Documentation Home
> SunScreen EFS Release 3.0 Reference Manual
SunScreen EFS Release 3.0 Reference Manual
Book Information
Preface
Chapter 1 SunScreen EFS 3.0 Overview
What Is SunScreen EFS 3.0?
SunScreen EFS 3.0 Features
Software and Hardware Requirements
Required Patches
Java Plug-In Software
Compatibility With Other SunScreen Products
Online Help and Documentation
Chapter 2 SunScreen EFS 3.0 Concepts
Security Considerations
Define Screen's Name Properly
How SunScreen EFS 3.0 Works
How SunScreen EFS 3.0 Uses Encryption
Remote and Local Administration
Remote Administration
Local Administration
Centralized Management of Firewall Groups
Setting Up Access Control
Policy Versions
Routing and Stealth Modes
Routing Mode
Stealth Mode
SunScreen EFS 3.0 Functions
SunScreen EFS 3.0 Function Details
Dynamic Packet Filtering
Network Address Translation (NAT)
Static NAT
Dynamic NAT
NAT Examples
Applying NAT
NAT and Mapping Collisions
High Availability (HA)
HA Policy
HA Network Connections and Failovers
HA Alerts
Time-Based Rules
User Authentication
Authorized Users
Proxy Users
Event Logging With Proxies
Encryption and Decryption
Address Management
Individual IP Addresses
Address Ranges
Address Groups
Designing an Addressing Scheme
Services and Service Groups
Standard Services
Modifying or Creating New Services
Service Groups
Policy Rules
Rule Syntax
Example of a Rule Configuration
Tunneling and VPNs
Chapter 3 Administration Graphical User Interface Reference
Starting the Administration GUI
Administration Limitations
Elements of the Administration GUI
Welcome Page
Administration GUI Negotiating Buttons
Back and Forward Buttons
Documentation
Help System
Policies List Page
Policy Edit Page
Common Objects Area
Save Is Not Required With Some Common Objects
Common Objects
Policy Rules Page
Packet Filtering Rules
Administrative Access Rules
Local Administrative Access
Remote Administrative Access
NAT Rules
Virtual Private Network (VPN) Gateway Rules
Defining VPN Gateways
Adding a VPN Rule
Chapter 4 SunScreen EFS 3.0 Logs
Logging Limitations
Log File Locations
Configuring Traffic Log Size
Configuring the Global Default Log Size
Configuring the Log Size for a Specific Screen
Configuring Events to be Logged
Configuring Log Event Limiters
Log Retrieval and Clearing
Log Statistics
ssadm logstats Sub-Command
Log Inspection and Browsing
Log Filters and the logdump Command
logdump Extensions
Logged Network Packet Enhancements
General Event Type Enhancements
Log Record Format
Extended Log Event Enhancements
Log Filtering Macros
Displaying and Creating Log Macros
Log Macro Name and Body
Listing Log Macros
Log Macro Usage
Chapter 5 Proxies
How Proxies Work
Policy Rule Matching
Proxy User Authentication
Proxy Limitations
FTP Proxy
FTP Proxy Operation
FTP Proxy and Anonymous FTP
FTP Proxy Use
Other FTP Proxy Issues
HTTP Proxy
HTTP Proxy Operation
SMTP Proxy
SMTP Proxy Operation
Spam Control
Other Mail Configuration Issues
SMTP Proxy Rules
telnet Proxy
telnet Proxy Operation
Other telnet Proxy Issues
telnet Proxy Use
User Authentication
SunScreen EFS 3.0 User Model
Authorized Users
Proxy Users
Authorized User Object Definition
Authorized User Object Creation
Authorized User Authentication Processing Logic
Proxy User Object Definition
Proxy User Object Creation
Proxy User Processing Logic
Null Authentication
Referenced Authorized User Authentication
SPECIAL External Method Authentication
User Access Control Processing Logic
RADIUS User Authentication Processing Details
RADIUS Server Configuration
RADIUS Node Secret Configuration
Typical RADIUS Configuration
User Databases
authuser Database
proxyuser Database
RADIUS Authentication
RADIUS proxyuser References
RADIUS Client-->Server Rules
Other vars for RADIUS Configuration
Other RADIUS Protocol Items
RADIUS Testing
Command Access to the Screen
ACE/Server Rules
SunScreen EFS 3.0 ACE/Client Rules
ACE/Server Setup
SecurID Client Setup on a Routing-Mode Screen
SecurID PIN Server Rules
SecurID authuser Entities
SecurID User Authentication Processing Details
SecurID Stub Client
SecurID Access Paths
SecurID PIN Establishment
Typical SecurID Configuration
Other SecurID Details
HTTP proxy
HTTP Proxy Limitations
SMTP Proxy
SMTP Mail Handling
SMTP Proxy Filtering
Appendix A Migrating From Previous SunScreen Firewall Products
Appendix B Command Line Reference
What Is the Command Line?
Sub-Command man Pages
Unix (shell) Commands
ss_install Command
screenInstaller Command
adminInstaller Command
ss_client Command
ssadm Command
Executing an ssadm Command on a Local Screen
Executing an ssadm -r Command on a Remote Administration Station
ssadm Sub-Commands
ssadm Sub-Command Summary
activate Sub-Command
active Sub-Command
algorithm Sub-Command
backup Sub-Command
debug_level Sub-Command
edit Sub-Command
ha Sub-Command
lock Sub-Command
log Sub-Command
logdump Sub-Command
login Sub-Command
logout Sub-Command
logmacro Sub-Command
logstats Sub-Command
patch Sub-Command
policy Sub-Command
product Sub-Command
restore Sub-Command
spf2efs Sub-Command
sys_info Sub-Command
traffic_stats Sub-Command
Unsupported Commands
ssadm lib/screeninfo Command
ssadm lib/statetables -f Command
ssadm lib/support Command
ssadm SKIP Commands
Configuration Editor
Configuration Editor Data Model
Configuration Editor Commands
add Sub-Command
add address Sub-Command
add screen Sub-Command
add service Sub-Command
add interface Sub-Command
add certificate Sub-Command
add time Sub-Command
add rule Sub-Command
add nat Sub-Command
add accesslocal Sub-Command
add accessremote Sub-Command
add vpngateway Sub-Command
add_member Sub-Command
authuser Sub-Command
delete Sub-Command
delete_member Sub-Command
insert Sub-Command
jar_hash Sub-Command
jar_sig Sub-Command
list Sub-Command
list_name Sub-Command
load Sub-Command
lock Sub-Command
lock_status Sub-Command
search Sub-Command
move Sub-Command
replace Sub-Command
refer Sub-Command
referlist Sub-Command
rename Sub-Command
renamereference Sub-Command
save Sub-Command
reload Sub-Command
verify Sub-Command
mail_relay Sub-Command
mail_spam Sub-Command
proxyuser Sub-Command
vars Sub-Command
quit Sub-Command
QUIT Sub-Command
Network Monitoring and Maintenance
Installing a Patch
Examining Logged Packets (ssadm logdump)
Using the ssadm logdump Command
Session Records
Using the ssadm debug_level Command
Gathering Information From Your System to Report Support Issues
More Details About Creating New Services
IP Packets
ICMP Packets
TCP Services
UDP Protocols
NTP Traffic
Archie Traffic
RPC Traffic
Appendix C Services and State Engines
Standard Services
ftp Service
traceroute Service
ip Services
VDOLive Service
CoolTalk Service
nfs readonly Service
smtp (Electronic Mail) Service
www (World-Wide-Web Access) Service
dns Service
rip Service
sqlnet Services
realaudio Services
icmp Services
TCP Services
UDP Services
ntp Service
archie Service
rpc Service
Network Service Groups
State Engines
Characteristics of State Engines
dns State Engine
ftp State Engine
icmp State Engine
ip State Engine
ipfwd State Engine
ipmobile State Engine
iptunnel State Engine
nis State Engine
ping State Engine
pmap_nis State Engine
pmap_tcp State Engine
pmap_udp State Engine
realaudio State Engine
rpc_tcp State Engine
rpc_udp State Engine
rsh State Engine
sqlnet State Engine
tcp State Engine
tcpall State Engine
udp State Engine
udpall State Engine
udp_datagram State Engine
udp_stateless State Engine
Appendix D Error Messages
Error Messages From ssadm edit Component
Error Messages From ssadm activate Component
Error Messages From ssadm lock Component
Logged Packet Reasons
Appendix E Glossary
© 2010, Oracle Corporation and/or its affiliates