Limitations

The SunScreen Lite firewall does not support some features that are available in SunScreen. A SunScreen Lite firewall:

• Does not support stealth-mode operation.

• If you have more than two interfaces and ip_forwarding is on, cannot support more than two routing interfaces. Any additional interfaces that are configured on this system will not have filtering rules applied to them. Note that Lite supports virtually unlimited routing interfaces when the Screen is not acting as a router--when ip_forwarding is turned off. This is ideal for protecting server systems that have multiple interfaces for connectivity, administration, and backup, but that are not routing packets between interfaces.

• Does not support and cannot create the ADMIN, HA, or STEALTH interfaces.

• Cannot support more than ten unregistered IP addresses that can be translated to registered addresses using network address translation (NAT); it is limited to two NAT rules.

• Cannot be a member of a high availability (HA) cluster.

• Cannot create and cannot be made the primary Screen in a centralized management group (CMG).

• Does not support proxies.

• Does not support and cannot create time objects.

• Ignores the time-of-day field in rules.