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id13034X25856"/>
|
|
<ServiceRef ref="sg-DHCP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id23005X9161"/>
|
|
<ObjectRef ref="id23017X9161"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id23111X9161" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id22992X9161"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id23473X9161" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow returning cluster snmp">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id3DC75CE7"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id22992X9161"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id487E69D18872"/>
|
|
<ServiceRef ref="id3D703C85"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id23203X9161" disabled="False" group="" log="False" position="5" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id22992X9161"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id23262X9161" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id23290X9161" disabled="False" group="" log="False" position="7" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id22992X9161"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id23322X9161" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id23350X9161" disabled="False" group="" log="True" position="9" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id23382X9161" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id23000X9161" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id23003X9161" name="probe-4P-igbr-140:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id23005X9161" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em1" comment="eth0" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id23008X9161" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em2" comment="eth1" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id23011X9161" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p1" comment="eth2" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id23014X9161" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p2" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id23017X9161" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="igbr1" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id24036X9674" host_OS="linux24" inactive="False" lastCompiled="1451594036" lastInstalled="0" lastModified="1451582445" platform="iptables" version="" name="probe-1P-DS-igbr-148" comment="" ro="False">
|
|
<NAT id="id24293X9674" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id24052X9674" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id24054X9674" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id24047X9674"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id24082X9674" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id24036X9674"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id24453X9674" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id24376X21016"/>
|
|
<ObjectRef ref="id11245X6767"/>
|
|
<ObjectRef ref="id24390X9674"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id24036X9674"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id24110X9674" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id24376X21016"/>
|
|
<ObjectRef ref="id11245X6767"/>
|
|
<ObjectRef ref="id24668X9674"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id24036X9674"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id24145X9674" disabled="False" group="" log="False" position="4" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id24036X9674"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id24176X9674" disabled="False" group="" log="False" position="5" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id24204X9674" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id24036X9674"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id24236X9674" disabled="False" group="" log="False" position="7" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id24264X9674" disabled="False" group="" log="True" position="8" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id24296X9674" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id24044X9674" dedicated_failover="False" dyn="True" label="igbr1" mgmt="True" security_level="100" unnum="False" unprotected="False" name="igbr1" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id24047X9674" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id24050X9674" name="probe-1P-DS-igbr-148:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="add_mgmt_ssh_rule_when_stoped">False</Option>
|
|
<Option name="add_rules_for_ipv6_neighbor_discovery">False</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="clear_unknown_interfaces">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_bonding_interfaces">False</Option>
|
|
<Option name="configure_bridge_interfaces">False</Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="configure_vlan_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script">echo "Checking to see if tunnel needs to be opened up"
|
|
if [ $(iptables -L -n 2>&1 |grep -Ec '^ACCEPT|^DROP|^LOG') -gt 0 ]; then
|
|
echo -n "Firewall looks to be running"
|
|
if ip -o -4 addr |grep -q tun0; then
|
|
echo -n ", found tun0"
|
|
if [ -x /sbin/phoneHome ]; then
|
|
echo ", so running 'phoneHome -O'"
|
|
/sbin/phoneHome -O
|
|
else
|
|
echo ", but no phoneHome found"
|
|
fi
|
|
else
|
|
echo " but no tun0 interface"
|
|
fi
|
|
else
|
|
echo "Firewall not running"
|
|
fi
|
|
</Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="ipv4_6_order">ipv4_first</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="scpArgs"></Option>
|
|
<Option name="script_name_on_firewall"></Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_m_set">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id24510X10964" host_OS="linux24" inactive="False" lastCompiled="1344952084" lastInstalled="0" lastModified="1344952069" platform="iptables" version="" name="probe-4P-igbr-121" comment="" ro="False">
|
|
<NAT id="id24898X10964" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id24538X10964" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id24540X10964" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id24518X10964"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id24568X10964" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id24510X10964"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks"></Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id24997X10964" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Stateless? Working but was dropping pg closes">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id24523X10964"/>
|
|
<ObjectRef ref="id24535X10964"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="classification">False</Option>
|
|
<Option name="classify_str"></Option>
|
|
<Option name="connlimit_above_not">False</Option>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks"></Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode_dstip">False</Option>
|
|
<Option name="hashlimit_mode_dstport">False</Option>
|
|
<Option name="hashlimit_mode_srcip">False</Option>
|
|
<Option name="hashlimit_mode_srcport">False</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="ipt_continue">False</Option>
|
|
<Option name="ipt_gw"></Option>
|
|
<Option name="ipt_iif"></Option>
|
|
<Option name="ipt_mark_connections">False</Option>
|
|
<Option name="ipt_oif"></Option>
|
|
<Option name="ipt_tee">False</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="limit_value_not">False</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="routing">False</Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="tagging">False</Option>
|
|
<Option name="tagobject_id"></Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id24596X10964" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id13034X25856"/>
|
|
<ServiceRef ref="sg-DHCP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id24523X10964"/>
|
|
<ObjectRef ref="id24535X10964"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id24629X10964" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id24510X10964"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id24721X10964" disabled="False" group="" log="False" position="5" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id24510X10964"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
<ServiceRef ref="id23850X12651"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id24781X10964" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id24809X10964" disabled="False" group="" log="False" position="7" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id24510X10964"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id24841X10964" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id24869X10964" disabled="False" group="" log="True" position="9" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id24901X10964" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id24518X10964" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id24521X10964" name="probe-4P-igbr-121:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id24523X10964" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em1" comment="eth0" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id24526X10964" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em2" comment="eth1" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id24529X10964" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p1" comment="eth2" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id24532X10964" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p2" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id24535X10964" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="igbr1" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id25802X22214" host_OS="linux24" inactive="False" lastCompiled="1325707369" lastInstalled="0" lastModified="1451582445" platform="iptables" version="" name="probe-1P-DS-160" comment="" ro="False">
|
|
<NAT id="id26060X22214" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id25818X22214" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id25820X22214" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id25813X22214"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id25848X22214" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id25802X22214"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id26422X22214" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id25802X22214"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id25876X22214" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id24376X21016"/>
|
|
<ObjectRef ref="id11245X6767"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id25802X22214"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id26498X22214" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow ftp">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id13139X31664"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id25802X22214"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id25912X22214" disabled="False" group="" log="False" position="5" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id25802X22214"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
<ServiceRef ref="id24575X12596"/>
|
|
<ServiceRef ref="id21485X19810"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id25943X22214" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id25971X22214" disabled="False" group="" log="False" position="7" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id25802X22214"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id26003X22214" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id26031X22214" disabled="False" group="" log="True" position="9" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id26063X22214" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id25810X22214" dedicated_failover="False" dyn="True" label="eth2" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth2" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id25813X22214" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id25816X22214" name="probe-1P-DS-160:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id26165X22214" dedicated_failover="False" dyn="True" label="eth3" mgmt="False" security_level="0" unnum="False" unprotected="False" name="eth3" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id26207X22214" dedicated_failover="False" dyn="True" label="eth4" mgmt="False" security_level="0" unnum="False" unprotected="False" name="eth4" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id26245X22214" dedicated_failover="False" dyn="True" label="eth5" mgmt="False" security_level="0" unnum="False" unprotected="False" name="eth5" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id26283X22214" dedicated_failover="False" dyn="True" label="bond0" mgmt="False" security_level="0" unnum="False" unprotected="False" name="bond0" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
<Interface id="id26325X22214" dedicated_failover="False" dyn="False" label="bond0.20" mgmt="False" security_level="0" unnum="False" unprotected="False" name="bond0.20" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">8021q</Option>
|
|
<Option name="vlan_id">20</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id26343X22214" dedicated_failover="False" dyn="True" label="bond0.300" mgmt="False" security_level="0" unnum="False" unprotected="False" name="bond0.300" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">8021q</Option>
|
|
<Option name="vlan_id">300</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="add_mgmt_ssh_rule_when_stoped">False</Option>
|
|
<Option name="add_rules_for_ipv6_neighbor_discovery">False</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="clear_unknown_interfaces">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_bonding_interfaces">False</Option>
|
|
<Option name="configure_bridge_interfaces">False</Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="configure_vlan_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script">echo "Checking to see if tunnel needs to be opened up"
|
|
if [ $(iptables -L -n 2>&1 |grep -Ec '^ACCEPT|^DROP|^LOG') -gt 0 ]; then
|
|
echo -n "Firewall looks to be running"
|
|
if ip -o -4 addr |grep -q tun0; then
|
|
echo -n ", found tun0"
|
|
if [ -x /sbin/phoneHome ]; then
|
|
echo ", so running 'phoneHome -O'"
|
|
/sbin/phoneHome -O
|
|
else
|
|
echo ", but no phoneHome found"
|
|
fi
|
|
else
|
|
echo " but no tun0 interface"
|
|
fi
|
|
else
|
|
echo "Firewall not running"
|
|
fi
|
|
</Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="ipv4_6_order">ipv4_first</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="scpArgs"></Option>
|
|
<Option name="script_name_on_firewall"></Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_m_set">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id26744X22214" host_OS="linux24" inactive="False" lastCompiled="1339424998" lastInstalled="0" lastModified="1363290334" platform="iptables" version="" name="probe-4P-igbr-157" comment="" ro="False">
|
|
<NAT id="id27132X22214" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id26772X22214" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id26774X22214" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id26752X22214"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id26802X22214" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id26744X22214"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id26830X22214" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id13034X25856"/>
|
|
<ServiceRef ref="sg-DHCP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id26757X22214"/>
|
|
<ObjectRef ref="id26769X22214"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id26863X22214" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id26744X22214"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id26898X22214" disabled="True" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow ftp">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id26744X22214"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id26927X22214" disabled="True" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Allow billingListener">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id26744X22214"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E2913D27246"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id26955X22214" disabled="False" group="" log="False" position="6" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id26744X22214"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
<ServiceRef ref="id23850X12651"/>
|
|
<ServiceRef ref="id27270X22214"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id26987X22214" disabled="True" group="" log="False" position="7" action="Accept" direction="Both" comment="Let the DNCS talk">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id49D4C8EC26647"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id26744X22214"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id27015X22214" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id27043X22214" disabled="False" group="" log="False" position="9" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id26744X22214"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id27075X22214" disabled="False" group="" log="False" position="10" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id27103X22214" disabled="False" group="" log="True" position="11" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id27135X22214" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id26752X22214" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id26755X22214" name="probe-4P-igbr-157:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id26757X22214" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em1" comment="eth0" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id26760X22214" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em2" comment="eth1" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id26763X22214" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p1" comment="eth2" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id26766X22214" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p2" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id26769X22214" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="igbr1" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id26669X10319" host_OS="linux24" inactive="False" lastCompiled="1369946042" lastInstalled="0" lastModified="1369946029" platform="iptables" version="" name="probe-4P-igbr-162" comment="" ro="False">
|
|
<NAT id="id27057X10319" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id26697X10319" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id26699X10319" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id26677X10319"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id26727X10319" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id26669X10319"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id26755X10319" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id13034X25856"/>
|
|
<ServiceRef ref="sg-DHCP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id26682X10319"/>
|
|
<ObjectRef ref="id26694X10319"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id26788X10319" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id26669X10319"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id26823X10319" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow ftp">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id26669X10319"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id26852X10319" disabled="False" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Allow billingListener">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id26669X10319"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E2913D27246"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id26880X10319" disabled="False" group="" log="False" position="6" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id26669X10319"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
<ServiceRef ref="id23850X12651"/>
|
|
<ServiceRef ref="id27123X10319"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id26912X10319" disabled="False" group="" log="False" position="7" action="Accept" direction="Both" comment="Let the DNCS talk">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id49D4C8EC26647"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id26669X10319"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id26940X10319" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id26968X10319" disabled="False" group="" log="False" position="9" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id26669X10319"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id27000X10319" disabled="False" group="" log="False" position="10" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id27028X10319" disabled="False" group="" log="True" position="11" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id27060X10319" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id26677X10319" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id26680X10319" name="probe-4P-igbr-162:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id26682X10319" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em1" comment="eth0" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id26685X10319" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em2" comment="eth1" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id26688X10319" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p1" comment="eth2" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id26691X10319" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p2" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id26694X10319" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="igbr1" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id26844X29239" host_OS="linux24" inactive="False" lastCompiled="1408042183" lastInstalled="0" lastModified="1408042157" platform="iptables" version="" name="probe-4P-igbr-166" comment="" ro="False">
|
|
<NAT id="id27232X29239" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id26872X29239" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id26874X29239" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id26852X29239"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id26902X29239" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id26844X29239"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id26930X29239" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id13034X25856"/>
|
|
<ServiceRef ref="sg-DHCP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id26857X29239"/>
|
|
<ObjectRef ref="id26869X29239"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id26963X29239" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id26844X29239"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id26998X29239" disabled="True" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow ftp">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id26844X29239"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id27027X29239" disabled="True" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Allow billingListener">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id26844X29239"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E2913D27246"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id27055X29239" disabled="False" group="" log="False" position="6" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id26844X29239"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
<ServiceRef ref="id27370X29239"/>
|
|
<ServiceRef ref="id28884X27061"/>
|
|
<ServiceRef ref="id28889X18774"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id27115X29239" disabled="False" group="" log="False" position="7" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id27143X29239" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id26844X29239"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id27175X29239" disabled="False" group="" log="False" position="9" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id27203X29239" disabled="False" group="" log="True" position="10" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id27235X29239" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id26852X29239" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id26855X29239" name="probe-4P-igbr-166:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id26857X29239" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em1" comment="eth0" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id26860X29239" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em2" comment="eth1" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id26863X29239" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p1" comment="eth2" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id26866X29239" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p2" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id26869X29239" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="igbr1" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id27416X19093" host_OS="linux24" inactive="False" lastCompiled="1384353989" lastInstalled="0" lastModified="1384353978" platform="iptables" version="" name="probe-4P-igbr-159" comment="" ro="False">
|
|
<NAT id="id27804X19093" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id27444X19093" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id27446X19093" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id27424X19093"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id27474X19093" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id27416X19093"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id27937X19093" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="Let back in snmp to cluster">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id27919X19093"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id27416X19093"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id487E69D18872"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id27438X19093"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id27502X19093" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id13034X25856"/>
|
|
<ServiceRef ref="sg-DHCP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id27429X19093"/>
|
|
<ObjectRef ref="id27441X19093"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id27535X19093" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id27416X19093"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id27627X19093" disabled="False" group="" log="False" position="5" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id27416X19093"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
<ServiceRef ref="id23850X12651"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id27687X19093" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id27715X19093" disabled="False" group="" log="False" position="7" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id27416X19093"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id27747X19093" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id27775X19093" disabled="False" group="" log="True" position="9" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks"></Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id27807X19093" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id27424X19093" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id27427X19093" name="probe-4P-igbr-159:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id27429X19093" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em1" comment="eth0" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id27432X19093" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em2" comment="eth1" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id27435X19093" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p1" comment="eth2" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id27438X19093" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p2" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id27441X19093" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="igbr1" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id27960X29630" host_OS="linux24" inactive="False" lastCompiled="1394548763" lastInstalled="0" lastModified="1451582445" platform="iptables" version="" name="probe-1P-DS-172" comment="" ro="False">
|
|
<NAT id="id28217X29630" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id27976X29630" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id27978X29630" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id27971X29630"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id28006X29630" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id27960X29630"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id28034X29630" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id24376X21016"/>
|
|
<ObjectRef ref="id11245X6767"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id27960X29630"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id28069X29630" disabled="False" group="" log="False" position="3" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id27960X29630"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
<ServiceRef ref="id24575X12596"/>
|
|
<ServiceRef ref="id28879X4933"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id28100X29630" disabled="False" group="" log="False" position="4" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id28128X29630" disabled="False" group="" log="False" position="5" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id27960X29630"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id28160X29630" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id28188X29630" disabled="False" group="" log="True" position="7" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id28220X29630" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id27968X29630" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id27971X29630" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id27974X29630" name="probe-1P-DS-172:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="add_mgmt_ssh_rule_when_stoped">False</Option>
|
|
<Option name="add_rules_for_ipv6_neighbor_discovery">False</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="clear_unknown_interfaces">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_bonding_interfaces">False</Option>
|
|
<Option name="configure_bridge_interfaces">False</Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="configure_vlan_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script">echo "Checking to see if tunnel needs to be opened up"
|
|
if [ $(iptables -L -n 2>&1 |grep -Ec '^ACCEPT|^DROP|^LOG') -gt 0 ]; then
|
|
echo -n "Firewall looks to be running"
|
|
if ip -o -4 addr |grep -q tun0; then
|
|
echo -n ", found tun0"
|
|
if [ -x /sbin/phoneHome ]; then
|
|
echo ", so running 'phoneHome -O'"
|
|
/sbin/phoneHome -O
|
|
else
|
|
echo ", but no phoneHome found"
|
|
fi
|
|
else
|
|
echo " but no tun0 interface"
|
|
fi
|
|
else
|
|
echo "Firewall not running"
|
|
fi
|
|
</Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="ipv4_6_order">ipv4_first</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="scpArgs"></Option>
|
|
<Option name="script_name_on_firewall"></Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_m_set">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id28372X29908" host_OS="linux24" inactive="False" lastCompiled="1394131775" lastInstalled="0" lastModified="1394131726" platform="iptables" version="" name="probe-4P-017" comment="" ro="False">
|
|
<NAT id="id28754X29908" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id28397X29908" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id28399X29908" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id28380X29908"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id28939X29908" disabled="False" group="" log="False" position="1" action="Deny" direction="Inbound" comment="">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id28932X29908"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AECF780"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id28427X29908" disabled="False" group="" log="True" position="2" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id28372X29908"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id28455X29908" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id28394X29908"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id28486X29908" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id28372X29908"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id28578X29908" disabled="False" group="" log="False" position="5" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id28372X29908"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id28637X29908" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id28665X29908" disabled="False" group="" log="False" position="7" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id28372X29908"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id28697X29908" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id28725X29908" disabled="False" group="" log="True" position="9" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id28757X29908" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id28380X29908" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id28383X29908" name="probe-4P-017:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id28385X29908" dedicated_failover="False" dyn="True" label="eth2" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth2" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id28388X29908" dedicated_failover="False" dyn="True" label="eth3" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth3" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id28391X29908" dedicated_failover="False" dyn="True" label="eth1" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth1" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id28394X29908" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id28938X11511" host_OS="linux24" inactive="False" lastCompiled="1415899142" lastInstalled="0" lastModified="1415898554" platform="iptables" version="" name="probe-4P-103" comment="" ro="False">
|
|
<NAT id="id29320X11511" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id28963X11511" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id28965X11511" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id28946X11511"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id28993X11511" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id28938X11511"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id29021X11511" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id13034X25856"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id28960X11511"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id29052X11511" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id28938X11511"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id29087X11511" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow ftp">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id28938X11511"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id29116X11511" disabled="False" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Allow billingListener">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id28938X11511"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E2913D27246"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id29144X11511" disabled="False" group="" log="False" position="6" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id28938X11511"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id29175X11511" disabled="False" group="" log="False" position="7" action="Accept" direction="Both" comment="Let the DNCS talk">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id49D4C8EC26647"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id28938X11511"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id29203X11511" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id29231X11511" disabled="False" group="" log="False" position="9" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id28938X11511"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id29263X11511" disabled="False" group="" log="False" position="10" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id29291X11511" disabled="False" group="" log="True" position="11" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id29323X11511" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id28946X11511" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id28949X11511" name="probe-4P-103:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id28951X11511" dedicated_failover="False" dyn="True" label="eth2" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth2" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id28954X11511" dedicated_failover="False" dyn="True" label="eth3" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth3" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id28957X11511" dedicated_failover="False" dyn="True" label="eth1" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth1" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id28960X11511" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id29538X2876" host_OS="linux24" inactive="False" lastCompiled="1418317711" lastInstalled="0" lastModified="1418317415" platform="iptables" version="" name="probe-4P-102" comment="" ro="False">
|
|
<NAT id="id29920X2876" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id29563X2876" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id29565X2876" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id29546X2876"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id29593X2876" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id29538X2876"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id29621X2876" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id13034X25856"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id29560X2876"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id29652X2876" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id29538X2876"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id29687X2876" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow ftp">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id29538X2876"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id29716X2876" disabled="True" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Allow billingListener">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id29538X2876"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E2913D27246"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id29744X2876" disabled="False" group="" log="False" position="6" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id29538X2876"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id29775X2876" disabled="False" group="" log="False" position="7" action="Accept" direction="Both" comment="Let the DNCS talk">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id49D4C8EC26647"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id29538X2876"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id29803X2876" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id29831X2876" disabled="False" group="" log="False" position="9" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id29538X2876"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id29863X2876" disabled="False" group="" log="False" position="10" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id29891X2876" disabled="False" group="" log="True" position="11" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id29923X2876" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id29546X2876" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id29549X2876" name="probe-4P-102:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id29551X2876" dedicated_failover="False" dyn="True" label="eth2" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth2" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id29554X2876" dedicated_failover="False" dyn="True" label="eth3" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth3" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id29557X2876" dedicated_failover="False" dyn="True" label="eth1" mgmt="False" security_level="100" unnum="False" unprotected="False" name="eth1" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id29560X2876" dedicated_failover="False" dyn="True" label="eth0" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id30754X32244" host_OS="linux24" inactive="False" lastCompiled="1339424998" lastInstalled="0" lastModified="1422549308" platform="iptables" version="" name="probe-4P-igbr-027" comment="" ro="False">
|
|
<NAT id="id31142X32244" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id30782X32244" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id30784X32244" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id30762X32244"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id30812X32244" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id30754X32244"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id30840X32244" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id13034X25856"/>
|
|
<ServiceRef ref="sg-DHCP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id30767X32244"/>
|
|
<ObjectRef ref="id30779X32244"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id30873X32244" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id30754X32244"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id30965X32244" disabled="False" group="" log="False" position="4" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id30754X32244"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
<ServiceRef ref="id12009X8217"/>
|
|
<ServiceRef ref="id30713X32244"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id31025X32244" disabled="False" group="" log="False" position="5" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id31053X32244" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id30754X32244"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id31085X32244" disabled="False" group="" log="False" position="7" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id31113X32244" disabled="False" group="" log="True" position="8" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id31145X32244" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id30762X32244" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id30765X32244" name="probe-4P-igbr-027:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id30767X32244" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em1" comment="eth0" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id30770X32244" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em2" comment="eth1" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id30773X32244" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p1" comment="eth2" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id30776X32244" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p2" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id30779X32244" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="igbr1" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id32379X2792" host_OS="linux24" inactive="False" lastCompiled="1423859992" lastInstalled="0" lastModified="1451582445" platform="iptables" version="" name="probe-4P-igbr-tun-182" comment="" ro="False">
|
|
<NAT id="id32636X2792" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id32395X2792" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id32397X2792" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id32390X2792"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id32425X2792" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id32379X2792"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id32453X2792" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id24376X21016"/>
|
|
<ObjectRef ref="id11245X6767"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id32379X2792"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id32488X2792" disabled="False" group="" log="False" position="3" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id32379X2792"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id32519X2792" disabled="False" group="" log="False" position="4" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id32547X2792" disabled="False" group="" log="False" position="5" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id32379X2792"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id32579X2792" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id32607X2792" disabled="False" group="" log="True" position="7" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id32639X2792" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id32387X2792" dedicated_failover="False" dyn="True" label="" mgmt="True" security_level="100" unnum="False" unprotected="False" name="em1" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id32390X2792" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id32393X2792" name="probe-4P-igbr-tun-182:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id32692X2792" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em2" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id32730X2792" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p1" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id32776X2792" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p2" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id32814X2792" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="igbr1" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id33189X2792" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="bond0" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="add_mgmt_ssh_rule_when_stoped">False</Option>
|
|
<Option name="add_rules_for_ipv6_neighbor_discovery">False</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="clear_unknown_interfaces">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_bonding_interfaces">False</Option>
|
|
<Option name="configure_bridge_interfaces">False</Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="configure_vlan_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script">echo "Checking to see if tunnel needs to be opened up"
|
|
if [ $(iptables -L -n 2>&1 |grep -Ec '^ACCEPT|^DROP|^LOG') -gt 0 ]; then
|
|
echo -n "Firewall looks to be running"
|
|
if ip -o -4 addr |grep -q tun0; then
|
|
echo -n ", found tun0"
|
|
if [ -x /sbin/phoneHome ]; then
|
|
echo ", so running 'phoneHome -O'"
|
|
/sbin/phoneHome -O
|
|
else
|
|
echo ", but no phoneHome found"
|
|
fi
|
|
else
|
|
echo " but no tun0 interface"
|
|
fi
|
|
else
|
|
echo "Firewall not running"
|
|
fi
|
|
</Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="ipv4_6_order">ipv4_first</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="scpArgs"></Option>
|
|
<Option name="script_name_on_firewall"></Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_m_set">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id32844X2792" host_OS="linux24" inactive="False" lastCompiled="1423079659" lastInstalled="0" lastModified="1451582445" platform="iptables" version="" name="probe-4P-igbr-tun" comment="" ro="False">
|
|
<NAT id="id33113X2792" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id32872X2792" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id32874X2792" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id32855X2792"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id32902X2792" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id32844X2792"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id32930X2792" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id24376X21016"/>
|
|
<ObjectRef ref="id11245X6767"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id32844X2792"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id32965X2792" disabled="False" group="" log="False" position="3" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id32844X2792"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id32996X2792" disabled="False" group="" log="False" position="4" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id33024X2792" disabled="False" group="" log="False" position="5" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id32844X2792"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id33056X2792" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id33084X2792" disabled="False" group="" log="True" position="7" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id33116X2792" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id32852X2792" dedicated_failover="False" dyn="True" label="em1" mgmt="True" security_level="100" unnum="False" unprotected="False" name="em1" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id32855X2792" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id32858X2792" name="probe-4P-igbr-tun:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id32860X2792" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em2" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id32863X2792" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p1" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id32866X2792" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p2" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id32869X2792" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="igbr1" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="add_mgmt_ssh_rule_when_stoped">False</Option>
|
|
<Option name="add_rules_for_ipv6_neighbor_discovery">False</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="clear_unknown_interfaces">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_bonding_interfaces">False</Option>
|
|
<Option name="configure_bridge_interfaces">False</Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="configure_vlan_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script">echo "Checking to see if tunnel needs to be opened up"
|
|
if [ $(iptables -L -n 2>&1 |grep -Ec '^ACCEPT|^DROP|^LOG') -gt 0 ]; then
|
|
echo -n "Firewall looks to be running"
|
|
if ip -o -4 addr |grep -q tun0; then
|
|
echo -n ", found tun0"
|
|
if [ -x /sbin/phoneHome ]; then
|
|
echo ", so running 'phoneHome -O'"
|
|
/sbin/phoneHome -O
|
|
else
|
|
echo ", but no phoneHome found"
|
|
fi
|
|
else
|
|
echo " but no tun0 interface"
|
|
fi
|
|
else
|
|
echo "Firewall not running"
|
|
fi
|
|
</Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="ipv4_6_order">ipv4_first</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="scpArgs"></Option>
|
|
<Option name="script_name_on_firewall"></Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_m_set">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id32704X14067" host_OS="linux24" inactive="False" lastCompiled="1451586176" lastInstalled="0" lastModified="1451582445" platform="iptables" version="" name="probe-1P-DS-ens160-192" comment="" ro="False">
|
|
<NAT id="id32961X14067" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id32720X14067" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id32722X14067" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id32715X14067"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id32750X14067" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id32704X14067"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id32778X14067" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id24376X21016"/>
|
|
<ObjectRef ref="id11245X6767"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id32704X14067"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id32813X14067" disabled="False" group="" log="False" position="3" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id32704X14067"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id32844X14067" disabled="False" group="" log="False" position="4" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id32872X14067" disabled="False" group="" log="False" position="5" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id32704X14067"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id32904X14067" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id32932X14067" disabled="False" group="" log="True" position="7" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id32964X14067" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id32712X14067" dedicated_failover="False" dyn="True" label="" mgmt="True" security_level="100" unnum="False" unprotected="False" name="ens160" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id32715X14067" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id32718X14067" name="probe-1P-DS-ens160-192:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="add_mgmt_ssh_rule_when_stoped">False</Option>
|
|
<Option name="add_rules_for_ipv6_neighbor_discovery">False</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="clear_unknown_interfaces">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_bonding_interfaces">False</Option>
|
|
<Option name="configure_bridge_interfaces">False</Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="configure_vlan_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script">echo "Checking to see if tunnel needs to be opened up"
|
|
if [ $(iptables -L -n 2>&1 |grep -Ec '^ACCEPT|^DROP|^LOG') -gt 0 ]; then
|
|
echo -n "Firewall looks to be running"
|
|
if ip -o -4 addr |grep -q tun0; then
|
|
echo -n ", found tun0"
|
|
if [ -x /sbin/phoneHome ]; then
|
|
echo ", so running 'phoneHome -O'"
|
|
/sbin/phoneHome -O
|
|
else
|
|
echo ", but no phoneHome found"
|
|
fi
|
|
else
|
|
echo " but no tun0 interface"
|
|
fi
|
|
else
|
|
echo "Firewall not running"
|
|
fi
|
|
</Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="ipv4_6_order">ipv4_first</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="scpArgs"></Option>
|
|
<Option name="script_name_on_firewall"></Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_m_set">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id33081X6465" host_OS="linux24" inactive="False" lastCompiled="1430233026" lastInstalled="0" lastModified="1430232999" platform="iptables" version="" name="probe-4P-igbr-193" comment="" ro="False">
|
|
<NAT id="id33469X6465" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id33109X6465" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id33111X6465" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id33089X6465"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id33139X6465" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id33081X6465"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id33167X6465" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id13034X25856"/>
|
|
<ServiceRef ref="sg-DHCP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id33094X6465"/>
|
|
<ObjectRef ref="id33106X6465"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id33200X6465" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id33081X6465"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id33235X6465" disabled="True" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow ftp">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id33081X6465"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id33264X6465" disabled="False" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Allow billingListener">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id33081X6465"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E2913D27246"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id33292X6465" disabled="False" group="" log="False" position="6" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id33081X6465"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
<ServiceRef ref="id33511X6465"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id33352X6465" disabled="False" group="" log="False" position="7" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id33380X6465" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id33081X6465"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id33412X6465" disabled="False" group="" log="False" position="9" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id33440X6465" disabled="False" group="" log="True" position="10" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id33472X6465" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id33089X6465" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id33092X6465" name="probe-4P-igbr-193:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id33094X6465" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em1" comment="eth0" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id33097X6465" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em2" comment="eth1" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id33100X6465" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p1" comment="eth2" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id33103X6465" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p2" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id33106X6465" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="igbr1" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id33613X6465" host_OS="linux24" inactive="False" lastCompiled="1430233089" lastInstalled="0" lastModified="1430233079" platform="iptables" version="" name="probe-4P-igbr-188" comment="" ro="False">
|
|
<NAT id="id33972X6465" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id33641X6465" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id33643X6465" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id33621X6465"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id33671X6465" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id33613X6465"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id33699X6465" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id13034X25856"/>
|
|
<ServiceRef ref="sg-DHCP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id33626X6465"/>
|
|
<ObjectRef ref="id33638X6465"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id33732X6465" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id33613X6465"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id33766X6465" disabled="True" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow ftp">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id33613X6465"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id33795X6465" disabled="False" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Allow billingListener">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id33613X6465"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E2913D27246"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id33823X6465" disabled="False" group="" log="False" position="6" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id33613X6465"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
<ServiceRef ref="id33511X6465"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id33855X6465" disabled="False" group="" log="False" position="7" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id33883X6465" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id33613X6465"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id33915X6465" disabled="False" group="" log="False" position="9" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id33943X6465" disabled="False" group="" log="True" position="10" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id33975X6465" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id33621X6465" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id33624X6465" name="probe-4P-igbr-188:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id33626X6465" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em1" comment="eth0" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id33629X6465" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em2" comment="eth1" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id33632X6465" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p1" comment="eth2" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id33635X6465" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p2" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id33638X6465" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="igbr1" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id36448X8920" host_OS="linux24" inactive="False" lastCompiled="1440788195" lastInstalled="0" lastModified="1440788102" platform="iptables" version="" name="probe-4P-igbr-179" comment="" ro="False">
|
|
<NAT id="id36836X8920" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id36476X8920" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id36478X8920" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id36456X8920"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id36506X8920" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id36448X8920"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id36534X8920" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id13034X25856"/>
|
|
<ServiceRef ref="sg-DHCP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id36461X8920"/>
|
|
<ObjectRef ref="id36473X8920"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id36567X8920" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id36448X8920"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id34912X11372" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow cluster ip snmp back in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id34996X11372"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id36448X8920"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id487E69D18872"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id34866X11372"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id36602X8920" disabled="False" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Allow ftp">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id36448X8920"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id36631X8920" disabled="False" group="" log="False" position="6" action="Accept" direction="Inbound" comment="Allow billingListener">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id36448X8920"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E2913D27246"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id36659X8920" disabled="False" group="" log="False" position="7" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id36448X8920"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
<ServiceRef ref="id23850X12651"/>
|
|
<ServiceRef ref="id36878X8920"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id36691X8920" disabled="False" group="" log="False" position="8" action="Accept" direction="Both" comment="Let the DNCS talk">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id49D4C8EC26647"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id36448X8920"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id36719X8920" disabled="False" group="" log="False" position="9" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id36747X8920" disabled="False" group="" log="False" position="10" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id36448X8920"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id36779X8920" disabled="False" group="" log="False" position="11" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id36807X8920" disabled="False" group="" log="True" position="12" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id36839X8920" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id36456X8920" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id36459X8920" name="probe-4P-igbr-179:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id36461X8920" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em1" comment="eth0" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id36464X8920" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em2" comment="eth1" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id36467X8920" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p1" comment="eth2" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id36470X8920" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p2" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id36473X8920" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="igbr1" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id34866X11372" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="bond0" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id34916X8179" host_OS="linux24" inactive="False" lastCompiled="1451663031" lastInstalled="0" lastModified="1451582445" platform="iptables" version="" name="probe-4P-igbr-tun-027" comment="" ro="False">
|
|
<NAT id="id35185X8179" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id34944X8179" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id34946X8179" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id34927X8179"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id34974X8179" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id34916X8179"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id35002X8179" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id24376X21016"/>
|
|
<ObjectRef ref="id11245X6767"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id34916X8179"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id35037X8179" disabled="False" group="" log="False" position="3" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id34916X8179"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
<ServiceRef ref="id35251X8179"/>
|
|
<ServiceRef ref="id35290X8179"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id35068X8179" disabled="False" group="" log="False" position="4" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id35096X8179" disabled="False" group="" log="False" position="5" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id34916X8179"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id35128X8179" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id35156X8179" disabled="False" group="" log="True" position="7" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id35188X8179" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id34924X8179" dedicated_failover="False" dyn="True" label="em1" mgmt="True" security_level="100" unnum="False" unprotected="False" name="em1" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id34927X8179" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id34930X8179" name="probe-4P-igbr-tun-027:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id34932X8179" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em2" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id34935X8179" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p1" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id34938X8179" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p2" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id34941X8179" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="igbr1" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="add_mgmt_ssh_rule_when_stoped">False</Option>
|
|
<Option name="add_rules_for_ipv6_neighbor_discovery">False</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="clear_unknown_interfaces">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_bonding_interfaces">False</Option>
|
|
<Option name="configure_bridge_interfaces">False</Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="configure_vlan_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script">echo "Checking to see if tunnel needs to be opened up"
|
|
if [ $(iptables -L -n 2>&1 |grep -Ec '^ACCEPT|^DROP|^LOG') -gt 0 ]; then
|
|
echo -n "Firewall looks to be running"
|
|
if ip -o -4 addr |grep -q tun0; then
|
|
echo -n ", found tun0"
|
|
if [ -x /sbin/phoneHome ]; then
|
|
echo ", so running 'phoneHome -O'"
|
|
/sbin/phoneHome -O
|
|
else
|
|
echo ", but no phoneHome found"
|
|
fi
|
|
else
|
|
echo " but no tun0 interface"
|
|
fi
|
|
else
|
|
echo "Firewall not running"
|
|
fi
|
|
</Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="ipv4_6_order">ipv4_first</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="scpArgs"></Option>
|
|
<Option name="script_name_on_firewall"></Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_m_set">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id35360X14376" host_OS="linux24" inactive="False" lastCompiled="1450385745" lastInstalled="0" lastModified="1451582445" platform="iptables" version="" name="probe-1P-DS-181" comment="" ro="False">
|
|
<NAT id="id35617X14376" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id35376X14376" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id35378X14376" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id35371X14376"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id35406X14376" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id35360X14376"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id35434X14376" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id24376X21016"/>
|
|
<ObjectRef ref="id11245X6767"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id35360X14376"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id35469X14376" disabled="False" group="" log="False" position="3" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id35360X14376"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id35500X14376" disabled="False" group="" log="False" position="4" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id35528X14376" disabled="False" group="" log="False" position="5" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id35360X14376"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id35560X14376" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id35588X14376" disabled="False" group="" log="True" position="7" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id35620X14376" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id35368X14376" dedicated_failover="False" dyn="True" label="eth8" mgmt="True" security_level="100" unnum="False" unprotected="False" name="eth8" comment="" ro="False">
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id35371X14376" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id35374X14376" name="probe-1P-DS-181:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="add_mgmt_ssh_rule_when_stoped">False</Option>
|
|
<Option name="add_rules_for_ipv6_neighbor_discovery">False</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="clear_unknown_interfaces">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_bonding_interfaces">False</Option>
|
|
<Option name="configure_bridge_interfaces">False</Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="configure_vlan_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script">echo "Checking to see if tunnel needs to be opened up"
|
|
if [ $(iptables -L -n 2>&1 |grep -Ec '^ACCEPT|^DROP|^LOG') -gt 0 ]; then
|
|
echo -n "Firewall looks to be running"
|
|
if ip -o -4 addr |grep -q tun0; then
|
|
echo -n ", found tun0"
|
|
if [ -x /sbin/phoneHome ]; then
|
|
echo ", so running 'phoneHome -O'"
|
|
/sbin/phoneHome -O
|
|
else
|
|
echo ", but no phoneHome found"
|
|
fi
|
|
else
|
|
echo " but no tun0 interface"
|
|
fi
|
|
else
|
|
echo "Firewall not running"
|
|
fi
|
|
</Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="ipv4_6_order">ipv4_first</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="scpArgs"></Option>
|
|
<Option name="script_name_on_firewall"></Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_m_set">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id35819X8626" host_OS="linux24" inactive="False" lastCompiled="1460134661" lastInstalled="0" lastModified="1460134649" platform="iptables" version="" name="probe-4P-igbr-203" comment="" ro="False">
|
|
<NAT id="id36207X8626" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id35847X8626" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id35849X8626" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id35827X8626"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id35877X8626" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id35819X8626"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id35905X8626" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id13034X25856"/>
|
|
<ServiceRef ref="sg-DHCP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id35832X8626"/>
|
|
<ObjectRef ref="id35844X8626"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id35938X8626" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id35819X8626"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="id47E325C828713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id36002X8626" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow traffic to virtual ip return from current active ip">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id36249X8626"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id35819X8626"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id487E69D18872"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id35835X8626"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id35973X8626" disabled="True" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Allow ftp">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id35819X8626"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id36030X8626" disabled="False" group="" log="False" position="6" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id35819X8626"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
<ServiceRef ref="id23850X12651"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id36090X8626" disabled="False" group="" log="False" position="7" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id36118X8626" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id35819X8626"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id36150X8626" disabled="False" group="" log="False" position="9" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id36178X8626" disabled="False" group="" log="True" position="10" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id36210X8626" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id35827X8626" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id35830X8626" name="probe-4P-igbr-203:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id35832X8626" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em1" comment="eth0" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id35835X8626" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em2" comment="eth1" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id35838X8626" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p1" comment="eth2" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id35841X8626" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p2" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id35844X8626" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="igbr1" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id36393X22383" host_OS="linux24" inactive="False" lastCompiled="1464376843" lastInstalled="0" lastModified="1464376827" platform="iptables" version="" name="probe-4P-igbr-002" comment="" ro="False">
|
|
<NAT id="id36781X22383" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id36421X22383" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id36423X22383" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id36401X22383"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id36916X22383" disabled="False" group="" log="True" position="1" action="Accept" direction="Both" comment="Watch traffic">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id36393X22383"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id36985X22383"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id36451X22383" disabled="False" group="" log="True" position="2" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id36393X22383"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id36479X22383" disabled="False" group="" log="False" position="3" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id13034X25856"/>
|
|
<ServiceRef ref="sg-DHCP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id36406X22383"/>
|
|
<ObjectRef ref="id36418X22383"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id36512X22383" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id36393X22383"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id36547X22383" disabled="True" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Allow ftp">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id36393X22383"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3E7553BC"/>
|
|
<ServiceRef ref="tcp-FTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">False</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id36604X22383" disabled="False" group="" log="False" position="6" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id36393X22383"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id36664X22383" disabled="False" group="" log="False" position="7" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id36692X22383" disabled="False" group="" log="False" position="8" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id36393X22383"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id36724X22383" disabled="False" group="" log="False" position="9" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id36752X22383" disabled="False" group="" log="True" position="10" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id36784X22383" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id36401X22383" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id36404X22383" name="probe-4P-igbr-002:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id36406X22383" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em1" comment="eth0" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id36409X22383" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em2" comment="eth1" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id36412X22383" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p1" comment="eth2" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id36415X22383" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p2" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id36418X22383" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="igbr1" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
<Firewall id="id38099X21917" host_OS="linux24" inactive="False" lastCompiled="1469458223" lastInstalled="0" lastModified="1469458125" platform="iptables" version="" name="probe-4P-igbr-198" comment="" ro="False">
|
|
<NAT id="id38487X21917" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</NAT>
|
|
<Policy id="id38127X21917" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<PolicyRule id="id38129X21917" disabled="False" group="" log="False" position="0" action="Accept" direction="Both" comment="Allow anything on loopback">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id38107X21917"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id38157X21917" disabled="False" group="" log="True" position="1" action="Deny" direction="Inbound" comment="Anti-spoofing rule">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id38099X21917"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level">warning</Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id38185X21917" disabled="False" group="" log="False" position="2" action="Accept" direction="Both" comment="Allow services on eth0">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id480EAF3C9882"/>
|
|
<ServiceRef ref="id485299531213"/>
|
|
<ServiceRef ref="id3B4FF0EA"/>
|
|
<ServiceRef ref="id3AECF776"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="id38112X21917"/>
|
|
<ObjectRef ref="id38124X21917"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id38218X21917" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Allow services in">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id38099X21917"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id3AED0D69"/>
|
|
<ServiceRef ref="id3AECF780"/>
|
|
<ServiceRef ref="udp-SNMP"/>
|
|
<ServiceRef ref="tcp-SSH"/>
|
|
<ServiceRef ref="icmp-ping_request"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id47E3235028713"/>
|
|
<ServiceRef ref="tcp-SMTP"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id38310X21917" disabled="False" group="" log="False" position="4" action="Accept" direction="Outbound" comment="Allow services out">
|
|
<Src neg="False">
|
|
<ObjectRef ref="id38099X21917"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="id47E28F0727246"/>
|
|
<ServiceRef ref="id47E28F0A27246"/>
|
|
<ServiceRef ref="id47E2C92728661"/>
|
|
<ServiceRef ref="id3AED0D8C"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id38370X21917" disabled="False" group="" log="False" position="5" action="Deny" direction="Inbound" comment="Ignore customer incoming broadcasts">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3F6D115C"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id38398X21917" disabled="False" group="" log="False" position="6" action="Deny" direction="Inbound" comment="Ignore chatty stuff">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id38099X21917"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sg-NETBIOS"/>
|
|
<ServiceRef ref="id480E4A4B9882"/>
|
|
<ServiceRef ref="udp-bootpc"/>
|
|
<ServiceRef ref="id480E5BDA9882"/>
|
|
<ServiceRef ref="udp-bootps"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id38430X21917" disabled="False" group="" log="False" position="7" action="Deny" direction="Inbound" comment="Ignore multicast">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="id3DC75CEC"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<PolicyRule id="id38458X21917" disabled="False" group="" log="True" position="8" action="Deny" direction="Both" comment="Deny and log catch all">
|
|
<Src neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Src>
|
|
<Dst neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Dst>
|
|
<Srv neg="False">
|
|
<ServiceRef ref="sysid1"/>
|
|
</Srv>
|
|
<Itf neg="False">
|
|
<ObjectRef ref="sysid0"/>
|
|
</Itf>
|
|
<When neg="False">
|
|
<IntervalRef ref="sysid2"/>
|
|
</When>
|
|
<PolicyRuleOptions>
|
|
<Option name="connlimit_masklen">0</Option>
|
|
<Option name="connlimit_value">0</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
|
<Option name="hashlimit_burst">0</Option>
|
|
<Option name="hashlimit_dstlimit">False</Option>
|
|
<Option name="hashlimit_expire">0</Option>
|
|
<Option name="hashlimit_gcinterval">0</Option>
|
|
<Option name="hashlimit_max">0</Option>
|
|
<Option name="hashlimit_mode">dstip</Option>
|
|
<Option name="hashlimit_name"></Option>
|
|
<Option name="hashlimit_size">0</Option>
|
|
<Option name="hashlimit_suffix"></Option>
|
|
<Option name="hashlimit_value">0</Option>
|
|
<Option name="limit_burst">0</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="log_level"></Option>
|
|
<Option name="log_prefix"></Option>
|
|
<Option name="pf_classify_str"></Option>
|
|
<Option name="stateless">True</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
</PolicyRuleOptions>
|
|
</PolicyRule>
|
|
<RuleSetOptions/>
|
|
</Policy>
|
|
<Routing id="id38490X21917" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
|
|
<RuleSetOptions/>
|
|
</Routing>
|
|
<Interface id="id38107X21917" dedicated_failover="False" dyn="False" label="loopback" security_level="100" unnum="False" unprotected="False" name="lo" comment="" ro="False">
|
|
<IPv4 id="id38110X21917" name="probe-4P-igbr-198:lo:ip" comment="" ro="False" address="127.0.0.1" netmask="255.0.0.0"/>
|
|
<InterfaceOptions/>
|
|
</Interface>
|
|
<Interface id="id38112X21917" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em1" comment="eth0" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id38115X21917" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="em2" comment="eth1" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id38118X21917" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p1" comment="eth2" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id38121X21917" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="p1p2" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Interface id="id38124X21917" dedicated_failover="False" dyn="True" label="" mgmt="False" security_level="0" unnum="False" unprotected="False" name="igbr1" comment="" ro="False">
|
|
<InterfaceOptions>
|
|
<Option name="type">ethernet</Option>
|
|
</InterfaceOptions>
|
|
</Interface>
|
|
<Management address="0.0.0.0">
|
|
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
|
<FWBDManagement enabled="False" identity="" port="-1"/>
|
|
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
|
</Management>
|
|
<FirewallOptions>
|
|
<Option name="accept_established">True</Option>
|
|
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
|
<Option name="action_on_reject"></Option>
|
|
<Option name="activationCmd"></Option>
|
|
<Option name="add_check_state_rule">true</Option>
|
|
<Option name="admUser"></Option>
|
|
<Option name="altAddress"></Option>
|
|
<Option name="bridging_fw">False</Option>
|
|
<Option name="check_shading">True</Option>
|
|
<Option name="clamp_mss_to_mtu">False</Option>
|
|
<Option name="classify_mark_terminating">False</Option>
|
|
<Option name="cmdline"></Option>
|
|
<Option name="compiler"></Option>
|
|
<Option name="configure_interfaces">False</Option>
|
|
<Option name="debug">False</Option>
|
|
<Option name="drop_invalid">False</Option>
|
|
<Option name="eliminate_duplicates">true</Option>
|
|
<Option name="epilog_script"></Option>
|
|
<Option name="firewall_dir">/etc</Option>
|
|
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
|
<Option name="freebsd_ip_forward">1</Option>
|
|
<Option name="ignore_empty_groups">False</Option>
|
|
<Option name="in_out_code">true</Option>
|
|
<Option name="limit_suffix"></Option>
|
|
<Option name="limit_value">0</Option>
|
|
<Option name="linux24_accept_redirects"></Option>
|
|
<Option name="linux24_accept_source_route"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
|
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
|
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
|
<Option name="linux24_ip_dynaddr"></Option>
|
|
<Option name="linux24_ip_forward"></Option>
|
|
<Option name="linux24_log_martians"></Option>
|
|
<Option name="linux24_path_ip">/sbin/ip</Option>
|
|
<Option name="linux24_path_iptables">/sbin/iptables</Option>
|
|
<Option name="linux24_path_iptables_restore">/sbin/iptables-restore</Option>
|
|
<Option name="linux24_path_logger">/usr/bin/logger</Option>
|
|
<Option name="linux24_path_lsmod">/sbin/lsmod</Option>
|
|
<Option name="linux24_path_modprobe">/sbin/modprobe</Option>
|
|
<Option name="linux24_rp_filter"></Option>
|
|
<Option name="linux24_tcp_ecn"></Option>
|
|
<Option name="linux24_tcp_fack"></Option>
|
|
<Option name="linux24_tcp_fin_timeout">0</Option>
|
|
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
|
<Option name="linux24_tcp_sack"></Option>
|
|
<Option name="linux24_tcp_syncookies"></Option>
|
|
<Option name="linux24_tcp_timestamps"></Option>
|
|
<Option name="linux24_tcp_window_scaling"></Option>
|
|
<Option name="load_modules">True</Option>
|
|
<Option name="local_nat">False</Option>
|
|
<Option name="log_all">False</Option>
|
|
<Option name="log_all_dropped">False</Option>
|
|
<Option name="log_invalid">False</Option>
|
|
<Option name="log_ip_opt">True</Option>
|
|
<Option name="log_level">info</Option>
|
|
<Option name="log_prefix">FW-RULE %N -- %A </Option>
|
|
<Option name="log_tcp_opt">True</Option>
|
|
<Option name="log_tcp_seq">False</Option>
|
|
<Option name="loopback_interface">lo0</Option>
|
|
<Option name="macosx_ip_forward">1</Option>
|
|
<Option name="manage_virtual_addr">False</Option>
|
|
<Option name="mgmt_addr"></Option>
|
|
<Option name="mgmt_ssh">False</Option>
|
|
<Option name="no_ipv6_default_policy">False</Option>
|
|
<Option name="openbsd_ip_forward">1</Option>
|
|
<Option name="output_file"></Option>
|
|
<Option name="pass_all_out">false</Option>
|
|
<Option name="pf_limit_frags">5000</Option>
|
|
<Option name="pf_limit_states">10000</Option>
|
|
<Option name="pf_scrub_maxmss">1460</Option>
|
|
<Option name="pf_timeout_frag">30</Option>
|
|
<Option name="pf_timeout_interval">10</Option>
|
|
<Option name="pix_add_clear_statements">true</Option>
|
|
<Option name="pix_assume_fw_part_of_any">true</Option>
|
|
<Option name="pix_default_logint">300</Option>
|
|
<Option name="pix_emblem_log_format">false</Option>
|
|
<Option name="pix_emulate_out_acl">true</Option>
|
|
<Option name="pix_floodguard">true</Option>
|
|
<Option name="pix_include_comments">true</Option>
|
|
<Option name="pix_route_dnat_supported">true</Option>
|
|
<Option name="pix_rule_syslog_settings">false</Option>
|
|
<Option name="pix_security_fragguard_supported">true</Option>
|
|
<Option name="pix_syslog_device_id_supported">false</Option>
|
|
<Option name="pix_use_acl_remarks">true</Option>
|
|
<Option name="prolog_place">top</Option>
|
|
<Option name="prolog_script"></Option>
|
|
<Option name="prompt1">$ </Option>
|
|
<Option name="prompt2"> # </Option>
|
|
<Option name="solaris_ip_forward">1</Option>
|
|
<Option name="sshArgs"></Option>
|
|
<Option name="ulog_cprange">0</Option>
|
|
<Option name="ulog_nlgroup">1</Option>
|
|
<Option name="ulog_qthreshold">1</Option>
|
|
<Option name="use_ULOG">False</Option>
|
|
<Option name="use_iptables_restore">False</Option>
|
|
<Option name="use_numeric_log_levels">False</Option>
|
|
<Option name="verify_interfaces">True</Option>
|
|
</FirewallOptions>
|
|
</Firewall>
|
|
</ObjectGroup>
|
|
<IntervalGroup id="id47DFE1951934" name="Time" comment="" ro="False"/>
|
|
</Library>
|
|
</FWObjectDatabase>
|