Configuration Editor Data Model

TABLE B-8 lists the data types that compose the Data Model as maintained by the configuration editor (ssadm edit) and the ssadm policy command.

Table B-8 Configuration Editor Object Type Name Summary

Object Type Name	Storage	Access Method	Description
address	common	named	Describe addresses of network elements
screen	common	named	Describe Screen objects and their relationships
state engine	common (read only)	named	Describe filtering capabilities of packet filter engine.
service	common	named	Define network services that can be filtered
interface	common	named	Describe network interfaces of a Screen.
certificate	common	named	Refer to certificate used for SKIP connections
time	common	named	Define time intervals for time-dependent rules
authuser	external	named	Describe users for administration and/or proxy access
proxyuser	external	named	Describe users for proxy access
jar_hash	external	named	Describe Java archive hash (for HTTP proxy applet filtering)
jar_sig	external	named	Describe Java archive signature (for HTTP proxy applet filtering)
logmacro	external	named	Define macro files
mail_relay	external	named	Describe mail relays (for SMTP proxy mail filtering)
mail_spam	external	named	Describe spam domains (for SMTP proxy mail filtering)
policy	policy list	named	Provide multiple, named polices for storing different configurations
filter rule	policy	ordered	Describe network traffic flow policy
nat rule	policy	ordered	Describe NAT translations
local access rule	policy	ordered	Describe who can access the Screen for local administration and what they can do.
remote access rule	policy	ordered	Describe who can access the Screen for remote administration and what they can do.
VPN gateway	policy	ordered	Describe how VPN hosts are protected behind certificates and tunnels
VPN	policy	ordered	Virtual object representing a collection of VPN gateways

Object types marked as having common storage in the table are normally stored in the common objects registry that is not part of any particular policy. These objects are used by all policies, so changes to the common objects can affect the behavior of multiple policies. To edit the common objects, it is necessary to specify a policy name when starting the configuration editor even if you are not modifying any policy objects.

Object types marked as having policy storage in the table are stored as part of a policy. Policy objects often refer to common objects and, therefore, can have different meaning depending on the value of common objects. For example, a policy can contain a rule object that allows address A to communicate with address B. The address objects A and B are defined in the common objects.

Object types marked as having external storage in the table are almost equivalent to common objects, but they are stored in a separate database that is not affected by the quit, reload, or save commands. Changes to these objects are always immediate, and persist even if the save command is not used.

Object types marked as having policy list storage in the table represents the names of the policies themselves. Minimal capabilities are provided by the configuration editor to manage the policy. A policy currently being edited can be saved or cloned (or portions of it) into a new policy. Other policy requests, such as add, delete, and rename are provided by the ssadm policy command.