Table Of Contents

Symbols - Numerics - A - B - C - D - E - F - G - H - I - K - L - M - N - O - P - R - S - T - U - V - W - X - Z

Index

Symbols

# (number sign) 11-4

* (wildcard) 3-7, 5-6, 11-3

Numerics

1-Gbps and 2-Gbps bandwidth options

displaying software license key 12-2

displaying software version 12-2

understanding 1-6

upgrading to 2 Gbps 13-17

2-Gbps operation upgrade

activating additional data port 13-18

regenerating SSL certificates 13-18

A

AAA

accounting 4-14

authentication 4-6

authorization 4-12

configuring 4-5

aaa accounting command 4-14

aaa authentication command 4-6

aaa authorization command 4-12

accounting, configuring 4-14

action command 7-19

action flow 11-6

add-service command 7-10

admin privilege level 3-2, 4-7

always-accept 7-21

always-ignore 7-21

anomaly

detected 11-2

flow 11-3

anomaly detection engine memory usage 12-25, 12-27

AP

booting to 2-12

clearing configuration 13-19

clearing passwords 13-19, 13-22

upgrading 13-10

upgrading, inline 13-13

application partition

See AP

attack report

copying 11-7

detected anomalies 11-2

exporting 11-7, 13-6

exporting automatically 11-7

layout 11-1

notify 11-4

statistics 11-2

timing 11-1

viewing 11-4

attack types 11-5

authentication, configuring 4-6

authorization

configuring 4-9, 4-10

disabling zone command completion 4-13, 5-7

auth packet types 7-11

automatic detect mode 1-5

automatic protection mode 9-3

automatic protect mode 9-3, 10-1

B

bandwidth options

displaying software license key 12-2

displaying software version 12-2

understanding 1-6

upgrading to 2 Gbps 13-17

banner, configuring login 4-32

Berkeley Packet filter 6-7

boot command 2-12

burn flash 13-15

bypass filter

command 6-11

configuring 6-10

definition 1-5, 6-1

deleting 6-12

displaying 6-11

C

capture, packets 12-15

CFE 13-11, 13-14, 13-15

clear ap config command 13-19

clear ap password command 13-19, 13-22

clear counters command 3-9, 12-6

clear log command 12-12

CLI

changing prompt 4-27

command shortcuts 3-7

error messages 3-5

getting help 3-6

issuing commands 3-4

TAB completion 3-6

using 3-2

command completion 4-13

command line interface

See CLI 3-2

commands, deactivating 3-5

command shortcuts 3-7

config privilege level 3-2, 4-7

configuration, supervisor engine

saving 2-1

configuration file

copying 13-3

exporting 13-3

importing 13-4

viewing 12-3

configuration mode

accessing 4-13

described 3-3

configure command 2-10, 3-7

constructing policies 8-4

copy commands

ftp running-config 13-4

log 12-10, 12-11

packet-dump 12-17

reports 11-7

running-config 5-16, 13-3

zone log 12-11

copy-from-this 5-6

copy guard-running-config command 5-16, 5-18

copy login-banner command 4-33

copy-policies command 8-17

copy wbm-logo command 4-34

counters

clearing 3-9, 12-6

history 12-5

counters, viewing 12-5

cpu utilization 12-26

D

DDoS

nonspoofed attacks 1-3

overview 1-2

spoofed attacks 1-3

zombies 1-3

deactivate command 9-5

deactivating commands 3-5

default configuration, returning to 13-19

default-gateway command 3-10

description command 5-7

detect

automatic mode 1-5

interactive mode 1-5, 9-3

detect command 9-5

detected

anomalies 11-2

flow 11-6

detected attack 11-5

DETECTOR_DEFAULT 5-3

DETECTOR_WORM 5-3

diff command 8-14, 8-15

disable command 7-7

disabling, automatic export 13-7

DNS

detected anomalies 11-2

TCP policy templates 7-3

tcp protocol flow 11-5

dst-ip-by-ip activation form 9-4, 9-7

dst-ip-by-name activation form 9-4

dst traffic characteristics 7-12

dynamic filter

1000 and more 6-14

command 6-15, 6-16, 9-9

definition 1-5

deleting 6-16

displaying 6-13

displaying events 12-9

overview 6-2, 6-13

preventing production of 6-16

sorting 6-13

worm 7-23

dynamic filters 10-2

dynamic privilege level 3-2, 4-8

E

enable

command 4-11, 7-7

password command 4-10

enabling services 4-2

entire-zone activation form 9-4

event log

activating 12-10

deactivating 12-10

event monitor command 12-10

export, disabling automatic 13-7

export command 13-6

packet-dump 12-17

reports 11-7

exporting

configuration file 13-3

log file 12-11

reports automatically 11-7

exporting GUARD configuration 5-16, 5-18

export sync-config command 5-17

extracting signatures 12-21

F

facility 12-10

file server

configuring 13-2

displaying sync-config 13-8

file-server

command 5-17, 13-2

configuring 13-2

deleting 13-3

displaying 13-3, 13-8

displaying sync-config 5-18, 13-7

filters

bypass 1-5, 6-10

dynamic 1-5, 6-2, 6-13

flex-content 1-5, 6-2

fixed-threshold 7-16

flash-burn command 13-16

flex-content filter

configuring 6-3

definition 1-5, 6-1

displaying 6-9

filtering criteria 6-2

renumbering 6-3

fragments 11-5

detected anomalies 11-2

policy template 7-3

G

generating signatures 12-21

global mode 3-3

global traffic characteristics 7-12

Guard

configuration mode 3-3

exporting configuration 13-6

GUARD_DEFAULT 5-3

GUARD_LINK 5-3, 5-4

GUARD_TCP_NO_PROXY 5-4

GUARD_ zone policy template 7-4

guard-conf command 5-11

GUARD configuration, exporting 5-16, 5-18

GUARD configuration, importing 5-16

Guard-protection activation methods 9-4

H

histogram command 7-23

host, logging 12-10

host keys

deleting 4-21

host keys, deleting 4-22

hostname

changing 4-27

command 4-27

HTTP

detected anomalies 11-2

policy template 7-3

hw-module command 13-10, 13-11, 13-12, 13-14, 13-19, 13-22

hw-module commands 2-11

hybrid 11-5

I

idle session, configuring timeout 4-35

idle session, displaying timeout 4-35

importing GUARD configuration 5-16

inline upgrade 13-13

in packet types 7-11

installation, verifying 2-2

interactive

operation mode 10-4

policy status 7-21

interactive detect mode 1-5, 9-3

interactive protect mode 10-1

interactive-status command 7-21

interface

activating 3-8, 3-9

clearing counters 3-9

command 3-8

configuration mode 3-3

configuring IP address 3-8

IP address

modifying, zone 5-9

ip address command

deleting 5-9

excluding 5-8

interface 3-8

zone 5-8

ip route command 3-10

IP scan 11-5

detected anomalies 11-2

policy template 7-3

IP summarization 12-14, 12-15

IP threshold configuration 7-18

K

key, generating for license 13-17

key command

add 4-22, 4-25

generate 4-23, 4-26

remove 4-25

key publish command 4-23

L

learning

command 8-6, 8-7

constructing policies 8-4

overview 8-2

policy-construction command 8-5

synchronizing results 8-4

terminating process 8-6, 8-7

threshold-tuning command 8-6

tuning thresholds 8-6

learning accept command 8-5, 8-7

learning parameters, displaying 8-9

learning-params

deactivating periodic action 8-7

deactivating periodic-action command 8-5

periodic-action command 5-13, 8-5, 8-7, 8-9

threshold-multiplier command 7-16

threshold-selection command 8-7, 8-10

threshold-tuned command 5-9, 8-11

learning-params command 5-13, 5-18

learning-params fixed-threshold command 7-16

licenses

generating key 13-17

ordering XG upgrade license 13-17

LINK templates 8-4

log file

clearing 12-12

exporting 12-10, 12-11

viewing 12-11

logging, viewing configuration 12-11

logging command 12-10

logging parameters, configuring 12-8

login banner

configuring 4-32

deleting 4-34

importing 4-33

login-banner command 4-32

logo

adding WBM 4-34

deleting WBM 4-35

M

maintenance partition

See MP

management

MDM 3-13

overview 3-11

port 2-3

SSH 3-13

VLAN 2-3

WBM 3-11

max-services command 7-6

MDM, activating 3-13

memory consumption 12-25

memory usage, anomaly detection engine 12-25, 12-27

min-threshold command 7-6

monitoring, network traffic 12-17

MP

booting to 2-12

upgrading 13-12

upgrading, inline 13-13

mtu command 3-9

N

netstat command 12-28

network server

configuring 13-2

deleting 13-3

displaying 13-3, 13-8

displaying sync-config 5-18, 13-7, 13-8

network server, configuring 13-2

no learning command 8-6, 8-7

non_estb_conns packet type 7-11

nonspoofed attacks 1-3

no proxy policy templates 7-4

notify 11-4

notify policy action 7-20

ns policy templates 7-4

O

other protocols

detected anomalies 11-2

policy template 7-3

out_pkts packet types 7-11

P

packet-dump

auto-capture command 12-14

automatic

activating 12-14

deactivating 12-15

displaying settings 12-15

exporting 12-17, 13-6

signatures 12-22

packet-dump command 12-15

packets, capturing 12-15

password

changing 4-8

enabling 4-10

encrypted 4-8

recovering 13-19, 13-22

pending 10-2

pending dynamic filters 10-2

displaying 10-3, 10-6

periodic action

accepting policies automatically 8-5, 8-7

deactivating 8-5, 8-7

permit

command 3-12, 3-13, 4-3

permit ssh command 4-22

ping command 12-32

pkts packet type 7-12

policy

action 7-13, 7-19, 7-20

activating 7-14

adding services 7-9

backing up current 7-27, 8-18

command 7-13

configuration mode 3-3

constructing 1-4, 8-2, 8-4

copying parameters 8-17

copy-policies 8-17

deleting services 7-10

disabling 7-14

inactivating 7-14

learning-params, fixed-threshold command 7-16

marking as tuned 5-9, 8-11

marking threshold as fixed 7-16

multiplying thresholds 7-17

navigating path 7-13

packet types 7-11

show statistics 7-25

state 7-14

threshold 7-13, 7-15

threshold-list command 7-18

timeout 7-13, 7-19

traffic characteristics 7-12

tuning thresholds 1-4, 8-2, 8-6

using wildcards 7-13, 7-24, 7-26

viewing statistics 8-8

policy set-timeout command 7-19

policy template

command 7-4, 7-5, 7-7

configuration command level 7-5

configuration mode 3-3

displaying list 7-4

Guard policy templates for synchronization 7-4

max-services 7-6

min-threshold 7-6

overview 7-3

parameters 7-5

state 7-7

worm_tcp 7-5

policy-template add-service command 7-10

policy-template remove service command 7-10

policy-type activation form 9-4

port scan 11-5

detected anomalies 11-2

policy template 7-3

power enable command 2-11

privilege levels 3-2

assigning passwords 4-10

moving between 4-11

protect

activation methods 9-4

automatic mode 9-3, 10-1

deactivating 9-5

interactive mode 10-1

protect command 9-5

protection-end-timer 9-7, 9-9

protect-ip-state command 9-4

protect learning command 8-6

protocol traffic characteristics 7-12

proxy policy templates, no proxy policy templates 7-4

public key, displaying 4-26

R

rates

history 12-5

viewing 12-5

reactivate-zones 13-8

rebooting parameters 13-8

recommendations 10-2

accepting 10-7

activating 10-4, 10-6

change decision 7-21

command 10-6

deactivating 10-3, 10-8

dynamic filters 10-2

ignoring 10-7

overview 10-2

viewing 10-4

viewing pending-filters 10-3, 10-6

reload command 13-8

remote-activate policy action 7-20

remote Guard

activating 6-15

terminating protection 9-7, 9-9

remote-guard command 9-7, 9-8

remote Guard list

displaying 9-8

remote Guards

activating 9-5

default list 9-7

list 9-8

list activation order 9-8

remove service command 7-10

renumbering flex-content filters 6-3

replied IP summarization 12-14, 12-15

report

See attack report 11-1

reports

details 11-4

exporting 13-6

reqs packet type 7-11

reset command 2-11

router configuration mode 3-3

routing table

manipulation 3-10

viewing 3-11

running-config

copy 5-16, 13-3

show 12-3

S

scanners traffic characteristics 7-12

service

adding 7-9

command 3-11, 3-13, 4-2

copy 8-17

deleting 7-10

MDM 3-13

permissions 4-3

snmp-trap 4-28

WBM 3-11

services, enabling 4-2

session, configuring timeout 4-35

session, displaying idle timeout 4-35

session timeout, disabling 4-35

session-timeout command 4-35

set-action 7-20

show commands

counters 12-5

cpu 12-26

diagnostic-info 12-24

dynamic-filters 6-13

file-servers 13-3, 13-8

flex-content-filter 6-9

host-keys 4-22, 4-24

learning parameters 8-9

learning-params 7-16

log 12-11

log export-ip 12-11

logging 12-11

login-banner 4-33

memory 12-25

module 2-2, 13-11, 13-12

packet-dump 12-15

packet-dump signatures 12-22

policies 7-24

policies statistics 7-25, 8-8

public-key 4-24, 4-26

rates 12-5

recommendations 10-4, 10-5

recommendations pending-filters 10-3, 10-6

remote-guards 9-8

reports details 11-4

running-config 12-3

show 12-4

sorting dynamic-filters 6-13

sync-config 5-18

sync-config file-servers 5-18, 13-7, 13-8

templates 5-6

zone policies 7-24

show privilege level 3-2, 4-8

show public-key command 4-26

shutdown command 3-9

signature

generating 12-21

snapshot

backing up policies 7-27, 8-18

command 8-13

comparing 8-14

deleting 8-16

displaying 8-16

overview 8-13

saving 8-13, 8-14

saving periodically 8-9

SNMP

configuring trap generator 4-28

traps description 4-29

snmp commands

community 4-32

trap-dest 4-28

software license key, displaying key information 12-2

software version number, displaying 12-2

SPAN, configuring 2-7

specific IP threshold 7-18

spoofed attacks 1-3

src traffic characteristics 7-12

SSH

configuring 3-13

deleting keys 4-25

generating key 4-23, 4-26

host key 4-24

service 3-13

viewing public key 4-24

ssh key, publishing 4-23

state command 7-14

static route, adding 3-10

supervisor engine

booting 2-12

configuring 2-1

powering off 2-11

resetting 2-11

saving configuration 2-1

shutting down 2-11

verifying configuration 2-12

syn_by_fin packet type 7-11

sync command 5-14, 5-15

synchronization

exporting configuration 13-6

syns packet type 7-11

syslog

configuring export parameters 12-10

configuring server 12-10

message format 12-10

system log, message format 12-10

T

TACACS+

authentication

key generate command 4-20

key publish command 4-23

clearing statistics 4-17

configuring server 4-14

server connection timeout 4-17

server encryption key 4-16

server IP address 4-15

viewing statistics 4-17

tacacs-server commands

clear statistics 4-17

first-hit 4-15

host 4-15, 4-16

key 4-15, 4-16

show statistics 4-17

timeout 4-15, 4-17

TCP

detected anomalies 11-2, 11-5

no proxy policy templates 7-4

policy templates 7-3

templates

LINK 8-4

viewing policies 5-6

zone 5-3

thresh-mult 7-17

threshold

command 7-15

configuring IP threshold 7-18

configuring list 7-18

configuring specific IP 7-18

marking as tuned 5-9, 8-11

multiplying before accepting 7-16

selection 8-13

setting as fixed 7-16

tuning 1-4, 8-2

worm 7-22

threshold-list command 7-18

threshold selection 8-7

threshold tuning

save results periodically 8-9

timeout command 7-19

timeout session, configuring 4-35

timeout session, disabling 4-35

traceroute command 12-31

traffic, monitoring 12-17

traffic sources

capturing 2-4

configuring 2-4

SPAN 2-4

VACL 2-4

trap 12-10

trap-dest 4-28

tuning policy thresholds 8-6

U

UDP

detected anomalies 11-3

policy templates 7-4

unauth_pkts packet type 7-12

unauthenticated TCP detected anomalies 11-3

upgrade command 13-19

upgrade license 13-17

upgrading

AP 13-10

inline 13-13

MP 13-12

user-detected anomalies 11-3

user filter

command 6-3

username

encrypted password 4-8

username command 4-7

users

adding 4-7

adding new 4-7

assigning privilege levels 4-7

deleting 4-9

privilege levels 3-2, 4-10

system users

admin 2-10

riverhead 2-10

username command 4-7

V

VACL, configuring 2-4

version, upgrading 13-19

W

WBM

activating 3-11

WBM logo

adding 4-34

deleting 4-35

worm

dynamic filter 7-23

identifying attack 7-23

overview 7-22

policy 7-11, 7-12

policy templates 7-4, 7-23

thresholds 7-22, 7-23

worm_tcp policy template 7-5

X

XG software image

license key 13-17

obtaining software image 13-17

XG software version, 2-Gbps operation 13-17

XML schema11-7to 11-9, 12-17, 13-7

Z

zombies 1-3

zone

anomaly detection 9-2

clearing counters 12-6

command 5-5, 5-6, 10-4

command completion 4-13, 5-7

comparing 8-15

configuration mode 3-3, 5-7

copying 5-6

creating 5-5

defining IP address 5-8

deleting 5-6

deleting IP address 5-9

duplicating 5-6

excluding IP address 5-8

exporting configuration 5-17

IP address 5-8

learning 8-2

LINK templates 8-4

modifying IP address 5-9

operation mode 5-6

reconfiguring 5-7

synchronize configuration 5-10

synchronizing automatically 5-13

synchronizing offline 5-15

templates 5-3

viewing configuration 5-8

viewing policies 7-24

viewing status 12-4

zone policy

marking as tuned 5-9, 8-11

zone synchronization 8-4